Chapter 31 — Human factors and cyber policy: implementation II | Engineering Human factors and cyber policy

Lesson map

Lesson 31 published. Map, example, EX091.

flowchart TD
  N0["Learning outcomes"]
  N1["31.1 Payment controls"]
  N2["31.2 Vendor session controls"]
  N3["31.3 Training in procedures"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX091"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["31.1 Payment controls"]
  N2["31.2 Vendor session controls"]
  N3["31.3 Training in procedures"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX091"]

[Learning outcomes]
    |
    v
[31.1 Payment controls]
    |
    v
[31.2 Vendor session controls]
    |
    v
[31.3 Training in procedures]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX091]

Learning outcomes

You will (1) implement the payment and vendor verification controls; (2) integrate controls into existing workflows; (3) train staff in the new procedures.

31.1 Payment controls

Aiko works with the finance team to implement the payment verification control. The finance system now places an automatic hold on any change to supplier bank details and creates a task for a second officer, who must call the supplier using the number held in the supplier file. The hold cannot be released by the person who received the request. The finance team tests the workflow with ten synthetic change requests, including two that use urgent wording, and every request is held and verified before release.

31.2 Vendor session controls

For remote vendor sessions to operational technology, the IT team configures the remote access gateway so that a session can start only when a valid ticket number from the maintenance system is entered and an engineer has approved the ticket. This removes the opportunity for a caller to talk an operator into opening a session by phone. Vendors are informed in writing a month before the change, and two vendors ask for a test session, which the team arranges so that real maintenance is not disrupted on the day of change.

31.3 Training in procedures

Aiko writes short procedure guides and runs fifteen-minute sessions for finance officers and control room operators. Sessions use worked examples and role-play rather than tests, and participants practise the callback and ticket steps. She records questions and revises the guides twice. Following the advice in NIST SP 800-50r1 (Hansche et al., 2024), she treats role-based training for staff with specific duties as distinct from general awareness, so these sessions focus only on the steps those roles must perform. Attendance is recorded for the regulator.

Worked example

Aiko implements a payment hold with second-officer callback, ticket-gated vendor sessions and short role-based training.

Synthetic case. Procedures are synthetic; NIST SP 800-50r1 is real.

Errors and limits

Second officers may approve without calling if busy. Vendors may resist ticket gates.

Exercises

EX091 — Hold release. Who cannot release the payment hold?
Show marking criteria
Rubric: 3 = the person who received the request;; 2 = requester;; 1 = second officer;; 0 = none.
EX092 — Vendor gate. What must exist before a vendor session starts?
Show marking criteria
Rubric: 3 = a valid approved maintenance ticket;; 2 = ticket;; 1 = a phone call;; 0 = none.
EX093 — Role-based training. How does role-based training differ from general awareness?
Show marking criteria
Rubric: 3 = it focuses on steps specific roles must perform;; 2 = role steps;; 1 = vague;; 0 = none.

Synthesis

Controls are implemented inside workflows and supported by short role-based training.

Continue studying — chapter 31 of 50

← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →