Nordvik Region and Hansa Mutual: Conclusions for Two Organisations

All courses / The Transformed Security Architect / Module 6 / Chapter 26

Learning objectives

After the lesson the participant can:

• Summarise the answer each organisation gave to its commission and the evidence behind what worked and what was hard.
• Explain why the two plans differ in order, using the levers, the people and the law each organisation has.
• Build a 24-month plan against the binding constraint, with owners, verifications and conditional autonomy increases.
• State what the chapter leaves unresolved for each organisation and for accountability in general.

Key concepts

Contract-first and delegation-first

The two plans. Nordvik mostly procures, so its leverage is the contract and its plan starts with the deputy and supplier evidence. Hansa mostly builds, so its leverage is the platform and its plan starts with review quality and patch velocity.

Plan against the constraint

For each shift, name the one constraint that most limits the practice, such as the single post or review throughput, and order measures by the constraint they relieve and then by reversibility: reversible measures early, hard-to-undo commitments late and conditional.

Autonomy as a threshold

Autonomy increases are written as conditions on recorded evidence. The default is none without two consecutive quarters of review-quality evidence. In both plans autonomy rises last and only on recorded conditions.

Verification of a measure

Each measure has an owner by role and a verification that produces evidence, such as a drill time or a share of verified controls, so that the plan can be checked against what happened.

What remains unresolved

The single point of failure at Nordvik, including how the architect is replaced; review throughput at Hansa; the regimes outside the EU; and whether a court would accept the records that show who answers for an agent-proposed change.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Nordvik had to build what Hansa already had; Hansa had to remove what Nordvik never built. Which sentence describes your organisation, and what follows for your first six months?
2. Hansa's cap turns the limit of six reviewers into a queue and not a rubber stamp. What would persuade your executives that a visible queue is the better outcome?
3. Whether a court would accept the organisations' records as sufficient remains untested. How should that uncertainty shape what you record today?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Under what condition does Nordvik's plan reopen the question of an agent team in months 18 to 24?

   1. When the supplier TriageSoft offers a hosted review-agent service
   2. When the verified share of tracked controls reaches 60 per cent
   3. When two people with evidenced competence can supervise agents
   4. When the regional executive committee funds a second architect post
   Show the answer

   C. When two people with evidenced competence can supervise agents
   Measure M4 reopens the agent-team deferral against its triggers on the condition that two people with evidenced competence can supervise agents, with the decision recorded either way.

2. What figures did Hansa's first quarterly report show for review quality after the redesign of AIDR-0556?

   1. A Tier 2 median of 28 seconds, a rejection rate of 1 per cent and no seeding
   2. A Tier 2 median of 11 minutes, a rejection rate near zero and 80 per cent of seeded errors caught
   3. A Tier 2 median of four working days and 57 of 61 items agreed with the board
   4. A Tier 2 median of 22 minutes, a rejection rate of 17 per cent and 86 per cent of seeded errors caught
   Show the answer

   D. A Tier 2 median of 22 minutes, a rejection rate of 17 per cent and 86 per cent of seeded errors caught
   After the redesign the first quarterly report showed a Tier 2 median of 22 minutes, a rejection rate of 17 per cent and 86 per cent of seeded errors caught, against a summer median under thirty seconds with rejections near zero.

3. According to the chapter, why does Nordvik upskill its post-holder instead of hiring a second security architect?

   1. Because ENISA's profile forbids external hiring for public authorities
   2. Because fixed pay scales and security vetting make hiring slow
   3. Because the union refused to agree the assessment rules
   4. Because the platform team already holds Advanced in design and law
   Show the answer

   B. Because fixed pay scales and security vetting make hiring slow
   The Region upskills because fixed pay scales and security vetting make hiring slow, building on the conclusion that upskilling is the strategy and hiring is for scarce specialisms. The funded post backfills the platform team so an engineer can serve as deputy.