Assess the whole programme and report it to a board

capstone · 150 min · Objective 5.5

Task

Pull Domain 5 together: assess the security programme you have built across this course against a named standard, produce the risk position, and write the board report — one page, in business terms, ending in the decisions you are asking for.

Steps

  1. Choose and name the standard, with its version. Assess the programme against at least twenty of its controls, reusing the gap analysis from the 5.1 lab and extending it to cover Domains 3 and 4.
  2. Produce the risk position: take the register from the 5.2 lab and update every entry against what you now know, including the measurements from the Domain 3 recovery labs and the Domain 4 detection labs.
  3. Identify what is OUTSIDE appetite. State the appetite you are measuring against — expansionary, conservative or neutral — and which entries breach it.
  4. List the risks that have been accepted, who accepted each, and when each is next reviewed. This is the item most often omitted from board reporting and the one with the sharpest governance consequence.
  5. Write /tmp/board-report.md, ONE page: the three things that could stop the business, the trend since the last report, what is outside appetite, what has been accepted on the board's behalf, and the decisions you are asking for — funding, acceptance, or a change of direction.
  6. Write the technical appendix separately. The board report must stand alone without it.
  7. Finally, review your own report against the test in the lesson: does it contain a vulnerability count, a severity distribution, or any number a board cannot act on? Remove them.

Verify

python3 - <<'PY'
import re
t=open('/tmp/board-report.md').read()
words=len(t.split())
print('board report length:',words,'words')
assert words<=700, 'the board report is longer than a page - it will not be read'
low=t.lower()
need={'top risks':'could stop|top risk|greatest',
      'trend':'trend|since the last|improving|worsening',
      'outside appetite':'appetite',
      'accepted on their behalf':'accepted',
      'decisions asked for':'decision|we are asking|recommend'}
missing=[k for k,p in need.items() if not re.search(p,low)]
assert not missing, 'missing from the board report: '+', '.join(missing)
tech=re.findall(r'\b(cvss|cve-\d{4}|port \d+|tcp/\d+|sha256)\b', low)
assert not tech, 'technical detail that belongs in the appendix: '+', '.join(set(tech))
print('board report contains all five required elements and no technical noise')
PY
awk -F, 'NR>1 {n++} END {print n" control(s) assessed"}' /tmp/programme-gap.csv
python3 - <<'PY'
import csv,re
rows=list(csv.DictReader(open('/tmp/register-final.csv')))
acc=[r for r in rows if r['strategy'].strip().lower()=='accept']
assert acc, 'no accepted risks in the final register'
for r in acc:
    assert r['accepted_by'].strip(), 'an accepted risk with nobody named: '+r['id']
    assert re.match(r'\d{4}-\d{2}-\d{2}', r['review_date'].strip()), 'accepted risk with no review date: '+r['id']
print('%d accepted risk(s), each named and dated' % len(acc))
PY

The length assertion is not arbitrary: a board report that runs past a page gets skimmed, and the material that gets skipped is the part asking for a decision. The technical-noise assertion enforces the lesson's point — a board cannot act on a CVSS distribution, and including it signals that the report was written for the author rather than the reader.

Notes

The accepted-risk section is the one to get right. Risks accepted on the board's behalf, by people acting under delegated authority, are the board's exposure and they frequently never appear in what the board sees. Listing them — with who accepted each and when it is revisited — is the single most useful thing a security report can contain, and it is the natural end of this course: the technical work of Domains 1 to 4 becomes a decision somebody with the authority to make it has actually made.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.