Module 3 · Compliance¶
With governance in place (Module 2), you can now do the first piece of real protective work: build Scaldimet's security baseline. The objective of this Module is to select and operate a baseline of controls that covers the bulk of general and sector-specific risk, and to design, test and prove the efficiency of those controls. Because a recognised reference has already worked out those common controls, you adopt that baseline as a whole rather than re-analysing each common risk yourself, and you spend your effort where it counts: the risks specific to Scaldimet.
There is a French name worth borrowing for this baseline: the socle de sécurité, the security foundation. In ANSSI's EBIOS Risk Manager method, the very first workshop establishes the socle through a compliance approach (the controls a recognised reference says any organisation like yours should already have), and only then does the method study targeted attack scenarios on top of it. That is exactly the course's operational order: governance, then compliance (this Module, the socle), then risk (Module 4, the scenarios the socle does not cover). Build the foundation that reduces ordinary risk efficiently, so your limited time, judgement and budget can focus on the risks that are specific to Scaldimet.
The Module moves from selection to operation to proof. You will tell laws, standards and frameworks apart and choose Scaldimet's baseline; learn the frameworks that matter here (NIST CSF as the backbone, CyFun as Scaldimet's Belgian baseline, ISO 27001 for the customer, NIS2 as the law); run a compliance programme; design, test and audit controls; and finish by confronting the central trap in this whole subject, mistaking a passed audit for a secure organisation.
The efficiency of a baseline is that you adopt it as a whole: a recognised reference has already decided which controls counter ordinary risk, so you implement the framework without re-deriving the case for each common control. That is the point of a socle: it spares your scarce risk analysis for what is specific to Scaldimet (Module 4). You still know each control through its risk rationale, the risk it addresses, which is what lets you prioritise, test and justify any exclusions, not something you re-argue before adopting.
What you will be able to do¶
- Distinguish laws, standards, frameworks and contracts, and select a coherent baseline for Scaldimet.
- Use NIST CSF as an organising backbone, operate CyFun as Scaldimet's baseline, and understand ISO 27001 and NIS2 in depth.
- Run a compliance programme: scope, gap analysis, evidence and a risk-prioritised roadmap.
- Operate the baseline as a whole, then design, test and audit controls, telling design effectiveness from operating effectiveness.
- Explain why compliance is necessary but not sufficient, and avoid the check-box trap.
Chapters in this Module¶
| Chapter | Title | Lessons |
|---|---|---|
| 3.1 | Selecting the baseline | 2 |
| 3.2 | Frameworks: NIST CSF and CyFun | 2 |
| 3.3 | ISO 27001 | 2 |
| 3.4 | NIS2 in depth and across borders | 2 |
| 3.5 | Managing a compliance programme | 1 |
| 3.6 | Control design, testing and audit | 2 |
| 3.7 | Compliance vs real security | 1 |