Articles
Asset and service inventory: knowing what you actually run
An inventory is a record with checkable properties, not a database: what CM-8 requires.
Security governance foundations
Directly assigned
Articles
The asset lifecycle: from acquisition to sanitisation
The inventory is a snapshot; the lifecycle is the process that ends an asset.
Articles
Classifying information: impact levels before labels
The impact level is the decision; the label only carries it to the object it governs.
Articles
Owner, custodian and service owner: three names on one asset
Three hats on one asset: who sets the rules, who runs it, and what the register names.
Articles
Roles, responsibilities and RACI: who does it and who answers for it
A RACI chart maps activities to roles; done badly it hides who answers for what.
Articles
Scope, assumptions and system boundaries: drawing the line around a system
Drawing a system boundary: the decision it encodes and the assumptions it rests on.
Articles
The structure of a security policy: what the document must contain
The parts a security policy must contain, and what their presence does not prove.
Articles
Asset owner, risk owner, service owner: who is accountable for what
Asset, process and risk are owned differently; NIST names who is accountable for each.
Articles
Assets, processes, data and dependencies: the scope of a security decision
An asset matters for its process and data; scope is a chain, not a perimeter.
Articles
Confidentiality, integrity and availability: what security actually protects
Security protects three separate properties, not one attribute: each has its own impact.
Articles
Least privilege and defense in depth: two principles, two different jobs
Least privilege bounds one identity; defense in depth bounds one failure.
Articles
Policy, standard, procedure, guideline: four levels of instruction
Policy states intent, standards bind, procedures give the steps, guidelines advise.