Chapter 1 — Research question and literature method

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["1.1 From topic to problem to question"]
  N2["1.2 The estimand: say exactly what number you will p"]
  N3["1.3 What a literature review is for"]
  N4["1.4 Searching across disciplines"]
  N5["1.5 From records to included studies"]
  N6["1.6 Synthesis by concept, not by author"]
  N7["1.7 Reading a study for design, not only for finding"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["1.1 From topic to problem to question"]
  N2["1.2 The estimand: say exactly what number you will p"]
  N3["1.3 What a literature review is for"]
  N4["1.4 Searching across disciplines"]
  N5["1.5 From records to included studies"]
  N6["1.6 Synthesis by concept, not by author"]
  N7["1.7 Reading a study for design, not only for finding"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]

[Learning outcomes and connection]
    |
    v
[1.1 From topic to problem to question]
    |
    v
[1.2 The estimand: say exactly what number you will p]
    |
    v
[1.3 What a literature review is for]
    |
    v
[1.4 Searching across disciplines]
    |
    v
[1.5 From records to included studies]
    |
    v
[1.6 Synthesis by concept, not by author]
    |
    v
[1.7 Reading a study for design, not only for finding]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes and connection

After this chapter you should be able to:

1. Distinguish a topic, a problem and a research question, and narrow one into the next with a reason for each step.
2. Write an incident-response question in a structured form (population, exposure, comparison, outcome, time) and test it against feasibility and interest criteria.
3. Classify a question as descriptive, associational, causal or explanatory, and state the strongest claim each type can support.
4. Define an estimand — the exact quantity the study will produce — before any data are seen.
5. Design a documented search across security, human-factors and safety literatures, test it with known items, deduplicate the results, screen them with a second reviewer and measure agreement.
6. Synthesize prior work by concept rather than by author, and locate the gap your study will address.

The chapter builds on the entry knowledge — you know what triage, severity, escalation and containment mean in practice — and prepares Chapter 2, where the studies you find are read critically against one another.

1.1 From topic to problem to question

1.1.1 Three different things

A topic is an area of interest: "SOC triage", "playbooks", "ransomware recovery". A problem is a situation in which someone must decide or act without knowing enough: "MRSS managers must decide whether to make the SEV-4 rubric mandatory for both teams, but they do not know whether it reduces missed high-impact incidents or merely slows analysts down." A research question is a precisely worded request for information that, if answered, would reduce that uncertainty, and whose answer could come out either way: "Among MRSS-like analysts triaging realistic incident cases, does using the SEV-4 rubric reduce the proportion of high-impact cases rated below their reference severity, compared with usual judgement?"

Each narrowing step should be defensible. Moving from "triage" to "severity assignment" is justified because severity drives escalation and notification clocks. Moving from "all severity errors" to "under-triage of high-impact cases" is justified because the consequences are asymmetric: an over-triaged low-impact case wastes effort, an under-triaged critical case waits. Write down each step and its reason; examiners ask about them, and the reasons become your dissertation's motivation section.

1.1.2 A structured form and two tests

Clinical researchers use the PICOT pattern (population, intervention, comparison, outcome, time). It transfers well to incident response once "intervention" is generalized to exposure — anything whose effect you want to know, whether or not someone assigned it:

Lesson table; scroll horizontally to read all columns →

Two tests then check whether the question is worth pursuing. The FINER criteria — feasible, interesting, novel, ethical, relevant — are a standard teaching device from clinical research design; treat them as prompts, not a scoring system. Feasible is the one master's students most often fail: a question about real incidents at real organizations may need data you will never be given. Ethical comes next: studying analysts' errors on live incidents creates risks to their employment. The Triage Rubric Study passes both by using fictional cases with consenting volunteers, at the price of realism, which Chapter 3 treats as a validity threat to be managed rather than hidden.

1.1.3 Question types and the claims they permit

Lesson table; scroll horizontally to read all columns →

The type of question fixes the type of claim. A descriptive study of tickets cannot say that the rubric caused anything, however large the sample. A causal tabletop study cannot say how often under-triage happens in live operations, because its cases were deliberately chosen. Mixing these up — writing a causal conclusion on a descriptive design, or a prevalence conclusion on an enriched case set — is the most common reason examiners ask for major corrections.

1.2 The estimand: say exactly what number you will produce

An estimand is the quantity a study aims to estimate, defined before data are seen. It is not the method (the estimator) or the number you get (the estimate). A useful template has five parts:

1. Population — whose decisions: analysts with at least six months of triage experience, of the kind MRSS employs.
2. Conditions compared — rubric versus usual judgement, each applied by the same analyst.
3. Outcome variable — under-triage (0/1) for each decision on a high-impact case.
4. Summary measure — the mean, across analysts, of each analyst's under-triage proportion with the rubric minus their proportion without it (a risk difference, in percentage points).
5. Handling of intercurrent events — what happens when an analyst withdraws, skips a case, or uses the rubric in a "usual" session. The Triage Rubric Study analyses analysts with both periods and reports how many withdrew; a sensitivity analysis keeps their available data.

Writing the estimand first protects you from two temptations. The first is choosing among summaries after seeing the data — the pooled proportion, the per-analyst mean, the odds ratio, the critical-only rate — and reporting the most impressive one. The second is quietly changing the population, for example by excluding "outliers" who did badly with the rubric. Chapter 3 turns the estimand into a predeclared analysis plan; Chapter 6 computes it; Chapter 8 asks what happens under the alternatives.

1.2.1 Claim scope

Every estimand implies a claim scope: the population, conditions and setting to which the result applies. The Triage Rubric Study's result applies to volunteer analysts deciding on fictional cases in a timed session with a printed rubric. It does not directly apply to live triage under alert floods, to analysts without six months' experience, or to an automated triage tool. Write the scope next to the question from the start; the limitations section of Chapter 7 is then a discussion of how far you can reasonably extrapolate, not a list of afterthoughts.

1.3 What a literature review is for

A dissertation's review has three jobs: to show what is already known about your question, to show how others have measured the same things (so you can reuse validated measures or justify new ones), and to locate a gap. It is not an annotated bibliography, and at master's level it is rarely a full systematic review.

Choose the review type deliberately and say which you chose:

• A narrative review summarizes literature selected by expertise. It is fast but unreproducible; acceptable for background, not for the claim that "no study has tested X".
• A scoping review maps what kinds of evidence exist on a broad question, with a documented search and screening, but usually without appraising quality in depth.
• A systematic review answers a focused question with an exhaustive, reproducible search, explicit eligibility criteria, dual screening, quality appraisal and often a quantitative synthesis; its reporting is guided by PRISMA 2020.

For the Triage Rubric Study the defensible choice is a scoping review with systematic elements: a documented search, explicit criteria, a second reviewer on a sample, and a flow diagram in the PRISMA style — but no claim of exhaustiveness. The gap statement must match that choice: "In the sources searched, we found no controlled study of structured severity rubrics for security analysts" is supportable; "no such study exists" is not.

1.4 Searching across disciplines

1.4.1 Why incident-response literature is scattered

Research about how people respond to incidents is spread across computer security venues (where SOC field studies appear), human-factors and cognitive-engineering journals (decision making under time pressure, situation awareness), safety science and medicine (checklists, triage, handover), management and organization studies (crisis coordination), and grey literature: national CSIRT annual reports, government guidance, after-action reviews and vendor reports. Each community has its own vocabulary. Clinicians speak of "under-triage" and "decision aids"; security researchers of "alert prioritization" and "analyst fatigue"; human-factors researchers of "cue utilization". A search in one community's database misses the others.

Two theoretical traditions are worth knowing by name because they predict different things about a rubric. Situation-awareness theory (Endsley 1995) treats good decisions as depending on perceiving the right elements, understanding them and projecting their future state; a rubric that forces attention to impact elements should help. Naturalistic decision-making research (Klein 2008) describes experts recognizing situations from patterns rather than comparing options; on that account a rubric may help novices but slow or even hinder experts. Chapter 2 develops these as competing models.

1.4.2 Concept blocks

Build the search from concept blocks, each an OR-list of synonyms, combined with AND:

• Block 1 (setting): "security operations center" OR SOC OR CSIRT OR "incident response team" OR "security analyst*".
• Block 2 (decision): triage OR prioriti* OR severity OR escalat* OR classif*.
• Block 3 (exposure): rubric OR checklist OR "decision aid" OR "decision support" OR scale OR protocol OR playbook.
• Optional Block 4 (cross-domain transfer, searched separately): (triage OR "time pressure") AND (checklist OR "decision aid") in medicine and human factors, to find designs and measures worth borrowing.

Record each database's exact syntax, field restrictions and date of search. A search that cannot be re-run is not documented.

1.4.3 Sources and the known-item test

Choose at least three bibliographic sources from different disciplines (for example, the ACM Digital Library and IEEE Xplore for security venues, a multidisciplinary index for human factors and safety, and a psychology index), plus a grey-literature plan with named source types: national CSIRT and agency reports, standards bodies (such as NIST SP 800-61 Rev. 3, April 2025, which frames incident response within cybersecurity risk management), professional associations such as FIRST (whose CSIRT Services Framework defines service vocabulary), and conference talks with published slides.

Before running the full search, define a known-item set: three to five studies you already know are relevant, found by other means (a supervisor's recommendation, a citation in a key paper). After the search, check how many it retrieved. Known-item recall is a rough test of sensitivity: if your search misses a study you know is relevant, it is probably missing others like it, and you must find out why (a missing synonym, a field restriction, a database not indexed) before trusting the rest.

1.4.4 Citation chaining and stopping

Backward chaining (reading the reference lists of included studies) and forward chaining (finding later studies that cite them) are essential in a scattered field. Predeclare a stopping rule: for example, stop when two consecutive rounds of chaining add no new included study. Without a rule, chaining stops when you are tired, which is not reproducible.

1.5 From records to included studies

1.5.1 Deduplication

The same study appears in several databases with slightly different titles, capitalization, punctuation or missing DOIs. Deduplicate in two passes: first on DOI where present, then on a normalized title plus year. Normalization must handle case, punctuation and symbols (an ampersand versus "and"); Lab 1 shows a simple version. Log how many duplicates each pass removed; the numbers feed the flow diagram.

1.5.2 Two-stage screening and agreement

Screen titles and abstracts against written eligibility criteria, then read the full text of everything that survives. A second reviewer should screen at least a random sample independently. Raw agreement overstates consistency because two reviewers who both exclude most records will agree often by chance. Cohen's kappa (Cohen 1960) corrects for this: κ = (p_o − p_e) / (1 − p_e), where p_o is observed agreement and p_e the agreement expected from the reviewers' marginal rates. Verbal benchmarks such as those of Landis and Koch (1977) ("moderate" for 0.41–0.60) are widely quoted but arbitrary; use kappa as a diagnostic of unclear criteria, not as a grade. The useful output of a screening-agreement exercise is the list of disagreements and the criterion revision they prompt.

1.5.3 The flow diagram

Report records identified per source, duplicates removed, records screened, records excluded at each stage with reasons, and studies included. The PRISMA 2020 flow diagram is the standard template even for a scoping review. A reader should be able to reconcile every number.

1.6 Synthesis by concept, not by author

A weak review proceeds author by author: "Smith (2021) found… Jones (2022) found…". A strong review proceeds by concept, using a concept matrix: rows are studies, columns are the things your question is about.

Lesson table; scroll horizontally to read all columns →

Reading down the columns reveals the gap. In this synthetic map, nobody has compared a rubric with usual judgement within the same experienced analysts, with an outcome that separates under- from over-triage and a reference standard set independently of the participants. That is the Triage Rubric Study's niche, stated with the scope of the search behind it.

1.7 Reading a study for design, not only for findings

When you add a study to the matrix, record its design features before its result: how the unit was sampled, who assigned the exposure, what the comparison was, how the outcome was measured and by whom, and what happened to missing data. Two studies that "found the checklist works" may support very different claims: a randomized study of students with an answer key, and a before-and-after audit of tickets whose severity field was re-defined at the same time as the checklist was introduced. Chapter 2 makes this reading protocol explicit.

1.8 Worked example: from topic to the Triage Rubric question (synthetic)

Starting point. A master's student who worked as an MRSS analyst proposes the topic "making triage better". Her supervisor asks for the decision behind it. She describes the MRSS manager's dilemma: East adopted SEV-4 in January 2025 and its under-triage rate fell; West's analysts say the rubric is slow and "just box-ticking"; the manager wants to mandate it for both teams.

First draft question. "Does the SEV-4 rubric work?" — too vague: work at what, compared with what, for whom?

Second draft. "Did East's under-triage fall because of the rubric?" — a causal question about one historical event. It is interesting, but the student knows that East also gained senior analysts that month. With one team per condition and simultaneous changes, the historical data can describe and associate but will struggle to isolate the rubric. Chapter 4 analyses exactly this problem.

Third draft (adopted). Three linked questions:

• RQ1 (causal, primary): Among analysts with at least six months of triage experience, does using SEV-4 reduce the proportion of high-impact fictional cases rated below their reference severity, compared with the same analysts' usual judgement?
• RQ2 (causal, secondary): What does it cost — in median decision time and in over-triage of low-impact cases?
• RQ3 (explanatory): How do analysts describe their reasoning on cases where the rubric changed, or failed to change, their rating?

Plus a bounded descriptive and associational strand on MRSS historical tickets (Chapter 4), reported as context, not as the causal test.

Estimand (RQ1). The mean across analysts of the within-analyst difference (rubric minus usual) in the proportion of high-impact cases under-triaged, in percentage points, among analysts who complete both conditions; withdrawals reported and examined in a sensitivity analysis.

Hoped-for claim and scope. "For experienced analysts deciding on realistic fictional cases, the rubric reduced under-triage of high-impact cases by about X points (interval…), at a cost of Y seconds per decision." Out of scope: prevalence of under-triage in live operations; effects on novices; effects of automated tools; any statement about MRSS as a real organization.

1.9 Practical activity: deduplicate, test recall and measure screening agreement

Lab 1 takes a synthetic search export of fourteen records from four sources. It deduplicates in two passes, checks known-item recall against four studies the student expects to find, and computes raw agreement and Cohen's kappa for two reviewers' title-and-abstract decisions. Save it as lab1_search.py and run it with python3 lab1_search.py.

# Lab 1 - known-item recall, deduplication and screening agreement for a triage-literature search (offline)
# Synthetic search export. Each record: (source, title, year, doi_or_empty). Nothing here is a real bibliography.
import re
RECORDS = [
    ("acm", "Severity Triage in a Security Operations Center: A Field Study", 2021, "10.9999/syn.001"),
    ("ieee", "Severity triage in a security operations center - a field study", 2021, "10.9999/syn.001"),
    ("acm", "Alert Fatigue and Analyst Escalation Decisions", 2022, "10.9999/syn.002"),
    ("scopus", "Alert fatigue and analyst escalation decisions", 2022, ""),
    ("ieee", "Checklists for Incident Classification: A Controlled Tabletop Experiment", 2023, "10.9999/syn.003"),
    ("scopus", "Mean Time to Respond as a SOC Performance Measure", 2020, "10.9999/syn.004"),
    ("grey", "Regional CSIRT annual report: incident categories and handling times", 2024, ""),
    ("grey", "Regional CSIRT Annual Report - Incident Categories and Handling Times", 2024, ""),
    ("acm", "Interrater reliability of incident severity scales", 2019, "10.9999/syn.005"),
    ("psyc", "Checklist use under time pressure in emergency triage", 2018, "10.9999/syn.006"),
    ("psyc", "Expertise and cue use in dynamic decision tasks", 2017, "10.9999/syn.007"),
    ("ieee", "Machine-learning alert prioritization benchmark", 2024, "10.9999/syn.008"),
    ("grey", "Vendor whitepaper: AI triage cuts MTTR by 90%", 2025, ""),
    ("scopus", "Under-triage of high-impact incidents in shared service SOCs", 2025, "10.9999/syn.009"),
]
KNOWN_ITEMS = {"10.9999/syn.003", "10.9999/syn.005", "10.9999/syn.009", "10.9999/syn.010"}

def norm(title):
    t = title.lower().replace("&", " and ")
    t = re.sub(r"[^a-z0-9 ]+", " ", t)
    return " ".join(t.split())

def dedupe(records):
    seen_doi, seen_title, kept, removed = set(), set(), [], 0
    for src, title, year, doi in records:
        key_t = (norm(title), year)
        if (doi and doi in seen_doi) or key_t in seen_title:
            removed += 1
            continue
        if doi:
            seen_doi.add(doi)
        seen_title.add(key_t)
        kept.append((src, title, year, doi))
    return kept, removed

def kappa(a, b):
    n = len(a)
    po = sum(x == y for x, y in zip(a, b)) / n
    cats = set(a) | set(b)
    pe = sum((a.count(c) / n) * (b.count(c) / n) for c in cats)
    return po, (po - pe) / (1 - pe)

kept, removed = dedupe(RECORDS)
found = {r[3] for r in kept if r[3]}
print(f"records exported: {len(RECORDS)}  duplicates removed: {removed}  unique: {len(kept)}")
hit = sorted(KNOWN_ITEMS & found); miss = sorted(KNOWN_ITEMS - found)
print(f"known-item recall: {len(hit)}/{len(KNOWN_ITEMS)}  missing: {', '.join(miss) or 'none'}")
# Title/abstract decisions in the order of `kept` (I = include, X = exclude)
A = "IIIXIIIXXXI"
B = "IIIIXIXXXXI"
assert len(A) == len(B) == len(kept)
po, k = kappa(list(A), list(B))
print(f"raw agreement: {po:.3f}  Cohen's kappa: {k:.3f}")
for (src, title, year, doi), x, y in zip(kept, A, B):
    if x != y:
        print(f"  disagree: A={x} B={y}  [{src}] {title[:58]}")
inc = sum(1 for x, y in zip(A, B) if x == "I" and y == "I")
print(f"both include: {inc}  to adjudicate: {sum(x != y for x, y in zip(A, B))}  both exclude: {sum(x == y == 'X' for x, y in zip(A, B))}")

Expected output:

records exported: 14  duplicates removed: 3  unique: 11
known-item recall: 3/4  missing: 10.9999/syn.010
raw agreement: 0.727  Cohen's kappa: 0.441
  disagree: A=X B=I  [scopus] Mean Time to Respond as a SOC Performance Measure
  disagree: A=I B=X  [grey] Regional CSIRT annual report: incident categories and hand
  disagree: A=I B=X  [psyc] Checklist use under time pressure in emergency triage
both include: 5  to adjudicate: 3  both exclude: 3

How to read it. Three duplicates were removed: one by DOI (the IEEE record of the field study), two by normalized title (the Scopus record of the alert-fatigue study, which lacked a DOI, and the second grey-literature CSIRT report). Known-item recall is three of four: 10.9999/syn.010 was not retrieved. In a real review that triggers a diagnosis — perhaps that study calls the exposure a "decision aid", which Block 3 must include, or it is indexed only in a database you did not search. Raw agreement of 0.727 sounds respectable; kappa of 0.441 shows that a good part of it is what two reviewers who exclude a lot would achieve by chance. The three disagreements point at three distinct criterion problems: whether a measurement paper (mean time to respond) is in scope; whether grey literature without a method section is eligible; and whether a cross-domain study (emergency medicine) belongs in the main review or in the separate design-borrowing search.

1.10 Common errors and limits

• Starting with a conclusion ("show that the rubric works") rather than a question that can come out either way.
• Asking a causal question of historical data where the exposure coincided with other changes, without saying how the coincidence will be addressed.
• Leaving the estimand undefined until the analysis, then choosing the summary that gives the largest effect.
• Searching one discipline's database and calling the result "the literature"; missing human-factors and safety work where the methods you need already exist.
• Ignoring grey literature in a field where CSIRT reports and agency guidance carry much of the practical evidence — or including vendor claims ("cuts MTTR by 90%") without criteria.
• Reporting raw agreement without chance correction, or kappa without examining the disagreements.
• Writing the review author by author.
• Treating a study's finding as transferable without recording its unit, population and setting.

The limit of a master's review is time: it will not be exhaustive, and it should not pretend to be. Its credibility comes from a documented, repeatable search, a known-item test and an honest statement of what was not searched.

Exercises — chapter 1

EX001 — From topic to question. Objective: narrow a topic into an answerable question. Inputs: the topic "handover between shifts during long incidents". Constraints: one primary question; an observable exposure; an outcome that can be measured without the participants' own self-report alone. Steps: (1) state the decision-maker's problem; (2) write the question in the structured form of §1.1.2; (3) test it against each FINER criterion in one sentence, saying honestly what is not feasible; (4) state the claim you hope to make and its scope. Expected evidence: a half-page memo. Rubric: 3 = answerable with obtainable data, exposure and outcome observable, FINER applied honestly, claim scoped to the design; 2 = one element vague; 1 = still a topic; 0 = none.

EX002 — Question types. Objective: match questions to designs and claims. Inputs: (a) "What share of MRSS tickets in 2025 were re-graded upward after review?" (b) "Are tickets opened at night more often under-triaged?" (c) "Does SEV-4 reduce under-triage compared with usual judgement?" (d) "Why do analysts discount incidents with few alerts?" (e) "Did East's under-triage fall because it adopted SEV-4?" Constraints: use the table in §1.1.3. Steps: classify each; name the minimum design; name the strongest claim. Expected evidence: a table. Rubric: 3 = all classified with designs that would genuinely support the claims, and (e) recognized as causal but weakly identified by the historical data; 2 = one error; 1 = designs generic; 0 = none.

EX003 — Search protocol and known-item test. Objective: build a documented, cross-disciplinary search. Inputs: RQ1–RQ3 in §1.8. Constraints: concept blocks with synonyms from at least two disciplines; at least three bibliographic sources; a grey-literature plan naming four source types. Steps: (1) write the blocks; (2) list sources with a one-line justification each; (3) define a known-item set of three studies and how you will check retrieval; (4) state a stopping rule for chaining; (5) design a search-log template. Expected evidence: a one-page protocol and template. Rubric: 3 = blocks cross disciplines, grey literature specified, known-item test and stopping rule concrete, log re-runnable; 2 = one element missing; 1 = single-discipline search; 0 = none.

EX004 — Run and extend Lab 1. Objective: use deduplication and agreement as diagnostics. Inputs: the lab. Constraints: offline. Steps: (1) run it and record the output; (2) append the record ("psyc", "Checklist Use Under Time-Pressure in Emergency Triage", 2018, "") to RECORDS (no change to the decision strings is needed if it is removed; if it is not removed, the assertion will fail — say which happened and why); (3) change reviewer B's decision on the mean-time-to-respond record from I to X and report the new raw agreement and kappa; (4) explain in about 100 words why one changed decision moves kappa more than raw agreement. Expected evidence: outputs and explanation. Rubric: 3 = correct outputs, the hyphen-versus-space normalization explained, kappa recomputed correctly, chance correction explained; 2 = one error; 1 = not run; 0 = none.

EX005 — Repair the eligibility criteria. Objective: turn disagreement into decidable criteria. Inputs: the three disagreements in Lab 1. Constraints: criteria must be decidable from a title and abstract, or from the first page of a grey report. Steps: (1) write inclusion and exclusion criteria covering measurement papers, grey literature and cross-domain studies; (2) apply them to the three records; (3) state what happens to a record you still cannot decide. Expected evidence: criteria and decisions. Rubric: 3 = criteria decidable, decisions consistent, undecidable records sent to full-text review rather than excluded; 2 = one inconsistency; 1 = criteria restate the topic; 0 = none.

EX006 — Concept matrix with a real study. Objective: synthesize by concept and read a design critically. Inputs: the matrix in §1.6 and the abstract of Haynes et al. (2009). Constraints: read the abstract yourself; quote numbers with their source. Steps: (1) check the Haynes row against the abstract and correct it if needed; (2) add a column "what the study can say about experienced professionals"; (3) write a 200-word concept-centred paragraph on "structured aids for time-pressured classification decisions" that ends with the gap. Expected evidence: matrix and paragraph. Rubric: 3 = Haynes row accurate (pre–post design across eight hospitals, complication and death rates before and after, no concurrent control), paragraph organized by concept, gap scoped to the search; 2 = paragraph author by author; 1 = numbers unsourced; 0 = none.

EX007 — Estimand and scope memo. Objective: define exactly what will be estimated. Inputs: RQ1 and RQ2. Constraints: the five-part template in §1.2. Steps: (1) write the estimand for RQ1; (2) write one for the time cost in RQ2; (3) list two estimands a careless analyst might compute instead and explain how they differ; (4) state the hoped-for claim and two claims explicitly out of scope. Expected evidence: one page. Rubric: 3 = estimands unambiguous, with the within-analyst contrast and intercurrent events handled, alternatives genuinely different (pooled proportion, critical-only rate, odds ratio), out-of-scope claims explicit; 2 = one estimand ambiguous; 1 = no contrast; 0 = none.

Chapter synthesis

A dissertation stands on its question. Move from topic to problem to question deliberately, recording the reason for each narrowing. Write the question in a structured form with an observable exposure, a comparison and an outcome that matters; test it against feasibility and ethics before interest. Classify it, because the type fixes the strongest claim. Define the estimand and claim scope before seeing data. Choose and name the review type; search across security, human-factors and safety literatures and grey sources; test the search with known items; deduplicate, dual-screen and use kappa to find unclear criteria. Synthesize by concept so that the gap emerges from the matrix rather than from assertion.