Chapter 12 — Final review and transfer
Lesson map
Lesson 12 published. Map, example, EX056.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Portfolio"]
N2["12.2 Transfer"]
N3["12.3 Research questions"]
N4["12.4 Dual-use"]
N5["12.5 Next course"]
N6["12.6 Care"]
N7["12.7 Narrative"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX056"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Portfolio"]
N2["12.2 Transfer"]
N3["12.3 Research questions"]
N4["12.4 Dual-use"]
N5["12.5 Next course"]
N6["12.6 Care"]
N7["12.7 Narrative"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]
[Learning outcomes]
|
v
[12.1 Portfolio]
|
v
[12.2 Transfer]
|
v
[12.3 Research questions]
|
v
[12.4 Dual-use]
|
v
[12.5 Next course]
|
v
[12.6 Care]
|
v
[12.7 Narrative]
|
v
[Worked example] --> [Exercise EX056]
Learning outcomes
You will (1) assemble a specialist portfolio; (2) transfer programme ownership; (3) state remaining research questions; (4) restate dual-use limits.
12.1 Portfolio
The specialist portfolio holds decision records, the catalogue page, evidence standards, an ethics charter excerpt, evaluation results, assurance examples, critique notes and the project handover. The contents list follows the course order, from DEC-14 and the catalogue page through to the handover note and the solo-run defect log. Amira reviews the portfolio once for residual sensitive data, and synthetic examples replace anything that could identify participants before it leaves her review. Each item carries its hash, so the successor can confirm nothing was altered afterwards.
12.2 Transfer
At transfer, the successor reads DEC-14 and the two-year calendar aloud; Amira answers questions but does not retain secret folklore. Questions the successor asks during the reading are added to the DEC-14 record as clarifications, not kept as verbal answers. Transfer day includes walking introductions to SOC and legal, because email alone is not transfer. The successor's first catalogue update is the next twice-yearly review, dated, redlined and posted under their own name, with Amira only copied. A successor who has only been emailed the files has not yet been handed the programme.
12.3 Research questions
How to measure detection learning across biennial threat-led exercises without exhausting white-team capacity remains open. Purple-team measures between exercises are one candidate, but they test detection rules rather than learning across a two-year gap. Leaving the question without an owner would make it folklore that dies when Amira leaves. Before she exits she therefore names a watcher and sets a quarterly invite, so the question stays alive at Meridian Clearing House and has someone accountable for reporting what has changed.
12.4 Dual-use
Amira's final slide lists her refusals: no public clearing exploit detail, no live demos against participants, no assurance without denominators. The no-denominator refusal is why every count in her packs, from amnesty results to pre-check rates, carries the number behind it. She will not trade those refusals for a conference invitation. Dual-use discipline closes the course in the same way that integrity opened it, and the slide is part of the portfolio the successor inherits. The successor is expected to keep the slide unchanged until a decision object says otherwise.
12.5 Next course
AI security (158) is next in the curriculum path. Amira tells successors which skills from this course transfer — decision objects, catalogue honesty, assurance language — and which do not. Successors starting AI security bring the decision clinic and the catalogue habit, but they begin a fresh authorization path: authority to touch new systems does not transfer, and the next course does not grant authority to test real AI systems without a new ROE. Nothing in this book is inherited as permission. Every new system starts with its own written scope.
12.6 Care
Transfer includes introducing the successor to SOC and legal personally; these introductions are part of care, not optional courtesy when calendars resist. Amira books them herself, so the successor meets the SOC lead and the legal contact in the first week. Legal uses its introduction to walk the successor through the pre-approved participant notice templates. The SOC introduction includes a five-minute shadow of the SOC stand-up, so the successor has watched real SOC work before taking over the role. Both introductions are logged on the transfer form with their dates.
12.7 Narrative
Folklore ends when names and dates replace hallway advice. Transfer day includes walking introductions to SOC and legal, because email alone is not transfer. Open research questions get named watchers before Amira exits. The successor's first catalogue update posts under their own name with Amira only CC'd — the visible handoff. Together these steps mean the transfer leaves writing rather than a personality cult, and a later examiner can see when ownership changed and who holds each open question. Amira's own name moves to the CC line on every record she used to own.
12.8 Watcher invite
The watcher for the open research question receives a quarterly calendar invite with Amira optional — succession of curiosity. The agenda has one item: what changed since last quarter in measuring detection learning across biennial exercises. Leaving Amira optional tests whether the question survives without her steering it. If attendance collapses, the watcher escalates to the CISO for a new owner rather than quietly dropping the topic; curiosity needs governance too. The first invite goes out before her last day, so the series starts while she can still answer questions.
12.9 SOC shadow
Amira will not call transfer complete until the successor has shadowed five minutes of the SOC stand-up and heard noise-budget talk live, not only in a slide. Hearing an analyst argue about a noise budget teaches the successor what the quarterly SOC sync is actually for. She schedules the shadow even when calendars resist; it takes five minutes, so a full calendar is never a real reason to skip it. Transfer without SOC reality is incomplete. The shadow date is written on the transfer form beside the successor's initials.
12.10 Transfer form
The transfer form has a checkbox, "SOC shadow completed", that blocks signature while it is empty, which makes the shadow a precondition rather than a recommendation. The successor and Amira both initial the box; initials without the box checked never close transfer at Meridian Clearing House. The form is filed with the portfolio, and an unchecked box returns it to Amira with the shadow still owed. Precondition language is how transfer avoids becoming a paperwork fiction. No exception path exists on the form, even for a successor who has worked in the SOC before.
Worked example (synthetic MCH)
Amira's transfer day ends with the successor posting the first catalogue update under their own name; Amira is CC only.
Synthetic case — Meridian Clearing House (MCH). The clearing organisation, Amira Hassan and all figures are invented for teaching.
Errors and limits
Threat-led and clearing-system tests require specialised legal authorization. This book uses synthetic scenarios only and never supplies exploit code or live targeting advice for market infrastructures.
Exercises
- EX056 — Portfolio count. List five portfolio artefacts. Rubric: 3 = five from list; 2 = three; 1 = one; 0 = none.
- EX057 — Folklore. What must not remain only in Amira's head? Rubric: 3 = decision rationale / programme rules; 2 = partial; 1 = everything secret; 0 = none.
- EX058 — Open question. State one remaining research question. Rubric: 3 = measuring detection learning vs white-team capacity; 2 = vague; 1 = minimal attempt; 0 = none.
- EX059 — Refusal list. Name two final refusals. Rubric: 3 = two of no public exploits, no live participant demos, no assurance without denominators; 2 = one; 1 = vague; 0 = none.
- EX060 — Next course. What is course 158? Rubric: 3 = AI security; 2 = AI; 1 = wrong; 0 = none.
Synthesis
Transfer leaves writing, refusals and an open research question — not a personality cult.
Continue studying — chapter 12 of 12
← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →