Chapter 12 — Final review and transfer
Lesson map
Lesson 12 published. Map, example, EX056.
flowchart TD
N0["Learning outcomes and connection"]
N1["12.1 The course as one method"]
N2["12.2 Transfer between sectors"]
N3["12.3 Multi-criteria decisions and reversal points"]
N4["12.4 Self-assessment and continuing practice"]
N5["12.6 Practical activity: same options, different wei"]
N6["Chapter synthesis"]
N7["Chapter 1: EX001–EX005"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX056"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["12.1 The course as one method"]
N2["12.2 Transfer between sectors"]
N3["12.3 Multi-criteria decisions and reversal points"]
N4["12.4 Self-assessment and continuing practice"]
N5["12.6 Practical activity: same options, different wei"]
N6["Chapter synthesis"]
N7["Chapter 1: EX001–EX005"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]
[Learning outcomes and connection]
|
v
[12.1 The course as one method]
|
v
[12.2 Transfer between sectors]
|
v
[12.3 Multi-criteria decisions and reversal points]
|
v
[12.4 Self-assessment and continuing practice]
|
v
[12.6 Practical activity: same options, different wei]
|
v
[Chapter synthesis]
|
v
[Chapter 1: EX001–EX005]
|
v
[Worked example] --> [Exercise EX056]
Learning outcomes and connection
After this chapter you should be able to:
- Integrate the course's methods into one coherent approach to organization-scale security decisions.
- Transfer a decision from one sector to another by re-examining assumptions and re-eliciting weights.
- Find the weight at which a multi-criteria recommendation reverses, and use it to focus discussion.
- Assess your own competence against the course outcome with evidence, and plan continuing development.
- Complete an advanced case analysis that draws on every chapter.
This final chapter reviews the course as a single method, practises transferring it to a new sector, and prepares the final assessment. Its last exercise is the course's integrating case.
12.1 The course as one method
Read across the chapters, the course describes one cycle that a specialist runs continuously:
- Frame the decision: owner, options including defer, objectives in service units (Chapter 1).
- Know the baseline: obligations, guidance and verified practice (Chapter 2).
- Establish the facts: evidence that separates observation from inference (Chapter 3).
- Quantify and distribute risk: frequency, severity, tail, and who bears it (Chapter 4).
- Design alternatives: consequence-first, compared as graphs and as operable systems (Chapter 5).
- Evaluate before trusting: controlled tests with intervals (Chapter 6).
- Integrate: ownership, suppliers, emergency command and sharing (Chapter 7).
- Prepare for the hard cases: weights, clocks and obligations agreed in advance (Chapter 8).
- Lead and assure: indicators, assurance cases, fresh evidence (Chapter 9).
- Read critically: studies, advisories and claims, for transfer (Chapter 10).
- Deliver and evaluate projects honestly (Chapter 11).
Each step produces an artefact others can inspect — a decision record, a verification plan, a finding, a loss exceedance curve with a distribution table, an ADR, an evaluation report, a RACI, a restoration-weight agreement, an assurance case, an evidence brief, a project report. A specialist's credibility rests on those artefacts more than on any single judgement.
12.2 Transfer between sectors
Specialists move between sectors, and regional work requires reasoning about several at once. Transfer fails in two characteristic ways: copying conclusions that depended on the first sector's conditions; and copying weights that reflected the first sector's values. Transfer succeeds when you copy the method and re-examine each assumption. A practical transfer checklist:
- Consequence and time: what is the essential function, and how fast does harm arrive when it fails? (A hospital's minutes, a water system's hours, a port's days.)
- Physics and safety: what failure modes can a security action itself cause?
- Regulation: which regimes and reporting clocks apply, and what evidence do they expect?
- People and suppliers: who will implement and operate the measure; which suppliers concentrate risk?
- Data and privacy: what personal or sensitive data are involved, and what duties follow? Healthcare security, for instance, sits under data-protection and health-privacy duties that a water utility rarely faces (GDPR; HHS, HPH CPGs).
- Values: what do this sector's leaders and the people it serves weigh most heavily, and who should set the weights?
12.3 Multi-criteria decisions and reversal points
When options are compared on several criteria with weights — a simple weighted-sum model — the recommendation depends on the weights. Rather than defending one weight set, find the reversal point: the weight at which the recommendation changes. If the reversal point is far from any plausible weight, the recommendation is robust; if it is close, the discussion should focus on that weight. Systematic sensitivity analysis of models is a field in its own right (Saltelli et al., 2008); for a three-option decision, a one-dimensional sweep is usually enough. This is the multi-criteria counterpart of the probability thresholds in Chapter 1.
12.4 Self-assessment and continuing practice
The course outcome is to lead advanced application and justify organization-scale choices in critical infrastructure and sector security. Assess yourself against it with evidence, not feelings: for each chapter, which artefact have you produced, to what standard (the exercise rubrics), and what feedback did you receive? Gaps become a continuing-development plan with specific practice, not only courses: lead a drill; write a decision record for a real decision; review a supplier contract; brief a board; present an evidence brief to peers. Professional codes expect practitioners to maintain competence and to work within it (ACM Code of Ethics; NSPE Code of Ethics). Laws, standards and threats will change during your career; the habits of framing, evidence, honest uncertainty and recorded judgement will not.
12.5 Worked example: transferring a programme choice to Merrow Health (synthetic)
Merrow Water's panel scored three security programmes on four criteria (0–10): continuity of the essential service, safety of people, affordability and privacy. Merrow Water's leadership weighted continuity heavily and privacy lightly. Merrow Health wants to reuse the analysis. The specialist copies the scores only after checking each one with clinical and information-governance colleagues (in this example they are confirmed), and asks Merrow Health's leadership to set its own weights. Lab 12 compares the results and finds the reversal point.
Copying the scores is a judgement in itself. Continuity and safety scores might differ in a hospital, where clinical systems fail into harm within minutes and privacy carries legal duties that a water utility rarely faces. Recording that each score was checked, and by whom, lets a reader see that the transfer rests on verified inputs rather than on Merrow Water's panel alone.
12.6 Practical activity: same options, different weights
# Lab 12 - transferring a decision to another sector: same options, different weights (offline, stdlib only)
# Synthetic: three security programmes scored 0-10 on four criteria by Merrow Water's panel, then reused
# by Merrow Health. Scores are invented; the weights are what each sector's leadership agreed.
OPTIONS = { # option: scores on (continuity of essential service, safety of people, cost-affordability, privacy)
"P1 manual-operation readiness": (9, 7, 6, 4),
"P2 identity and remote-access": (6, 6, 7, 8),
"P3 network monitoring and response": (7, 5, 4, 6),
}
CRIT = ["continuity", "safety", "affordability", "privacy"]
WEIGHTS = {
"water": (0.45, 0.30, 0.20, 0.05),
"health": (0.25, 0.30, 0.15, 0.30),
}
for sector, w in WEIGHTS.items():
assert abs(sum(w) - 1) < 1e-9
scores = {o: sum(a * b for a, b in zip(s, w)) for o, s in OPTIONS.items()}
print(sector, " ".join(f"{o.split()[0]}={v:.2f}" for o, v in scores.items()), " best:", max(scores, key=scores.get).split()[0])
# Sweep the privacy weight, taking it proportionally from the other water weights, to find the reversal point
w0 = WEIGHTS["water"]; prev = None
for k in range(0, 61):
p = k / 100; rest = sum(w0[:3])
w = tuple(x / rest * (1 - p) for x in w0[:3]) + (p,)
best = max(OPTIONS, key=lambda o: sum(a * b for a, b in zip(OPTIONS[o], w))).split()[0]
if best != prev: print(f"privacy weight {p:.2f}: best {best}"); prev = best
Expected output:
water P1=7.55 P2=6.30 P3=5.75 best: P1
health P1=6.45 P2=6.75 P3=5.65 best: P2
privacy weight 0.00: best P1
privacy weight 0.28: best P2
Interpretation. With water's weights, manual-operation readiness (P1) scores 7.55 and is clearly preferred. With health's weights — privacy now 0.30 because patient data are at stake — identity and remote-access (P2) wins at 6.75 against 6.45. The sweep on water's weights shows that P2 overtakes P1 once privacy's weight passes about 0.28; for health, the reverse sweep (EX056) shows P1 regains first place once continuity's weight exceeds about 0.32. The transfer lesson is that the scores travelled, the conclusion did not: the same evidence, weighed by a different sector's legitimate values, recommends a different programme. The specialist's job is to make that visible, not to argue one sector into the other's weights. The reversal points also tell each leadership exactly which judgement to debate.
12.7 Common errors and limits
- Copying a conclusion from one sector without re-examining its conditions.
- Re-using another organization's weights as if they were facts.
- Defending a single weight set instead of reporting reversal points.
- Treating course completion as competence without evidence.
- Planning development only as courses, not as practice with feedback.
- Assuming today's laws, standards and threat picture will hold.
Weighted-sum models assume criteria can trade off linearly and that scores are on comparable scales; neither is fully true. They are tools for structured conversation, best used with the reversal points and the decision record.
Exercises — chapter 12
EX056 — Health's reversal point. Objective: find where the recommendation changes. Inputs: Lab 12. Constraints: sweep continuity's weight for health, taking the remainder proportionally from the other three criteria. Steps: (1) modify the sweep; (2) report the weight at which P1 overtakes P2; (3) derive the same point algebraically; (4) explain what Merrow Health's leadership should debate. Expected evidence: code, output, derivation and paragraph. Rubric: 3 = reversal between 0.31 and 0.32 by sweep and 0.318 algebraically (4.4c − 1.4 = 0), discussion focused on continuity versus privacy for clinical services; 2 = sweep only; 1 = not run; 0 = none.
EX057 — Transfer checklist. Objective: transfer a water-sector conclusion to a port. Inputs: Chapter 1's robust recommendation C (half remote-access hardening, half manual-operations capability) for Merrow Water. Constraints: use the §12.2 checklist for Port of Merrow. Steps: for each item state what differs and whether it changes the conclusion; then state what you would re-elicit. Expected evidence: table and conclusion. Rubric: 3 = differences specific (time to harm in days; contractor-run terminal OT; different regimes; supplier concentration on Halden Cloud and Lumen Watch; commercial rather than public-health consequences), conclusion re-derived rather than copied, re-elicitation listed; 2 = some items generic; 1 = copies the conclusion; 0 = none.
EX058 — Self-assessment with evidence. Objective: assess competence against the course outcome. Inputs: your exercise answers and feedback. Constraints: evidence for each claim. Steps: (1) for each chapter, list your artefact and its rubric score; (2) identify your three weakest areas; (3) write a 12-month development plan with practice activities and evidence of progress. Expected evidence: table and plan. Rubric: 3 = honest scores with evidence, weaknesses specific, plan practice-based with measurable evidence; 2 = plan course-only; 1 = no evidence; 0 = none.
EX059 — Integrating case: Merrow Bay supplier compromise. Objective: apply the whole course to one advanced case. Inputs: synthetic scenario: Corvane Systems reports that an attacker accessed its remote-support platform for eleven days; Corvane supports SCADA at Merrow Water and Merrow Energy and pathology systems at Merrow Health. Logs at Merrow Water show three Corvane sessions in that period, one at night outside any ticket. Constraints: 3,000 words maximum; synthetic data only; cite chapters for methods. Steps: (1) frame the immediate and the strategic decisions (Ch. 1); (2) state the evidence plan and initial findings (Ch. 3); (3) set restoration and protective priorities across the three operators with explicit weights (Ch. 4, 8); (4) evaluate design changes to vendor access (Ch. 5, 6); (5) address ownership, supplier concentration and forum coordination (Ch. 7); (6) draft board and regulator communications (Ch. 3, 9); (7) assess Corvane's statements critically (Ch. 10); (8) propose a follow-on project with an evaluation design (Ch. 11). Expected evidence: case report. Rubric: 0–3 on each of eight parts (maximum 24); 20+ = excellent, 14–19 = competent, below 14 = not yet competent. Full marks require explicit uncertainty, recorded value judgements and no deception in communications.
EX060 — Continuing practice and review triggers. Objective: keep the course current. Inputs: the references in this book. Constraints: identify sources likely to change. Steps: (1) list five sources (laws, standards, guidance) that you must re-verify, with how you will monitor them; (2) set review triggers for your own practice (for example a new advisory affecting your remote-access products); (3) state how you will record changes in your decision records. Expected evidence: one-page plan. Rubric: 3 = sources genuinely volatile (for example NIS2 transposition, NERC CIP revisions, SP 800-82 revision, CPG updates, sector guidance), monitoring concrete, triggers specific, change-recording method; 2 = generic monitoring; 1 = list only; 0 = none.
Chapter synthesis
The course is one method: frame, baseline, evidence, risk and distribution, design, evaluation, integration, preparation for hard cases, leadership and assurance, critical reading and honest projects — each producing an inspectable artefact. Transfer the method, not the conclusion: re-examine consequence, physics, regulation, people, data and values, and let each sector set its own weights. Report reversal points so leaders debate the judgement that matters. Assess yourself with evidence, plan practice with feedback, and keep sources and decisions under review as the field changes.
Continue studying — chapter 12 of 12
← Chapter 11 · Course chapter index · Next course via chapter index →
This is the final chapter of this course; the index links the next course in the full study path.