◇ OpenCyber Academy
Engineering · Chapter 43 · English

Chapter 43 — Industry or public-service practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 43 — Industry or public-service practice

Lesson map

Lesson 43 published. Map, example, EX127.

flowchart TD
  N0["Learning outcomes"]
  N1["43.1 Governance"]
  N2["43.2 Procurement"]
  N3["43.3 Stakeholders"]
  N4["43.4 Public accountability"]
  N5["Data protection in network logs"]
  N6["Working with suppliers"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX127"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["43.1 Governance"]
  N2["43.2 Procurement"]
  N3["43.3 Stakeholders"]
  N4["43.4 Public accountability"]
  N5["Data protection in network logs"]
  N6["Working with suppliers"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX127"]

[Learning outcomes]
    |
    v
[43.1 Governance]
    |
    v
[43.2 Procurement]
    |
    v
[43.3 Stakeholders]
    |
    v
[43.4 Public accountability]
    |
    v
[Data protection in network logs]
    |
    v
[Working with suppliers]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX127]

Learning outcomes

You will (1) work within public-sector governance; (2) engage stakeholders; (3) follow procurement.

43.1 Governance

Councils change their systems through formal governance. Significant network changes go to a change advisory board, which checks risk, timing and rollback plans, and anything touching personal data goes to information governance review. Kofi learns to write short papers for each: a page stating what will change, why, the risk of changing and of not changing, the rollback plan and who is responsible. Boards meet monthly, so a missed submission costs weeks. Treating governance as part of the engineering plan, rather than an obstacle, keeps the project on schedule.

43.2 Procurement

Public bodies must buy equipment and services through procurement rules designed to ensure fair competition and value for money. The council's firewalls and second network links are bought through existing public-sector framework agreements, which are faster than a full tender but still take several weeks for quotes, approval and ordering. Kofi builds these lead times into the schedule and orders long-lead items such as links early. He also writes clear technical requirements for the purchase, so the equipment bought matches the design rather than whatever is cheapest.

43.3 Stakeholders

More people are affected by the network than the IT team. Office managers care about disruption; staff representatives and unions care about whether logging will be used to monitor individuals; the information governance officer cares about lawful handling of personal data. Kofi meets each group early, explains what logs contain and that they are used for security and troubleshooting, not performance management, and records that commitment in the logging notice. Early consultation prevents objections late in the project, when they would be far more disruptive.

43.4 Public accountability

A council spends public money and holds residents' data, so its decisions may be examined by auditors, elected members or the public through information requests. Kofi therefore records decisions, the options considered, costs and approvals in a form that a non-specialist could follow. This differs from many private-sector projects, where informal agreements may be enough. Good records also protect staff: if a decision is later questioned, the record shows it was reasoned, approved by the right body and based on the information available at the time.

Data protection in network logs

Network logs contain addresses, device names and sometimes usernames, which can identify staff and residents. Under data protection law, the council must have a lawful basis for collecting them, keep them only as long as needed and protect them from misuse. Kofi works with the information governance officer to write a short logging notice that explains what is collected, why, for how long and who can access it. Access to raw logs is limited to the security engineers, and every search is itself recorded. The ninety-day retention in requirement R5 is justified by investigation needs and documented, so it can be defended if questioned.

Working with suppliers

Public bodies depend on suppliers for equipment, links and services such as the CCTV system. Kofi learns that security expectations must be written into contracts, not just discussed. The council's revised supplier terms require remote access only through the jump host, named individual accounts, notice before changes and prompt reporting of security incidents. Existing contracts are amended at renewal. Supplier performance against these terms is reviewed annually. This approach turns the CCTV bypass problem found at the start of the project into a general rule, so future suppliers cannot create the same hidden path through the firewall without breaching their contract.

Worked example

Kofi's change paper for the board fits on two pages and is approved first time.

Synthetic case. Processes are synthetic.

Errors and limits

Ignoring governance delays projects more than technical problems.

Exercises

Synthesis

Public-service practice requires governance, consultation and accountability.

Continue studying — chapter 43 of 50

← Chapter 42 (draft) · Course chapter index · Chapter 44 (draft) →