Accountability stays with you. Work can be delegated; responsibility for the outcome cannot.
If accountability always stays with the organisation, what can it realistically recover from a supplier that causes a breach? Contracts often cap liability or exclude indirect losses, so the fine and the loss of trust may exceed what the supplier pays. Should the contract and the risk assessment treat the gap between accountability and recourse as a residual risk that someone has to accept
A rule that ignores behaviour does not produce the behaviour; it produces theatre plus workarounds, at full cost and negative benefit.
NIST dropped forced rotation in 2017, but what should an organisation do if a customer contract, an auditor’s checklist or an older standard still requires regular password changes? Should the policy follow the evidence and document the deviation with a justification, and who has the authority to approve that deviation?
A line drawn after seeing the risks is a line drawn to flatter them.
How is the threshold kept fixed in practice? If many risks land above the line in one cycle and the budget is limited, there is pressure to move the line instead of the risks. Should the board approve the appetite statement before each assessment cycle, and who is allowed to change it mid-year, with what record?
A sample tells you a control probably worked; a full-population test tells you exactly which three exceptions exist, when, and to whom
If a full-population test is possible for anything that leaves a machine record, should it replace sampling for those controls? The text says the analysis is only as good as the question asked of the data, so how does the auditor show that the data extract is complete and that the log source itself was not altered? Does the audit trail need a step for validating the data before the test?
Design lives in the document; operation lives in the records; an audit checks both.
The procedures are written by the first line, and the records (tickets, logs, sign-offs) are produced by the same people who do the work. Who checks that the records are complete and true between audits, especially in a small organisation without an internal audit function? Is a periodic sample by the second line enough, and how often should it run
MFA protects the login, not the session
If MFA only protects the login, which controls protect the session once a token is stolen? The case names short session lifetimes and alerts on new sessions, but how short is short enough without making staff log in so often that they look for workarounds? And who decides the session policy, security or the business?
Severity ranks flaws; risk ranks work
Who decides when a patch is allowed to deviate from the CVSS order, and where is that decision recorded? The example says the reasoning must be written down, but if the patch policy sets deadlines by CVSS band, the 7.5 on the checkout could break the policy while the 9.8 on the test machine is within it. Should the policy include a rule for deviations that cites value, exposure and existing controls?
Prevention lowers how often; preparedness lowers how bad - and an organisation needs both
If preparedness is a corrective control, how should it be rated in the risk register? Does it lower the consequence score and leave likelihood unchanged, and who signs off that the lower rating is deserved?