◇ OpenCyber Academy
Engineering · Chapter 48 · English

Chapter 48 — Evidence dossier

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 48 — Evidence dossier

Lesson map

Lesson 48 published. Map, example, EX142.

flowchart TD
  N0["Learning outcomes"]
  N1["48.1 Dossier purpose"]
  N2["48.2 Organising evidence"]
  N3["48.3 Protecting sensitive content"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX142"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["48.1 Dossier purpose"]
  N2["48.2 Organising evidence"]
  N3["48.3 Protecting sensitive content"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX142"]
[Learning outcomes]
    |
    v
[48.1 Dossier purpose]
    |
    v
[48.2 Organising evidence]
    |
    v
[48.3 Protecting sensitive content]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX142]

Learning outcomes

You will (1) assemble evidence of engineering work; (2) organise it for assessors; (3) protect sensitive content.

48.1 Dossier purpose

The evidence dossier shows assessors what Jonas did and how he knows it worked. It includes requirements, models, threat analysis, architecture decisions, code at tagged versions, test and verification reports, external and independent review logs, metrics, trial results and reflections. Each item is linked to the competence it demonstrates. A dossier differs from a diary: it is organised around claims and the evidence for each, so assessors can check them efficiently. Dr Nwosu reviews the structure early to confirm it matches assessment criteria.

48.2 Organising evidence

Jonas organises the dossier by the engineering lifecycle, with an index mapping each assessment criterion to evidence items. For example, the criterion on verification links to the two verification laboratory reports, the coverage matrix and the external review response. He includes short notes explaining context where an item could be misread. Dr Nwosu checks a sample of links and asks for one missing test log, which he adds. He also adds a one-page reading guide explaining how to navigate the dossier, which assessors later say saved them time.

48.3 Protecting sensitive content

Some evidence is sensitive: production configuration, keyholder names and the details of findings in deployed contracts. Jonas includes redacted versions and states where full versions are held under the cooperative's control. He confirms with the board that nothing in the dossier would help someone target the live system. Balancing assessability with security is itself evidence of professional judgement. He records which items were redacted and why in a short note, so assessors understand the gaps. The board's security lead reviews the redactions and confirms that the dossier can be shared with university assessors under the confidentiality terms agreed at the start of the project.

Worked example

The dossier maps every criterion to evidence, a missing test log is added after sampling, and sensitive content is redacted with board approval.

Synthetic case. Dossier contents are synthetic.

Errors and limits

Including unredacted production configuration in an assessment dossier exposes the live system.

Exercises

Synthesis

An organised, claim-based and safely redacted dossier demonstrates engineering competence.

Continue studying — chapter 48 of 50

← Chapter 47 (draft) · Course chapter index · Chapter 49 (draft) →