Lesson 14 — Operating Model & The Questions To Ask
Security is a governed capability you steer with questions and funding — not a project that finishes. This lesson gives you the model to run it and the questions that expose real posture.
Day 3GovernanceQuestions
Notes: The leadership-operating lens. The payoff is the question set — what to ask to see the truth.
Lesson 14 · Slide 2
A programme, not a project
Projects finish; threats don't — security is ongoing capability
It is governed and run, with owners, cadence, and accountability
Resilience is built in peacetime and funded continuously
The leader steers it with questions and budget, not day-to-day control
The reframe
"We did a security project last year" is not a posture. A living programme is.
Notes: Reveal each. Kills the "we're done" mindset. The leader's tools are governance and funding.
Lesson 14 · Slide 3
Who owns what
The board — oversight; assures risk is managed to appetite
The CEO — owns the risk; it cannot be fully delegated away
The CISO — runs the programme; translates risk into controls
Everyone — owns their own behaviour; culture is a control
The trap
"IT owns cyber" is the classic failure (recall Day 1). Risk ownership sits with leadership; the CISO runs it, but does not absorb the accountability.
Notes: Reveal each. Clarify the difference between running the programme (CISO) and owning the risk (CEO/board). Callback to Lesson 01.
Lesson 14 · Slide 4
Three lines of defence
1st line — operational management owns & runs controls
→
2nd line — risk & compliance set policy & oversee
→
3rd line — internal audit independently assures
Why it works
Separating "do," "oversee," and "assure" stops the people running controls from being the only ones grading them.
Notes: Reveal step by step. A widely used governance structure; the independence of the third line is the point.
Lesson 14 · Slide 5
A shared language: NIST CSF 2.0
Six functions give leaders and technologists one vocabulary. Press →.
GOVERN — leadership in the loop
→
Identify
→
Protect
→
Detect
→
Respond
→
Recover
Notes: Reveal each. Govern is highlighted deliberately — it is the 2.0 addition that puts leadership formally in the loop. Framework as concept, not product.
Lesson 14 · Slide 6
Why "Govern" changes the game
Earlier models treated security as a technical lifecycle. Adding Govern makes explicit what this whole course argues: leadership, risk appetite, roles, and accountability are part of security itself.
The message
You are not a bystander to the framework. Govern is your function.
Notes: Reinforce the executive's formal role. This slide is the intellectual anchor of the operating model.
Lesson 14 · Slide 7
Managing it as a system: ISO/IEC 27001
An information security management system (ISMS) — a governed, auditable way to run security
Certifiable — independent assurance you meet a recognised bar
Emphasises continual improvement, not a one-time pass
Why you care
Certification is evidence of a managed system, not a guarantee of safety. "We passed an audit" is a floor, never a ceiling (recall Day 1).
Notes: Reveal each. Balance: frameworks structure the work but don't equal security. Callback to Lesson 01's "we passed an audit."
Lesson 14 · Slide 8
Metrics that matter vs vanity metrics
Metrics that matter
Time to detect and to respond
Control coverage of crown jewels
Backup restoration success & time
Vanity metrics
"Emails blocked" and raw alert counts
Numbers that only ever go up and to the right
Activity without outcome or risk reduction
Notes: Reveal each. Vanity metrics feel reassuring and measure effort, not risk. Outcome metrics tell you if you're actually safer.
Lesson 14 · Slide 9
Which question best exposes your real security posture?
C. "Are we secure?" (A) invites a comforting yes. B and D check for the existence of controls or certificates, not whether they work. C forces evidence: a date and a duration that either exist or reveal a gap. Evidence-forcing questions cut through reassurance; yes/no questions invite it.
Notes: The lesson's core skill. A/B/D can all be answered reassuringly; C cannot be faked. Teach leaders to ask for evidence, not comfort.
Lesson 14 · Slide 10
The questions a leader should ask
Crown jewels — "What matters most, and who can reach it?"
Detection — "How would we know we're breached, and how fast?"
Recovery — "When did we last test our backups and our incident plan?"
Risk — "What's our biggest unfunded risk right now?"
Supply chain — "Which supplier could take us down?"
Leadership move
You do not need to run the controls. You need to ask the questions that make evidence — or gaps — visible.
Notes: Reveal each. These five recur across the course. They are evidence-forcing and cut across every earlier lesson.
Lesson 14 · Slide 11
Two-minute drill: your Monday question
Write the single evidence-forcing question you will ask your security leadership this week — one that cannot be answered with a reassuring "yes."
Notes: Start the timer. Turning the lesson into one real question they will actually ask is the behavioural change.
Lesson 14 · Slide 12
Recap & what's next
Security is a governed programme; Govern is your function
Three lines of defence; measure outcomes, not activity
Steer with evidence-forcing questions, not reassuring ones
Next
Lesson 15 — Capstone: a live multi-vector crisis tabletop that puts every lesson to the test.
Notes: Bridge: the operating model and questions now meet reality in the capstone tabletop.