Lesson 2.12: Which controls actually worked? Reading the year's incidents
The CFO asks a fair question before the budget round: 'Which of the tools we pay for actually stopped something this year?' The incident records hold the answer if each incident notes which control prevented it, which detected it and which should have stopped it but didn't. In the lab you read Northwind's ten incidents of 2026, count what each control did, find the controls that never fired and their cost, and write a review that separates 'failed', 'worked' and 'not tested by reality yet'.
20 min
You will learn to
- Record prevented, detected and missed controls per incident
- Count what each control did over a year
- Find controls that never fired and what they cost
- Tell 'didn't work' from 'wasn't tested'
- Turn the review into budget decisions
Key terms
- Preventive control
- Stops an attack from succeeding.
- Detective control
- Notices an attack that got through.
- Control failure
- A control that should have stopped an incident but didn't.
- Untested control
- A control no real incident has exercised; absence of evidence, not evidence of failure.
- Defence in depth
- Layers that catch what the previous layer missed.
← Board oversight and what you disclose about it · All lessons · Introduction to the command line →