Chapter 34 — Human factors and cyber policy: integration
Lesson map
Lesson 34 published. Map, example, EX100.
flowchart TD
N0["Learning outcomes"]
N1["34.1 Incident response"]
N2["34.2 Governance alignment"]
N3["34.3 Risk register links"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX100"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["34.1 Incident response"]
N2["34.2 Governance alignment"]
N3["34.3 Risk register links"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX100"]
[Learning outcomes]
|
v
[34.1 Incident response]
|
v
[34.2 Governance alignment]
|
v
[34.3 Risk register links]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX100]
Learning outcomes
You will (1) integrate the programme with incident response; (2) align with governance and risk management; (3) connect metrics to the risk register.
34.1 Incident response
Aiko integrates reporting with incident response. When triage confirms a malicious email that reached many inboxes, the triage tool opens an incident ticket automatically, notifies the response lead and removes the email from all mailboxes. Responders can see who reported first and thank them. After incidents, response leads add a short note on human factors, such as whether a control helped or got in the way. This link means that reporting has a visible effect on response and that lessons flow back into design.
34.2 Governance alignment
Aiko maps the programme to Greyford's governance. The Govern function of NIST CSF 2.0 expects roles, policies and oversight for cybersecurity, and the programme now has a named owner, a charter, quarterly reporting to the risk committee and an annual review. ISO/IEC 27001:2022 requires awareness and competence for people doing work that affects security, and the programme provides records of both. She avoids treating these frameworks as the goal; they provide structure, while the goal remains fewer harmful outcomes. The charter is reviewed by the risk committee each year.
34.3 Risk register links
Aiko links programme measures to entries in the risk register, following the approach of NIST SP 800-30r1, in which likelihood and impact estimates should be updated with evidence. The risk of payment fraud is now informed by the number of held change requests and verified fakes; the risk of OT access abuse by attempted ungated sessions. When measures change, risk owners review the entry. This turns the programme from a separate activity into a source of evidence for risk decisions across the organisation.
Worked example
Aiko links reporting to automatic incident tickets, maps the programme to CSF 2.0 and ISO/IEC 27001, and feeds measures into the risk register.
Synthetic case. The integration is synthetic; NIST CSF 2.0, ISO/IEC 27001:2022 and SP 800-30r1 are real.
Errors and limits
Automatic incident creation may cause noise. Framework mapping can become box-ticking.
Exercises
- EX100 — Automatic action. What happens when triage confirms a widely received malicious email? Rubric: 3 = an incident ticket opens and the email is removed;; 2 = ticket;; 1 = vague;; 0 = none.
- EX101 — CSF function. Which CSF 2.0 function covers roles, policies and oversight? Rubric: 3 = Govern;; 2 = Govern, hedged with another function;; 1 = Protect;; 0 = none.
- EX102 — Risk evidence. Which measure informs the payment fraud risk? Rubric: 3 = held change requests and verified fakes;; 2 = held requests;; 1 = vague;; 0 = none.
Synthesis
Integration links reporting to response, the programme to governance and measures to risk decisions.
Continue studying — chapter 34 of 50
← Chapter 33 (draft) · Course chapter index · Chapter 35 (draft) →