◇ OpenCyber Academy
Bachelor's · Chapter 27 · English

Chapter 27 — Privacy and data protection: verification

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 27 — Privacy and data protection: verification

Lesson map

Lesson 27 published. Map, example, EX079.

flowchart TD
  N0["Learning outcomes"]
  N1["27.1 Verification plan"]
  N2["27.2 Sampling"]
  N3["27.3 Network comparison"]
  N4["27.4 Honest reporting"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX079"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["27.1 Verification plan"]
  N2["27.2 Sampling"]
  N3["27.3 Network comparison"]
  N4["27.4 Honest reporting"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX079"]

[Learning outcomes]
    |
    v
[27.1 Verification plan]
    |
    v
[27.2 Sampling]
    |
    v
[27.3 Network comparison]
    |
    v
[27.4 Honest reporting]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX079]

Learning outcomes

You will (1) verify controls against requirements; (2) sample records for compliance; (3) report verification honestly.

27.1 Verification plan

Elena plans verification of the trust's controls. For each control she defines a requirement and a test. Access control: staff can see only what their role allows, tested by sampling accounts. Retention: records past their period are deleted, tested by querying the system. App vetting: no unapproved app receives data, tested by comparing the app register with network traffic. She follows a principle that every important control should be tested with evidence, not assumed. Each control gets one test. Tests follow the risk ranking.

27.2 Sampling

Elena samples twenty staff accounts across schools and compares each account's permissions with its role. Eighteen match; two have extra permissions left from previous roles. She reports the error rate and fixes the accounts. She explains that a sample does not prove all accounts are correct, but it gives an estimate and shows whether the joiners-movers-leavers process works. She recommends repeating the sample each term. The twenty sampled accounts come from every school, and each is checked against current staff lists.

27.3 Network comparison

Elena works with the IT manager to list domains that school devices contact and compares them with approved apps. Two unapproved apps appear: a free quiz site and a drawing app. Both receive pupil names through login. She contacts the teachers involved, who were unaware of the process, and helps them find approved alternatives. She notes that technical verification finds practices that policies and surveys miss. Traffic showed several apps never vetted. Two unapproved apps were found this way, both used by a single class for homework quizzes.

27.4 Honest reporting

Elena writes a verification report showing passes and failures. Governors ask whether the trust is compliant. She explains that the trust has improved and has evidence for many controls, but that failures remain and verification must continue. She avoids claiming full compliance, which no evidence could support. Dr. Asante notes that honest reporting builds trust with governors and regulators better than optimistic claims that later prove wrong. Her report states clearly which controls failed testing and what will be done about each one.

Worked example

Elena verifies controls with tests, finds two of twenty sampled accounts with excess permissions, discovers two unapproved apps through network comparison and reports results without claiming full compliance.

Synthetic case. Samples and findings are synthetic.

Errors and limits

Network comparison misses apps used on home devices.

Exercises

Synthesis

Chapter 27 verifies. Chapter 28 analyses failures.

Continue studying — chapter 27 of 40

← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →