Homework — Lesson 14
Two tasks · ~30 minutes · Applied to your own organisation
Task 1 — Write your five questions
List the five evidence-forcing questions you will start asking about your own organisation's posture, and identify who owns the answer to each.
✓ Self-check: each question demands a date, duration, name, or number — none can be answered with a reassuring "yes."
Task 2 — Swap one vanity metric
Identify one metric your organisation currently reports that measures activity rather than risk, and propose the outcome metric that should replace it.
✓ Self-check: your replacement measures an outcome (time, coverage, recovery) rather than effort.
Task 3 (optional) — Check your ownership
Write one sentence stating who owns cyber risk in your organisation. If the honest answer is "IT," note what needs to change.
✓ Self-check: risk ownership sits with leadership; the CISO runs the programme but does not absorb the accountability.