Chapter 29 — Human factors and cyber policy: operations

Lesson map

Lesson 29 published. Map, example, EX085.

flowchart TD
  N0["Learning outcomes"]
  N1["29.1 Routine tasks"]
  N2["29.2 Refreshers and simulations"]
  N3["29.3 Staff feedback"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX085"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["29.1 Routine tasks"]
  N2["29.2 Refreshers and simulations"]
  N3["29.3 Staff feedback"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX085"]

[Learning outcomes]
    |
    v
[29.1 Routine tasks]
    |
    v
[29.2 Refreshers and simulations]
    |
    v
[29.3 Staff feedback]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX085]

Learning outcomes

You will (1) define routine tasks to sustain the programme; (2) plan refreshers and ethical simulations; (3) handle staff feedback.

29.1 Routine tasks

A programme fades without routine care. Nadia drafts a calendar for Ashcombe: IT checks the shared mailbox daily and replies within a day; monthly, IT shares a short note on recent suspicious emails; quarterly, managers review reporting figures by branch group; yearly, the programme is reviewed. Each task has an owner and a backup. The calendar is small enough for a two-person IT team, which matters because an ambitious plan that cannot be sustained would quickly collapse. Managers sign off the calendar.

29.2 Refreshers and simulations

Nadia proposes five-minute refreshers at staff meetings using recent real examples with personal details removed. She considers whether to run simulated phishing and recommends only a small number, at most twice a year, under the rules from chapter 10: announced programme, templates agreed with staff representatives, no lures about pay or health, immediate kind feedback and aggregate results only. She rates templates with the NIST Phish Scale so results can be compared across years. She also asks staff representatives to review the refresher topics each quarter.

29.3 Staff feedback

Staff can comment on the programme through a feedback form and at staff meetings. Nadia expects some complaints, especially about simulations, and proposes that each is answered personally and recorded by theme. If a template upsets staff, it is withdrawn. Responding well to feedback shows staff that the programme respects them, which sustains the trust that reporting depends on. Feedback also reveals practical problems, such as reminders appearing too often, that managers might not otherwise notice. Themes are reported to managers quarterly.

Worked example

Nadia drafts a sustainable calendar, plans brief refreshers and limited ethical simulations and sets up feedback handling.

Synthetic case. Plans are synthetic; the Phish Scale is real.

Errors and limits

Calendars slip under pressure. Few simulations give limited data.

Exercises

• EX085 — Simulation frequency. How often does Nadia recommend simulations?
  Show marking criteria

  Rubric: 3 = at most twice a year;; 2 = twice;; 1 = monthly;; 0 = none.
• EX086 — Template rating. Why rate templates with the Phish Scale?
  Show marking criteria

  Rubric: 3 = so results can be compared across years;; 2 = comparison;; 1 = vague;; 0 = none.
• EX087 — Upsetting template. What happens to a template that upsets staff?
  Show marking criteria

  Rubric: 3 = it is withdrawn;; 2 = withdraw;; 1 = vague;; 0 = none.

Synthesis

Sustainable operations use small routines, limited ethical simulations and responsive feedback handling.

Continue studying — chapter 29 of 40

← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →