What monitoring is for
When risk management is federated, the security office no longer does the work itself, so it needs another way to know how the work is going. Federated Practice Monitoring provides it.
It reads the records that resource teams already keep and turns them into signals about the health of the practice. The person who reads those signals holds the auditor role.
A signal is a starting point
Monitoring is a diagnostic instrument. A signal tells you where to look, and looking is still required.
A weak signal may reflect a data quality problem, a deliberate decision about scope, or a real gap in implementation. Telling them apart takes context that the signal does not carry.
Three kinds of signal
- Process. Is the practice being sustained? Are plans kept current, is work in progress moving, and are reviews spread through the year?
- Posture. What is the current state? Has the team defined what it is responsible for, implemented it, and recorded the evidence?
- Remediation. Is the gap closing? Are identified gaps being taken up, decided on and finished?
Each measures something different, and no one of them tells the whole story. A team can implement its controls thoroughly while letting its reviews lapse. Another can keep a perfect schedule while leaving known gaps alone.
A fourth, built from the others
Urgency combines the health signals and asks a different question. Given where a team is, how significant its resources are, and how recently anyone has worked on them, how soon does it need attention? Deciding Where to Intervene covers it.
Measured at the resource, gathered by team
Every signal is measured for each resource first. Team figures are built from the resource figures, and the organization's from the teams. That allows a roll-up to the whole and a drill-down to the single resource behind a number.
A team's figure is more than an average. It gives extra weight to the weakest resources, so a few that are doing badly are not hidden by the many that are fine.
Fairness in the measurement
- What does not apply does not count against you. A measure that cannot apply to a resource is left out, and the rest are rebalanced.
- New teams get time. A new team starts with a reasonable default while it builds a record. The default fades as real data arrives.
- Direction counts. Each signal is tracked over short and long periods, because where a team is heading says as much as where it stands.
The methodology began with two scores that are still its foundation. Two Scores: Coverage Maturity and Administrative Risk describes them.