A shop buys a till nobody checked
A shop buys a cheap till system. Nobody asked if it was safe. Nobody owns it. Six months later, card details leak.
Each part of that story is a missed principle. Today you learn six principles that stop it.
Key words
| Word | What it means |
|---|---|
| IT governance | Good rules for how a company buys, runs and uses IT. |
| Principle | A basic rule that guides decisions. |
| Asset owner | The person in charge of one system or set of data. |
| Secure by design | Planning for safety from the start, not adding it later. |
| Personal data | Facts about a real person who can be named from them. |
| Data controller | The one who decides why and how personal data is used. |
| Data processor | The one who handles personal data on the controller's orders. |
| Conformance | Using IT in line with the laws and rules that apply. |
| Technical control | A safeguard made by technology, such as a lock on a file. |
| Non-technical control | A safeguard made by people and rules, such as training. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can name six IT governance principles and say how each one helps keep information safe.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
The six principles
IT governance has six principles. Think of them as six questions a company asks.
Responsibility. Who owns this? Strategy. Is the plan safe? Acquisition. Is this purchase wise? Performance. Is it good enough? Conformance. Does it follow the rules? Human behaviour. What will people really do?
Responsibility and strategy
Responsibility: every person involved in security knows their own job. Examples are the asset owner, the data controller and the data processor.
Strategy: plans are secure by design. They count security limits and future needs, such as cloud services and sharing data. The plans serve what the business needs.
Acquisition and performance
Acquisition: every purchase is checked for risk, benefit and cost. The choice is open and written down, so anybody can see why it was made.
Performance: the right levels of prevention and repair are in place. They keep data confidential, correct and available.
Check: the first four
Have a go
Check: the first four
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.