Developing an implementation plan for security controls

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which row would belong in an implementation plan for a security control?

A Passwords are important for keeping data safe

B Turn on MFA | IT officer | 12 March | Authenticator app licences

2. How should the controls be ordered in the plan?

A The controls that reduce the highest risks come first

B In alphabetical order by control name

3. A plan says 'Set up weekly backups' with no name beside it. What is the problem?

A No person is responsible, so nobody may do the task

B There is no problem, because the team will sort it out

4. Which entry in the timeline column is best?

A Complete by Friday 14 June

B Some time later this year

5. What does the resources needed column list?

A The list of people who might attack the system

B The software, equipment, time or money required for the task

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Task: Turn on MFA for staff logins		ADue: 14 March \| Resources: encryption software, 4 hours of IT time
2Responsible: Priya (IT Manager)		BThe task is vague, the responsible person is not a named individual and there is no real due date.
3Controls are ordered by risk so the most serious threat is dealt with first		CThe task column states exactly what action will be done to put a security control in place.
4Each control needs a due date and the resources needed to complete it		DNames the person who is accountable for completing the task.
5Task: Improve security \| Responsible: the team \| Due: soon		E1. Encrypt customer database (High risk) \| 2. Update antivirus (Medium risk) \| 3. Lock server room (Low risk)
61. Lock server room (Low risk) \| 2. Encrypt customer database (High risk)		FThe controls are not ordered by risk, so the low risk control is done before the high risk one.

Definitions

implementation plan

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Priority 1: MFA (risk: ____) Priority 2: Backups (risk: Medium) Priority 3: Posters (risk: Low)

Control: Encryption ___________: IT Manager Due: 14/03/2026

Control: Backups Responsible: Data Analyst ___: 28/03/2026

Control: Multi-factor authentication _________: Authenticator app, staff time

_______: Backups Task: Schedule nightly cloud backup Due: 28/03/2026

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Order: High risk first

B 1. Rename files (Low)

C 2. Update passwords (Medium)

D 3. Add door sign (Low)

Question 2

A Control: Multi-factor login

B Task: Turn on MFA for staff

C Owner: IT Manager

D Due: when possible

E Resources: Authenticator app

Question 3

A Control: Weekly backups

B Owner: Everyone

C Due: 20 March

D Resources: Cloud storage

Question 4

A Order: Low risk first

B 1. Encrypt database (High)

C 2. Train staff (Medium)

D 3. Update signage (Low)

Question 5

A Control: Encrypt laptops

B Owner: IT Manager

C Resources: none needed

D Due: 5 April

Answer Key

Developing an implementation plan for security controls

Section A: Quick Questions

B — Turn on MFA | IT officer | 12 March | Authenticator app licences

A — The controls that reduce the highest risks come first

A — No person is responsible, so nobody may do the task

A — Complete by Friday 14 June

B — The software, equipment, time or money required for the task

Section B: Match the Pairs

Task: Turn on MFA for staff logins → The task column states exactly what action will be done to put a security control in place.

Responsible: Priya (IT Manager) → Names the person who is accountable for completing the task.

Controls are ordered by risk so the most serious threat is dealt with first → 1. Encrypt customer database (High risk) | 2. Update antivirus (Medium risk) | 3. Lock server room (Low risk)

Each control needs a due date and the resources needed to complete it → Due: 14 March | Resources: encryption software, 4 hours of IT time

Task: Improve security | Responsible: the team | Due: soon → The task is vague, the responsible person is not a named individual and there is no real due date.

1. Lock server room (Low risk) | 2. Encrypt customer database (High risk) → The controls are not ordered by risk, so the low risk control is done before the high risk one.

Section C: Definitions

implementation plan — A plan listing each security control with the task, the person responsible, the due date and the resources needed to put it in place, ordered by risk.

Section D: Fill in the Blanks

Priority 1: MFA (risk: High)
Priority 2: Backups (risk: Medium)
Priority 3: Posters (risk: Low)

Control: Encryption
Responsible: IT Manager
Due: 14/03/2026

Control: Backups
Responsible: Data Analyst
Due: 28/03/2026

Control: Multi-factor authentication
Resources: Authenticator app, staff time

Control: Backups
Task: Schedule nightly cloud backup
Due: 28/03/2026

Section E: Spot the Error

B — The plan is ordered by risk, highest first. A Low risk control cannot come before High risk ones. Line 2 should be the High risk control, 1. Encrypt laptops (High).

D — Every control needs a specific due date so the timeline can be tracked. 'when possible' is vague. It should be a real date such as Due: 14 March.

B — A plan names one responsible person or role. 'Everyone' means no one is accountable. It should name a specific role, such as Owner: IT Technician.

A — An implementation plan orders security controls by risk, with the highest risk dealt with first. Line 1 should say Order: High risk first.

C — Encryption needs software and staff time, so resources cannot be 'none needed'. The plan must list the resources needed, such as Resources: BitLocker, 2 hours.