ORSM Assurance Questions¶

Before a significant security architecture decision is approved, ORSM asks seven questions.

1. Purpose¶

Why does this control exist? Can its protection objective be clearly demonstrated?

Is the control proportionate to the business risk, or does it introduce unnecessary complexity for marginal gain?

What complexity does this introduce? Can the same outcome be achieved more simply?

If this fails tomorrow, can the organisation continue operating?

Can we recover this capability quickly and predictably?

Can we realistically operate this for the next five years?

Will people actually use this as intended, or will they work around it?

An ORSM assessment should answer these questions with evidence rather than assertion.