Governance, Risk and Compliance

Area Overview

Governance, risk and compliance is a dynamic and integral part of product development and management. It’s not a one-time activity but a continuous process that evolves with the organisation, the product and the surrounding threat landscape. By setting clear expectations, managing risks and meeting obligations effectively, organisations can not only protect their products but also support their overall business objectives and maintain customer trust.

These capabilities ensure you can govern how product security is delivered, and identify, assess, and mitigate the risks associated with it. Governance establishes the policies, processes and procedures, the accountabilities and responsibilities, and the people and skills that make security achievable. Risk management and compliance then ensure that decisions about suppliers, data, business impact and threats are made deliberately and meet your legal, regulatory and contractual obligations. This approach is crucial in today's landscape where products, especially digital or software-based ones, face a myriad of security threats that can impact not only the product's functionality and integrity but also the organisation's reputation and customer trust.

Benefits

• Enhanced Product Security: By setting clear expectations and systematically managing risks, the security of the product is significantly enhanced.
• Informed Decision Making: It provides stakeholders with crucial information, aiding in making informed decisions about product development and security investment.
• Clear Accountability: People understand what they are accountable and responsible for, and have the skills and support to deliver it.
• Regulatory Compliance: Helps in meeting legal and regulatory requirements, reducing the risk of penalties or legal issues.
• Customer Trust and Brand Protection: A secure product fosters customer trust and protects the brand's reputation.

Policies, Processes and Procedures [PSCF‑GRC‑PPP]

The capability to define and apply clear expectations, implementable processes and ways of working that meet these requirements

Capability Overview

Policies, Processes and Procedures is the capability that turns leadership's intent into something a product team can actually follow. A policy that exists only as a PDF nobody reads has no effect on behaviour; this capability closes the gap between stated expectation and daily practice, so that "what we require" and "what actually happens" describe the same thing.

This capability spans three related but distinct artifacts. Policies set expectations — what must be true, and why. Processes describe the repeatable sequence of activities that gets you there. Procedures give the specific, step-by-step detail an individual needs to execute a single instance of that process correctly. Confusing these layers is a common failure mode: an organisation with strong policy and weak procedure produces good intentions and inconsistent outcomes; an organisation with strong procedure and no policy produces consistent activity with no clear purpose behind it.

Getting this right depends on making the material genuinely usable by the people expected to follow it — written at the right level of detail, discoverable when needed, and kept current as the organisation and its products change. A policy library that is accurate but unreachable, or reachable but stale, fails the same test as having no policy at all.

Compliance Requirement

Accountability

Responsibility

Organisational Operating Model [PSCF‑GRC‑OOM]

The capability to evaluate and apply fair and scalable accountabilities and responsibilities for capabilities across the delivery organisation.

Capability Overview

Enable the definition and refinement of the internal structure of a product delivery organisation introduces the vital capability of Organisational Operating Model (OOM). This capability plays a pivotal role in facilitating well-defined structures, streamlined processes, and collaborative ways of working, all aimed at crystallising the accountabilities and responsibilities within the organisation.

At the heart of OOM lies the articulation of roles and responsibilities, ensuring every team member understands their contribution to the organisation's success. This clarity is not just about internal coherence; it extends to delineating a transparent and accountable framework that resonates with external regulatory expectations. A key aspect of OOM is ensuring that the model is not just robust but also adaptable, capable of scaling and evolving in harmony with the organisation's growth and the dynamic regulatory landscape.

Involvement of leadership and stakeholders is crucial in OOM. These key players must possess a deep understanding of the organisation's goals, the intricacies of product delivery, and the regulatory requirements that shape the industry landscape. They are instrumental in addressing 'what if' scenarios that might challenge the existing operational model, ensuring the organisation remains resilient and responsive to change.

Choosing the right structure and processes to focus on within the OOM is essential. While it might be tempting to cover every conceivable aspect, the priority should be on those areas that significantly influence accountability, transparency, and compliance, ensuring a robust, compliant, and efficient operating model.

Compliance Requirement

Accountability

Responsibility

Risk Management [PSCF‑GRC‑RM]

The capability to identify and evaluate risks throughout the product delivery processes and apply mitigations to minimise potential negative impacts on the organisation

Capability Overview

Risk Management, as a capability within Governance, Risk and Compliance, is the practical discipline of identifying, assessing, treating and monitoring the risks that specific product delivery decisions create — distinct from the area's overall name, which describes the broader governance function this area covers.

This capability requires a consistent method for taking a risk from initial identification through to a decision about how it will be treated: accepted, mitigated, transferred or avoided. The method matters as much as the outcome, because a risk decision made through a repeatable, documented process can be defended and revisited; a risk decision made informally, however sound at the time, cannot.

Product delivery generates risk continuously — new features, new dependencies, new integrations, new markets — and this capability is what keeps pace with that rate of change, ensuring risk decisions are made by people with the authority and context to make them, recorded in a way that survives staff turnover, and revisited when the underlying assumptions change.

Compliance Requirement

Accountability

Responsibility

Continuous Capability Improvement [PSCF‑GRC‑CCI]

The capability to evaluate capabilities in this framework that require improvement and apply improvements over time.

Capability Overview

Your capacity for Continuous Capability Improvement reflects the ability of your organisation to systematically evaluate and enhance the security aspects of product delivery. This capability is essential for keeping pace with the ever-evolving landscape of technological advancements and changing work practices.

As the world and technology evolve, so must our security practices to prevent the emergence of new vulnerabilities. This involves not only adapting to new technologies and methodologies but also proactively anticipating future changes and challenges. The importance of continuous improvement in security measures is a vital aspect of product development and management, ensuring that what is secure today remains secure tomorrow. This capability, like all others in the realm of product security, requires ongoing development and refinement to effectively protect against emerging threats and to align with the latest technological innovations.

Compliance Requirement

Accountability

Responsibility

Workforce Development and Retention [PSCF‑GRC‑WDR]

The capability to attract, develop, and retain competent individuals in alignment with organisational objectives

Capability Overview

Workforce Development and Retention is the capability to build and keep a workforce with the security skills a product delivery organisation actually needs — recognising that every other capability in this framework depends on people who understand it well enough to apply it.

Security skills are scarce, and the market for people who hold them is competitive. An organisation that only recruits for these skills, without also investing in developing them internally, will find itself permanently exposed to the market's constraints and to the disruption caused whenever an experienced person leaves. Developing skills in place — through training, mentoring, and structured career paths in and around security — is both cheaper over time and more resilient than a recruit-only strategy.

Retention is the other half of the equation, and it is frequently under-invested relative to development. Skills built through training or experience represent a real organisational asset, and losing the people who hold them is a loss of capability, not just a staffing gap. This capability asks an organisation to treat the retention of skilled people as deliberately as it treats the retention of any other valuable asset.

Compliance Requirement

Accountability

Responsibility

Third-Party Components [PSCF‑GRC‑TPC]

The capability to evaluate and select third-party component suppliers.

Capability Overview

Recognising that it is impractical to build every component in-house, this capability involves making informed decisions about utilising third-party solutions, such as databases, cloud-based services, secrets storage, etc.

The core challenge here is to determine which third-party components are secure and suitable for use. This decision-making process might involve creating and maintaining an approved list of components that meet security standards (the 'allow' list) or a list of prohibited components (the 'deny' list).

Understanding the importance of having a robust process to assess and authorise third-party components ensures that your product's security is not compromised. Consider how you managing these lists, including how to handle exceptions and ensure that all necessary components are evaluated for security before use.

Compliance Requirement

Accountability

Responsibility

Third-Party Software Development Services [PSCF‑GRC‑TPD]

The capability to evaluate and select secure third-party development services suppliers.

Capability Overview

This capability is vital when outsourcing software creation, as it involves ensuring that these external parties not only meet but ideally exceed your organisation's standards for quality and security.

A crucial aspect of this process is establishing clear communication and collaboration methods with the third-party developers, especially considering the sensitivity and confidentiality of the projects, which often include intellectual property and new product development.

It is important to clearly define ownership and usage rights in contractual agreements and maintain a balance between confidentiality, availability, and integrity. This ensures that the third-party services are fully aligned with your organisational goals and deliver the desired outcomes promptly, maintaining a competitive edge in the market.

Compliance Requirement

Accountability

Responsibility

Third-Party Software-as-a-Service [PSCF‑GRC‑TPS]

The capability to evaluate and select secure SaaS offerings from third parties.

Capability Overview

Choosing Software as a Service (SaaS) providers is more complex than selecting general third-party components due to the critical nature of the services provided and the intricacies of contractual agreements. This capability is essential for integrating business-critical systems like Identity Providers (IdPs), online log management services, or Content Delivery Networks (CDNs) into an organisation's operations. These services, often crucial for automation or computational tasks, are not typically core to a business but are fundamental to its smooth functioning.

The selection process requires careful consideration because these SaaS offerings will handle sensitive data and play a significant role in the overall security of the product. When choosing SaaS providers, ensure they align with your organisation's security needs and business goals. It is important to understand the various offerings in the market and make informed decisions based on the security, reliability, and compatibility of these services with the business's requirements.

Compliance Requirement

Accountability

Responsibility

Compliance Obligations [PSCF‑GRC‑CO]

The capability to define, understand and apply your obligations for compliance to your product delivery process.

Capability Overview

Internal compliance encompasses voluntary standards an organisation might adopt, like ISO27001 or SOC 2, which are chosen for their value in enhancing operations or customer trust. External compliance, on the other hand, involves adhering to legal and industry-specific regulations, such as the Data Security Standard (PCI-DSS) for businesses involved in the Payment Card Industry. Failure to comply can lead to legal issues or loss of operational licenses.

This capability requires a thorough understanding of what each set of compliance obligations entails, ensuring that an organisation not only recognises its required obligations but also implements the necessary practices to meet them. It also involves evaluating the cost-effectiveness and value of complying with internal standards, a critical factor in strategic decision-making and resource allocation

Compliance Requirement

Accountability

Responsibility

Data Processing Obligations [PSCF‑GRC‑DPO]

The capability to define, understand and apply your obligations for data processing to your product delivery process.

Capability Overview

Part of an organisation's broader compliance obligations, requiring a clear understanding of the specific regulations that apply, such as the General Data Processing Rules (GDPR) for businesses operating in Europe. It is important to comprehending the full scope of data processing, including the nature of the data, its intended use, and the adherence to specific requirements of regulations like GDPR. You must also be aware of any third-party entities involved in data processing and ensure their compliance with relevant regulations. This capability is crucial for organisations to meet regulatory standards and avoid potential legal complications.

Compliance Requirement

Accountability

Responsibility

Business Impact Assessment [PSCF‑GRC‑BIA]

The capability to analyse the business value of products and the effects security disruptions to that product will have on business.

Capability Overview

Analysing the business value of products and the impact of security disruptions centres around the vital process of Business Impact Assessment (BIA) within a product delivery organisation.

This capability involves assessing how different levels of security incidents can affect the value and operations of a product. A crucial aspect of BIA is determining the appropriate level of detail for the assessment, ensuring it's sufficient to understand the impact without losing sight of the overall business value. Another key factor is the involvement of someone who can represent and articulate the business interests effectively. This person should have an in-depth understanding of the product or service to address potential 'what if' scenarios. The choice of scenarios to be discussed in the BIA is also critical. While it's not necessary to cover every possible scenario, the focus should be on those most relevant and likely to impact the business, ensuring a thorough and meaningful assessment.

Compliance Requirement

Accountability

Responsibility

Data Protection Impact Assessment [PSCF‑GRC‑DIA]

The capability to analyse the potential impact to the data subject that a failure of data protection would have.

Capability Overview

Navigating the intricate landscape of data handling and processing, especially under the stringent regulations of GDPR, introduces the imperative capability of Data Protection Impact Assessment (DPIA) within a product delivery organisation.

This capability is centred on meticulously evaluating the data processing activities of a product and understanding the potential privacy impacts these activities may have on individuals. A pivotal aspect of DPIA is the depth and thoroughness of the assessment, ensuring it's comprehensive enough to cover all relevant data processing nuances without overshadowing the primary objective of safeguarding personal data. It's crucial to involve someone with a profound comprehension of the GDPR's requirements and the specific data processing activities of the product. This individual should be adept at dissecting and addressing potential data protection risks and envisaging 'what if' scenarios related to data breaches or misuse. Selecting the most pertinent and impactful data processing activities to assess is also paramount. While it may not be feasible to scrutinise every minor processing detail, the focus should be on those activities that pose significant privacy risks, thereby ensuring a robust and meaningful DPIA.

Compliance Requirement

Accountability

Responsibility

Threat Intelligence [PSCF‑GRC‑TI]

The capability to define and understand criminal abuses your product might be exposed to and apply this understanding to product delivery.

Capability Overview

Defining and understanding criminal abuses a product might face, and applying this knowledge to product delivery, revolves around developing a comprehensive threat intelligence capability.

This involves a deep understanding of the product, user activities, and the potential threat actors and their methods. The capability spans various levels of threat intelligence, including operational intelligence which offers technical data feeds for immediate threats, tactical intelligence that requires more specific interpretation and evaluation related to the product and market, and strategic intelligence that encompasses broader geopolitical and industry-wide events.

Effective threat intelligence is crucial in proactively identifying and mitigating potential risks to the product, but it also requires careful balancing of resources and expertise to manage the associated costs. This capability is integral in ensuring the security and integrity of the product in a dynamic threat landscape

Compliance Requirement

Accountability

Responsibility