Exercise 4 · Security review: a structured architecture risk review
| Time | 14 minutes, after the Module 4 slides |
|---|---|
| Blueprint sections | 7 Security, privacy and compliance requirements, 11 Technical risks and architecture decision records |
| You need | Your Virtual CTO conversation; your architecture (section 4) and stack (section 5) |
| You leave with | A technical risk register with owners, your security controls, and a list of what needs specialist review |
| Safety tip | This review prepares you for specialist review; it does not replace it. Never paste real vulnerabilities, server details or customer data into an AI tool |
Where you are
You've chosen an architecture and a stack. Now you look at what could go wrong: security, privacy, availability, data loss, scale, vendors and people. A CTO works through risk in a structured way, starting with the most likely risks rather than the most dramatic.
What you will make
A risk register: each risk with its likelihood, impact, mitigation and owner, most likely first. Your security controls: access, encryption, secrets, backups, logging and updates. And a clear list of anything that needs a specialist: a security tester, a data protection adviser or a lawyer.
For TutorDesk, the top risk is a parent seeing another family's bookings through a permissions mistake: likelihood medium, impact high; mitigation: automated permission tests on every change; owner: lead developer. Specialist review: a penetration test and a data protection impact assessment before real children's lesson data goes in.
© 2026 MVP Studios Ltd. MVPAI™ and the MVP Studios Academy course materials, including the MVP Founders Programme and MVPAI in a Week, are original works of MVP Studios Ltd. All rights reserved. No copying, redistribution or commercial use without written permission. Course terms