Facilitator Notes & Model Answers — Lesson 14
For instructors and self-study · Model operating model and rationale
Model operating-model map
| Element | Reference position |
|---|---|
| Risk owner | CEO / board — accountable, cannot delegate the risk away |
| Programme owner | CISO — runs controls, translates risk, reports evidence |
| 1st / 2nd / 3rd line | Operational management / risk & compliance / independent internal audit |
| Framework | NIST CSF 2.0 for shared language (Govern added); ISO/IEC 27001 ISMS for a managed, auditable system |
Model metric set
- Mean time to detect and mean time to respond.
- Control coverage of crown-jewel systems.
- Backup restoration success rate and restoration time.
- Percentage of critical suppliers meeting security requirements.
- Open high-risk findings and their age.
Model board questions
- What are our crown jewels and who can reach them?
- How would we know we are breached, and how quickly?
- When did we last successfully restore from backup, and how long did it take?
- What is our biggest unfunded risk right now?
- Which supplier could take us down, and what do we require of them?
Why the poll answer is C (last successful restore)
- A — "are we secure?": invites a reassuring, unfalsifiable yes.
- B — firewall/antivirus: checks existence of controls, not effectiveness.
- C — last successful restore + time: demands evidence — a date and a duration that exist or expose a gap.
- D — passed the audit: a certificate is a floor, not proof of real-world resilience.
Teaching point: evidence-forcing questions cut through reassurance. Train leaders to ask for a date, a duration, a name, or a number.
Homework — what good looks like
Task 1
Strong questions each demand concrete evidence and have a named owner.
Task 2
The best swaps replace an activity count with an outcome measure tied to risk reduction.
Task 3
A good answer places risk ownership with leadership and flags the "IT owns cyber" fallacy where it persists.