## Intro This workshop turns cybersecurity governance into concrete decisions, accountable ownership, and measurable actions for technology organizations. It anchors choices in recognized practices (NIST Cybersecurity Framework 2.0, ISO/IEC 27001, and enterprise risk management) and produces a risk-informed, 90-day plan that technology leaders can run in half to one day. Who it is for: CTOs, CIOs, CISOs, engineering and product leaders who must balance delivery speed with security, compliance, and cost. Practical takeaway: leave with a prioritized control set, clear decision rights, defined risk appetite and tolerance, evidence requirements, incident governance, third‑party risk decisions, and a metrics dashboard suitable for executives and the board. ## When to use (and when not) Use this workshop when: - Roadmaps or architectures change and introduce new cyber risks. - Certifications or audits (e.g., ISO 27001) require policy, control, and evidence updates. - Customers or regulators request assurance or board reporting needs clarity. - You must prioritize security investments against limited capacity. Do not use it as: - A substitute for detailed threat modeling or red teaming. - A compliance checkbox without owners or evidence. - An incident postmortem (run a dedicated review, then feed outputs into this workshop). Prerequisites: - Current asset inventory and critical data flows. - Latest policies and known exceptions. - Open risks and third‑party list. - Capacity and budget envelope for the next 90 days. Limitations and common misunderstandings: - Governance does not eliminate risk; it makes risk explicit and directed by appetite and tolerance. - Policies without evidence are weak controls; define what proof you will keep. - Vanity metrics (e.g., number of tools) do not show risk reduction; focus on leading, lagging, diagnostic, and guardrail measures. ## Governance anchors you will use - NIST CSF 2.0 functions: Identify, Protect, Detect, Respond, Recover to classify controls and gaps. - ISO/IEC 27001: control objectives, Annex A controls, and evidence requirements. - Enterprise Risk Management (ERM): define risk appetite (the level of risk you are willing to pursue) and risk tolerance (acceptable deviation by domain), with treatment options: avoid, mitigate, transfer, accept. ## Roles, decision rights, and pre‑work Required roles: - Executive sponsor (CIO/CTO/CISO): sets risk appetite and resolves value trade‑offs. - Security lead: frames threats, control options, constraints, and evidence. - Product or platform lead: customer impact and delivery reality. - Engineering lead: feasibility, effort, and reversibility. - Data privacy/compliance: obligations, lawful basis, audit needs. - Incident response/SRE: failure modes, playbooks, guardrails. - Vendor management/procurement: third‑party risk and contracts. Decision rights (use a DACI/RACI hybrid): - Driver: security lead (prepares options and recommendation). - Approver: executive sponsor (accepts residual risk and allocates investment). - Contributors: product, engineering, privacy, incident/SRE, vendor mgmt. - Informed: finance, legal, customer success, audit. Pre‑work checklist: - One‑page business context and top outcomes. - Current risk register and exceptions. - Evidence map: what logs, tickets, configs, and reports exist per control. - Incident and third‑party summaries (last 12 months). - Capacity and budget estimate for the next quarter. ## Timed agenda (4–7 hours total) - Orientation and objectives (15 min) - Business and risk context: appetite and tolerance (30 min) - Current posture snapshot vs NIST CSF 2.0 (45 min) - Obligations and evidence needs (ISO 27001) (30 min) - Threats and scenarios, incl. third‑party (45 min) - Control objectives and options (60 min) - Investment prioritization and decision (45 min) - Metrics and evidence plan (30 min) - Exception and incident governance updates (20 min) - 90‑day action plan, owners, due dates (40 min) - Board/exec reporting draft (20 min) Timebox each section and record decisions as you go. ## Core questions to drive decisions - Business value: Which customer, revenue, or cost risks are we reducing? - Appetite and tolerance: What level of loss, downtime, or data exposure is acceptable per domain? - Assets and flows: Which data and transactions are critical (crown jewels)? - Threats: What credible attack paths matter in our context? - Obligations: Which laws, contracts, or certifications apply, and what evidence is required? - Third‑party: Which suppliers create concentration or data risk? - Trade‑offs: What speed, UX, or cost will we exchange for risk reduction? - Metrics: What leading, lagging, diagnostic, and guardrail metrics prove impact and safety? - Reversibility: What is the rollback plan and which steps are irreversible? ## Exercises that convert talk into choices - Quick SWOT of posture: top strengths to leverage, weaknesses to reduce, threats, and obligations. - Control‑to‑value mapping: categorize options as Prevent/Detect/Respond/Recover; list user friction and dependencies. - Prioritization score: Risk reduction per unit effort = (Inherent risk − Residual risk) × Impact weight ÷ Estimated effort/cost. - Pilot design: hypothesis, cohort, guardrails, evidence, and rollback using feature flags or shadow validation. - Abilene checks: collect independent positions, vote anonymously, record dissent and assumptions. ## Completed example risk scenario (illustrative) - Scenario: Compromised admin credentials allow privilege escalation in the admin console. - Inherent risk: Likelihood High, Impact High (critical data access, service disruption). - Control objectives: Reduce probability of unauthorized admin action and detect anomalies within minutes; ensure recoverability within RTO/RPO. - Selected controls: Step‑up MFA for high‑risk admin actions (Protect), anomaly detection on admin events (Detect), privileged access workflow with approvals (Protect), incident playbook for admin compromise (Respond), tested backups of admin policy store (Recover). - Residual risk (target): Likelihood Medium, Impact High. - Treatment: Mitigate. Exception request for two legacy service accounts with compensating controls and 60‑day remediation. - Risk owner: Platform engineering director. - Due date: Controls in pilot by Day 30; full rollout by Day 75; exception closure by Day 90. - Key Risk Indicators (KRIs): - Leading: % of admin high‑risk actions challenged by MFA; % coverage of anomaly rules over admin events. - Lagging: Confirmed admin credential abuse attempts; mean time to detect (MTTD) and contain (MTTC) admin anomalies. - Guardrails: Admin task completion rate; false positive challenge rate; support contacts related to access. - Risk appetite/tolerance reference: Admin compromise residual risk must be Medium or lower; guardrail thresholds: false positives <2% and admin completion rate ≥97%. ## Templates you can copy Risk register (minimal fields):
IDScenarioAsset/FlowInherent (L/I)ControlsResidual (L/I)TreatmentOwnerDueKRIsAppetite/Tolerance note
R‑001Admin credential compromiseAdmin consoleH/HMFA, anomaly detection, approvalsM/HMitigateEng Dir2026‑10‑31MTTD, MTTC, FP%Residual <= Medium
Control decision record:
ControlObjective (SMART)CSF FunctionISO RefEffortDependenciesDecisionRationaleEvidence
Step‑up MFACut unauthorized admin actions by 40% in 30 daysProtectAnnex A ACMIdP, app changesApproveHigh risk reductionAuth logs, policy config, test results
Exception register:
Exception IDPolicy/ControlScopeJustificationCompensating ControlsExpiryOwnerReview Date
EX‑012MFA for service accountsLegacy jobsTech constraintIP allowlist, vault rotation, monitoring2026‑11‑30Ops Lead2026‑10‑31
Metrics dashboard (define clearly): - Leading: control coverage %, patch SLAs met %, MFA challenge rate for high‑risk actions. - Lagging: incidents by severity, loss events, downtime violating SLAs. - Diagnostic: alert fidelity, backlog age, mean time to remediate vulnerabilities. - Guardrail: auth failure rate, support tickets from security changes, privacy complaints. - Vanity (avoid): number of tools, number of policies without context. 90‑day action plan:
WorkstreamKey actionsOwnerWeek 2Week 4Week 8Week 12
Admin hardeningShip step‑up MFA pilot, tune, roll outEng DirPilotTuneRolloutValidate
DetectionAdd admin anomaly rules, test playbookSec LeadRulesDry runDrillDrill
EvidenceMap ISO evidence, automate exportsComplianceMapScriptsSampleAudit pack
VendorValidate IdP and SIEM SLAsProcurementReviewNegotiateSignReport
## Third‑party and incident governance Third‑party risk decisions: - Maintain an inventory of critical suppliers (hosting, IdP, payments, analytics). - For each, capture data processed, access granted, security attestations, outage and breach SLAs, and right‑to‑audit terms. - Set trigger points for reassessment (scope change, incident, renewal) and define compensating controls for gaps. Incident governance: - Define severity levels, decision thresholds, and notification obligations. - Maintain tested playbooks for top scenarios; track MTTD, MTTC, and time to notify stakeholders. - Document breach decision criteria and external communications approval. Board and executive reporting (one page): - Top 5 risks vs appetite with trend arrows. - Quarter investment and realized risk reduction (score and narrative). - Control coverage heatmap by CSF function. - Incidents and lessons learned; exceptions aging; third‑party status. ## Evidence requirements (make audits easy) For every control, specify evidence type, system of record, retention, and retrieval path. Examples: configuration baselines, access reviews, ticket history, test results, monitoring screenshots, vendor certificates with validity dates. Automate where possible. ## Putting it together: the workshop flow in practice - Confirm scope, decision rights, and timebox. - Reaffirm appetite and tolerance by domain (e.g., data loss, availability, fraud). - Show posture vs NIST CSF 2.0; highlight top gaps. - Align ISO 27001 control objectives and evidence needs. - Walk through 2–3 risk scenarios (include one third‑party case). - Score options with the prioritization formula; pick 2–4 for this quarter. - Define pilots, guardrails, and rollback. - Finalize owners, due dates, and the 90‑day plan. - Draft the board page and confirm how metrics will populate it. ## Conclusion A good cybersecurity governance workshop makes risk explicit, ties controls to business outcomes, and produces evidence‑backed decisions you can defend to customers, auditors, and the board. Use this template to anchor choices in NIST CSF 2.0 and ISO 27001, define appetite and tolerance, prioritize investments by risk reduction per effort, and ship a 90‑day plan with clear owners and metrics. Keep it disciplined, measurable, and reversible where possible, and iterate quarterly to build a durable, value‑aligned governance rhythm.