Skip to content
sec/atlas
knowledge base · governance, risk and leadership

Governance and risk, made practical.

Risk, frameworks, third parties, architecture principles, compliance evidence, metrics, strategy and crisis communication: the business side of security.

$ click a card for details · ctrl+k to search

learning map

Topics are laid out by level, from foundations to advanced. Arrows point from a prerequisite to what builds on it. Select a topic to preview it, or follow the highlighted next step.

Your next step

0 of 8 studied
start this topic

01 Foundations

The ideas everything else builds on.

02 Practitioner

Apply the controls and make them work in practice.

03 Advanced

Design, scale and operate at depth.

  • studied
  • ready to study
  • prerequisites missing

from risk to leadership

Identify, design, prove, lead: each phase turns risk into decisions. Each chip opens the matching topic.

  1. 01identify

    know what can go wrong, and who it can come through

    risks with owners and treatmentsuppliers, partners and dependencies

    gate: every important risk has an owner, a rating and a decision

  2. 02design

    frameworks and architecture that scale

    ISO 27001, NIST CSF, CIS, PCI DSSzero trust and reusable patterns

    gate: controls are designed once, as patterns, and mapped to requirements

  3. 03prove

    show that controls work

    evidence and auditsoutcome metrics and board reporting

    gate: evidence is produced continuously and metrics inform decisions

  4. 04lead

    decide, communicate, build culture

    strategy, roadmap and budgetcrisis communication and culture

    gate: leadership understands the risk, funds the plan and trusts the team

topics

Security risk management
Security cannot remove all risk, and does not need to. Risk management turns "everything is urgent" into a ranked list the business can accept, reduce, transfer or avoid.
concept· stage: identify
Third-party and supply chain risk
A growing share of incidents enter through a vendor, a partner or a dependency: an attacker breaches a smaller company to reach its large customer. Know who you depend on and how much you trust them.
practice· stage: identify
Security frameworks and standards
Frameworks are shared vocabularies for what good looks like. Pick one as the backbone, map the others to it, and never confuse passing an audit with being secure.
concept· stage: design
Security architecture principles
A security architect designs the controls once, as patterns, so that hundreds of teams inherit them. The craft is a small set of principles applied consistently across cloud, network, identity and data.
concept· stage: design
Compliance in practice: controls, evidence and audits
Audits are painful when evidence is gathered by panic in the last week. They are routine when controls have owners and evidence is produced automatically all year.
practice· stage: prove
Security metrics and reporting to leadership
A number that cannot change a decision is decoration. Good security metrics show whether risk is going down, how fast the team responds, and where leadership must act.
practice· stage: prove
Security strategy, roadmap and budget
A strategy is a choice about what not to do. With limited people and money, the job is to put them where they reduce the most risk for the business, and to explain why.
concept· stage: lead
Crisis communication and security culture
In a serious incident the technical response is half of the work; the other half is telling the truth, on time, to the right people. And the culture you built beforehand decides whether people report problems or hide them.
practice· stage: lead