Chapter 9 — Human factors and cyber policy: leadership and assurance
Lesson map
Lesson 09 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Leading the programme"]
N2["9.2 Assurance"]
N3["Lab — Quarterly assurance measures"]
N4["9.3 Communicating uncertainty"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Leading the programme"]
N2["9.2 Assurance"]
N3["Lab — Quarterly assurance measures"]
N4["9.3 Communicating uncertainty"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX041"]
[Learning outcomes]
|
v
[9.1 Leading the programme]
|
v
[9.2 Assurance]
|
v
[Lab — Quarterly assurance measures]
|
v
[9.3 Communicating uncertainty]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) lead a human-centred security programme; (2) provide assurance to boards and regulators; (3) communicate uncertainty honestly.
9.1 Leading the programme
Daniel leads a small team and a network of thirty champions across departments. He sets a clear purpose: help people make safe choices easily and report quickly. He holds monthly champion meetings to share examples and problems. He models the behaviour he asks for, reporting his own near misses openly. Leadership in this field is less about commanding compliance and more about creating conditions in which people feel able to act safely and speak up when something seems wrong. Champions rotate yearly.
9.2 Assurance
The board and the insurance regulator ask for assurance that human risks are managed. Daniel provides a quarterly report with outcome measures: median time to first report, share of malicious emails reported, payment changes held and verified, and staff burden. He includes verification results for controls and the governance panel's decisions. The lab produces a quarter-by-quarter summary from synthetic data. Assurance means showing evidence that controls work and outcomes improve, not just listing activities completed. Each measure has a written definition.
Lab — Quarterly assurance measures
# Quarterly assurance measures (synthetic).
q = [("Q1", 52, 0.48, 3, 3.1), ("Q2", 31, 0.61, 5, 3.0), ("Q3", 19, 0.72, 4, 2.8), ("Q4", 14, 0.79, 6, 2.7)]
for name, med, share, held, burden in q:
print(f"{name}: median first report {med} min, reported share {share:.0%}, fake changes held {held}, burden {burden}/5")
Run with python3 lab_assure.py. Verified output:
Q1: median first report 52 min, reported share 48%, fake changes held 3, burden 3.1/5
Q2: median first report 31 min, reported share 61%, fake changes held 5, burden 3.0/5
Q3: median first report 19 min, reported share 72%, fake changes held 4, burden 2.8/5
Q4: median first report 14 min, reported share 79%, fake changes held 6, burden 2.7/5
9.3 Communicating uncertainty
Daniel reports uncertainty honestly. He shows intervals for rates, notes when changes are within normal variation and explains when attack volumes have changed. When the board asks whether the programme has made Calloway safe, he answers that it has reduced specific risks measurably but that no programme eliminates deception. The board values this candour. He notes that overclaiming would undermine trust when the next incident occurs, while honest reporting sets realistic expectations. He includes a short glossary of terms so board members can read intervals and variation without needing statistical training.
Worked example
Daniel leads through purpose and champions, reports outcome-based assurance quarterly and communicates uncertainty honestly.
Synthetic case. Measures are synthetic.
Errors and limits
Champions vary in commitment. Quarterly data are noisy.
Exercises
- EX041 — Programme purpose. What purpose did Daniel set? Rubric: 3 = help people make safe choices easily and report quickly;; 2 = purpose;; 1 = compliance;; 0 = none.
- EX042 — Modelling behaviour. How does Daniel model desired behaviour? Rubric: 3 = reporting his own near misses openly;; 2 = openness;; 1 = vague;; 0 = none.
- EX043 — Lab trend. How did median report time move across the quarters? Rubric: 3 = 52, 31, 19 and 14 minutes;; 2 = falling;; 1 = vague;; 0 = none.
- EX044 — Assurance meaning. What does assurance mean here? Rubric: 3 = evidence that controls work and outcomes improve;; 2 = evidence;; 1 = activity lists;; 0 = none.
- EX045 — Board answer. How did Daniel answer whether Calloway is safe? Rubric: 3 = specific risks reduced but deception not eliminated;; 2 = candour;; 1 = yes;; 0 = none.
Synthesis
Leadership creates safe conditions, and assurance reports evidence with honest uncertainty.
Continue studying — chapter 09 of 12
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →