◇ OpenCyber Academy
Postgraduate · Chapter 7 · English

Chapter 7 — Organizational integration

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Organizational integration

Lesson map

Lesson 07 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Integration map"]
  N2["7.2 Shadow programmes"]
  N3["7.3 Cadence"]
  N4["7.4 Health metrics"]
  N5["7.5 Participant care"]
  N6["7.6 Failure mode"]
  N7["7.7 Narrative"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Integration map"]
  N2["7.2 Shadow programmes"]
  N3["7.3 Cadence"]
  N4["7.4 Health metrics"]
  N5["7.5 Participant care"]
  N6["7.6 Failure mode"]
  N7["7.7 Narrative"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]

[Learning outcomes]
    |
    v
[7.1 Integration map]
    |
    v
[7.2 Shadow programmes]
    |
    v
[7.3 Cadence]
    |
    v
[7.4 Health metrics]
    |
    v
[7.5 Participant care]
    |
    v
[7.6 Failure mode]
    |
    v
[7.7 Narrative]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) integrate testing with SOC, risk, legal and participants; (2) design information flows; (3) avoid shadow programmes; (4) measure integration health.

7.1 Integration map

Amira draws who receives what: the SOC gets ATT&CK tags and timelines; risk gets ranked residuals; legal gets disclosure-relevant facts; participants get only what contracts allow. A finding tagged with ATT&CK techniques for the SOC is restated for risk as a ranked residual before it moves. Participant notices draw only on contract-allowed facts, so a SOC timeline never reaches a clearing member by forwarding; oversharing into the wrong channel is how trust with clearing participants breaks. The diagram sits in the integration playbook and is reviewed whenever a new stakeholder appears.

7.2 Shadow programmes

Business units hiring boutique scanners without ROE create shadow risk; integration means one catalogue and one authorization path. A boutique scan without ROE has no stop authority and no exclusion list, so it could touch SWIFT-adjacent hosts unnoticed. Amnesty week invites declarations so shadow scans enter the catalogue or stop. Declared scans that continue go through the same authorization path as Amira's own quarterly WSTG-style web tests, and after amnesty week every external scan enters through the same request form that internal tests use. Undeclared scans found later become audit findings against the unit, not quiet exceptions.

7.3 Cadence

Amira runs a quarterly sync with the SOC on noise budgets, a monthly review with risk on acceptance expiries, and ad hoc meetings with legal on disclosure. The SOC sync agrees how many alerts each planned test may generate, so analysts can separate test noise from real attacks. She keeps the calendar invites recurring so integration does not depend on memory. A missed sync is logged as programme debt, not as personal failure, and the debt list is reviewed at the next catalogue review so repeated misses lead to a cadence change rather than to blame.

7.4 Health metrics

Integration health is measured by the percent of findings with owners, the percent of tests in the catalogue and the median time from finding to detection ticket. Median time to detection ticket is the slow figure on the worked scorecard, which is why the PulseMap-to-backlog bridge was funded. Amira refuses vanity counts of raw findings without validation; they stay off management slides. The three health metrics appear beside the amnesty counts on the same slide family, so the board sees programme hygiene rather than volume.

7.5 Participant care

Clearing participants are customers of trust, and a wrong phrase in a participant notice can cause market noise that no finding severity can justify. Communications templates are therefore pre-approved by legal and participant management, and they are the only words that leave the building. Amira does not invent wording under pressure when a notice is needed. Templates are versioned, and the version number is logged with each notice, so legal can reconstruct exactly what a participant received and when. During test-related incidents involving participants, she rejects ad-lib emails even from senior staff.

7.6 Failure mode

Integration fails when testing is a heroic annual event with no backlog into BAU engineering; heroics without backlog produce the same issues next year, and examiners notice when they return. The PulseMap-to-backlog bridge exists so each detection gap found in testing lands as an ordinary engineering ticket, not a slide. Every finding that needs a fix must have a ticket in the ordinary engineering queue before Amira calls integration healthy. A finding that only ever appears in a board pack is counted as unintegrated, however well it was presented.

7.7 Narrative

Shadow-programme amnesty week invites business units to declare boutique scans. Each declaration names the vendor, the targets scanned and the unit lead who commissioned the work. Declared scans enter the catalogue or stop, and undeclared scans found later become audit findings against the unit lead. The rules are published before the week starts, because amnesty without consequences for later concealment is theatre. At the close of the week the declaration list goes to internal audit, so later discoveries can be checked against it without argument about what was declared.

7.8 Amnesty slide

Amnesty week metrics — declared, catalogued, stopped — go to the board risk committee in one slide. Keeping the three counts together lets the committee see whether declarations led to tools actually being stopped. The stopped count is printed as large as the declared count and sits in the main slide, never in a footnote, so nobody can read the slide as a list of approvals and a stalled shutdown cannot be hidden. Transparency about the stopped count is what shows the amnesty had teeth.

7.9 Amnesty results

Amnesty week produced twelve declarations: eight catalogued, four stopped. The four stopped scans could not be brought under an ROE with stop authority, so they ended rather than entering the catalogue. The slide to the risk committee used those three numbers only; unit names stayed in the catalogue, keeping the committee focused on whether the amnesty worked. Amira refuses amnesty narratives without counts. Units that stayed silent and were later found scanning received findings with owners named in the minutes, and those findings carry the amnesty dates so a unit cannot claim it never heard about the window.

7.10 Archived counts

Amnesty counts are archived with the hash of the signed committee minutes, so a later reader can check that the reported figures were the ones the committee saw. The archive entry stores the twelve, eight and four counts, the slide file and the minute hash together. Amira also records the hash in the catalogue changelog, so the record survives a change of committee secretary. She has used that check when a unit disputed whether it had declared; producing the hash settled the dispute.

Worked example (synthetic MCH)

Amira's integration scorecard shows 100% catalogue coverage but slow detection-ticket time; she funds a PulseMap-to-backlog bridge.

Synthetic case — Meridian Clearing House (MCH). The clearing organisation, Amira Hassan and all figures are invented for teaching.

Errors and limits

Threat-led and clearing-system tests require specialised legal authorization. This book uses synthetic scenarios only and never supplies exploit code or live targeting advice for market infrastructures.

Exercises

Synthesis

Integration is one catalogue, named recipients and BAU backlog — not annual heroics.

Continue studying — chapter 07 of 12

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →