◇ OpenCyber Academy
Engineering · Chapter 45 · English

Chapter 45 — Independent design review

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 45 — Independent design review

Lesson map

Lesson 45 published. Map, example, EX133.

flowchart TD
  N0["Learning outcomes"]
  N1["45.1 Package"]
  N2["45.2 Reviewers"]
  N3["45.3 Findings"]
  N4["45.4 Responses"]
  N5["45.5 Outcome"]
  N6["Practice note — preparing reviewers"]
  N7["Review logistics"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX133"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["45.1 Package"]
  N2["45.2 Reviewers"]
  N3["45.3 Findings"]
  N4["45.4 Responses"]
  N5["45.5 Outcome"]
  N6["Practice note — preparing reviewers"]
  N7["Review logistics"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX133"]

[Learning outcomes]
    |
    v
[45.1 Package]
    |
    v
[45.2 Reviewers]
    |
    v
[45.3 Findings]
    |
    v
[45.4 Responses]
    |
    v
[45.5 Outcome]
    |
    v
[Practice note — preparing reviewers]
    |
    v
[Review logistics]
    |
    v
[Worked example] --> [Exercise EX133]

Learning outcomes

You will (1) prepare a design package for independent review; (2) respond to review findings with tracked actions; (3) distinguish must-fix findings from recommendations; (4) record the review outcome formally.

45.1 Package

Requirements and traceability, architecture and ADRs, safety argument, threat model and FMEA, verification reports from Chapters 30 and 40, privacy assessment, and open risks. Reviewers receive it a week in advance.

Sending the package early lets reviewers read at their own pace and arrive with questions rather than first impressions. Kofi's team included a reading guide that pointed to the decisions they were least sure about. The open risks were listed honestly, including two the team had not yet solved, because reviewers find hidden problems anyway and trust falls when they do.

45.2 Reviewers

An external engineer from another utility, a privacy specialist, and an OT safety engineer. None worked on the design. Their independence is the point: none of them reports to the BEN manager who owns Lantern's delivery date.

Kofi's team asked each reviewer to declare any conflict before the review. The external engineer had once worked with a member of BEN's team, which was recorded and judged not to affect her independence. Reviewers are thanked in the record but are not paid by the project.

45.3 Findings

Findings are graded: must-fix before go-live, should-fix within a set time, and observations. Each gets an owner and due date.

Grading keeps attention on what matters. A must-fix finding blocks go-live until it is closed and checked. A should-fix item has a date and an owner but does not hold up the launch. Observations are recorded for the team to consider. Kofi's team received two must-fix findings, five should-fix items and several observations, all logged in the same tracker as the project's defects.

45.4 Responses

The team responds in writing: accepted with action, accepted with alternative, or disputed with evidence. Disputes are resolved by the review chair.

Each response cites the evidence for its position. When the team disputed one finding about retention periods, they attached the partner agreement that set the period. The chair accepted the evidence, and the finding was closed with a note. Another finding the team first wanted to dispute turned out to be correct once they reread their own design record, and they accepted it.

45.5 Outcome

The chair records the decision: proceed, proceed with conditions, or do not proceed. Conditions link to must-fix findings.

The decision is recorded with its date, the package version reviewed and the names of the reviewers. Proceed with conditions means go-live may happen only once each condition is closed and the chair has confirmed it. In the worked example, the chair checked the changed ticket template and the closure block herself before signing off, which took one short meeting. The record is filed with the package.

Practice note — preparing reviewers

A one-page reading guide pointing reviewers to the riskiest decisions makes their limited time count.

Review logistics

The review runs for half a day: thirty minutes of overview, then reviewers question the team on the riskiest decisions. Findings are drafted the same afternoon while details are fresh, and the team receives them within two days. Minutes record who said what so later disputes can be checked against the record.

Worked example

The OT safety reviewer finds that the vendor-watch service can create OT tickets with recommended firewall changes but no explicit reminder of the two-person rule. Must-fix: add the rule to every recommendation and block ticket closure without both approvals. The chair grants "proceed with conditions".

Synthetic case. The review and findings are invented.

Errors and limits

Reviews by friends or managers who own the schedule are not independent. A review is a snapshot; major changes need another.

Exercises

Synthesis

Package evidence, use truly independent reviewers, grade and track findings, and record a formal outcome.

Continue studying — chapter 45 of 50

← Chapter 44 (draft) · Course chapter index · Chapter 46 (draft) →