Chapter 36 — Community or field response practice
Lesson map
Lesson 36 published. Map, example, EX106.
flowchart TD
N0["Learning outcomes and connection"]
N1["36.1 Why field practice"]
N2["36.2 Consent and scope"]
N3["36.3 Avoiding private live data"]
N4["36.4 Observation and feedback"]
N5["36.5 Reflection"]
N6["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX106"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["36.1 Why field practice"]
N2["36.2 Consent and scope"]
N3["36.3 Avoiding private live data"]
N4["36.4 Observation and feedback"]
N5["36.5 Reflection"]
N6["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX106"]
[Learning outcomes and connection]
|
v
[36.1 Why field practice]
|
v
[36.2 Consent and scope]
|
v
[36.3 Avoiding private live data]
|
v
[36.4 Observation and feedback]
|
v
[36.5 Reflection]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX106]
Learning outcomes and connection
You will be able to (1) prepare a supervised exercise with a community or small organization under clear consent and scope; (2) observe and gather feedback without collecting private live data; (3) record improvements for the host organization; and (4) reflect on your own practice. This chapter applies the exercise method of Chapter 30 and the ethics of Chapters 10 and 35 outside the classroom.
36.1 Why field practice
Small organizations — charities, community clinics, schools — face the same incident types as large ones with far fewer resources. A supervised tabletop gives them a low-cost rehearsal and gives you experience with real stakeholders, real constraints and real communication challenges.
The Riverside Community Pantry example shows the value for both sides. The host learned that nobody knew who administered its donor database, a gap no tool would have found, and the student learned that the most useful discussion concerned who to call rather than technical injects. Neither result required touching a live system.
36.2 Consent and scope
Agree in writing with the host: objectives, participants, duration, what will and will not be discussed, that no live systems will be accessed, that no personal or sensitive security details will be recorded, who receives the after-action note, and that your supervisor is responsible. Participants consent individually and may leave at any time.
For Riverside, the agreement would state that the donor database's settings and support contact are described, not accessed, that the shared office laptop is not used, and that the after-action note goes to the director. Keep a signed copy with your supervisor before the session starts, and give each participant a short consent sheet in plain language that explains they may leave at any time.
36.3 Avoiding private live data
The exercise uses a fictional scenario adapted to the host's type of work. If participants reveal real weaknesses ("our admin password is on a sticky note"), do not record specifics; record the general improvement ("credential storage practice to review") and tell the host contact privately if appropriate.
The Riverside reflection shows how easily this slips: the student recorded a volunteer's comment about password reuse together with her name, noticed, removed the name and kept only a general note. Review your notes before the session ends and again before writing the after-action note. Anything that could identify a person or point to a specific weakness should be generalized or told privately to the host contact, not written down.
36.4 Observation and feedback
Use simple observable objectives (who would you call; how would you tell clients; where are backups). Collect feedback with a short anonymous form: usefulness, clarity, what to change.
At Riverside the objectives were simple: who decides and who is told, where the database settings and support contact are described, a draft message to donors and one improvement. Observation showed that the draft promised that no data was taken, which the facilitator could then discuss using the confirmed and unknown structure. Feedback came from a short anonymous form; nine of ten participants found the session useful and several asked for a one-page contact list, which became a practical follow-up for the host.
36.5 Reflection
Write a reflective note: what you planned, what happened, what you learned about facilitation, communication and your own assumptions, and what you would change. Reflection is part of professional development and is assessed in this course.
The Riverside excerpt is a good model: it names a planning mistake, too many technical injects, and an ethical slip that was caught and corrected. Write the note soon after the session, while details are fresh, and be specific about what you would change next time. A reflection that only lists successes is not useful to you or to an assessor.
36.6 Worked example (synthetic): a community food bank
Fictional host "Riverside Community Pantry": 4 staff, 30 volunteers, a donor database in a cloud service, a shared office laptop.
Scenario: a volunteer receives an email that looks like it comes from the director asking for the donor list; the next day donors report scam emails using their names.
Objectives: identify who decides and who is told; locate the donor database's admin settings and support contact (described, not accessed); draft a short message to donors; identify one improvement.
Observations (fictional): no one knew who administers the database; the director assumed the cloud provider "handles security"; the draft donor message promised "no data was taken". Improvements recorded: name a database administrator and a backup; enable MFA on the database (host to do this themselves with the provider's guide); use a message template with confirmed/unknown structure (Chapter 32). Feedback: 9 of 10 participants found it useful; several asked for a one-page contact list.
Reflection excerpt (student): "I prepared too many technical injects; the most valuable discussion was who to call. I also caught myself recording a volunteer's comment about password reuse with her name — I removed the name and wrote a general note."
36.7 Common errors and limits
- Turning an exercise into an unauthorized security assessment.
- Recording sensitive real details.
- Recommending controls the host cannot afford or operate.
-
Overstating what one exercise can achieve.
-
Promising the host outcomes that a single tabletop cannot deliver, such as being secure afterwards.
- Leaving the host with a long list of recommendations and no indication of which matters most.
- Treating feedback scores as evidence that the host's practice improved; they measure how the session felt.
- Running the session without the supervisor named in the agreement, which removes the accountability the host was promised.
Exercises — chapter 36
Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.
EX106 — Agreement letter. Steps: write the scope-and-consent letter for the Riverside exercise. Rubric: 3 = objectives, participants, no live systems, data handling, recipients of results, withdrawal, supervisor contact; 2 = missing data handling; 1 = informal; 0 = none.
EX107 — Handling a disclosure. Inputs: during the exercise, a staff member says the donor database has a shared login used by all volunteers. Steps: describe what you record and what you do. Rubric: 3 = record general improvement (individual accounts), no credentials recorded, inform host contact privately, recommend provider guidance, do not test; 2 = partial; 1 = records specifics; 0 = none.
EX108 — Reflection. Steps: write a 200-word reflection on a group exercise you have taken part in (real or classroom), using plan/happened/learned/change. Rubric: 3 = honest, specific, links to course concepts, actionable change; 2 = descriptive only; 1 = generic; 0 = none.
Chapter synthesis
Field practice serves the host first: agree scope and consent in writing, use fictional scenarios, keep real weaknesses out of your notes, give practical improvements and reflect honestly on your own practice.
Continue studying — chapter 36 of 40
← Chapter 35 · Course chapter index · Chapter 37 →
Continue to the next authored lesson.