Chapter 12 — Final review and transfer
Lesson map
Lesson 12 published. Map, example, EX056.
flowchart TD
N0["Learning outcomes"]
N1["12.1 The portfolio view"]
N2["12.2 Transfer to another sector"]
N3["12.3 Transfer brief"]
N4["12.4 Continuing development"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX056"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 The portfolio view"]
N2["12.2 Transfer to another sector"]
N3["12.3 Transfer brief"]
N4["12.4 Continuing development"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX056"]
[Learning outcomes]
|
v
[12.1 The portfolio view]
|
v
[12.2 Transfer to another sector]
|
v
[12.3 Transfer brief]
|
v
[12.4 Continuing development]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX056]
Learning outcomes
You will (1) review the course's decisions as a portfolio; (2) transfer methods from BWRP to another sector; (3) write a transfer brief for a successor; and (4) plan your own continuing professional development in OT security.
12.1 The portfolio view
Across the course, BWRP took a set of decisions: brokered vendor access (Ch. 1), gap priorities (Ch. 2), segmentation justified by tail risk (Ch. 4), tiered lift-station protection (Ch. 5), rule set B (Ch. 6), RACI and metrics (Ch. 7), storm-night response (Ch. 8), the assurance case (Ch. 9) and the monitoring project (Ch. 11). Reviewing them together shows whether they are consistent: for example, dosing integrity appears in Chapters 3, 9, 10 and 11 — a sign it is the plant's central concern.
Look for tension as well as consistency. For example, the segmentation decision and the lift-station design both depend on firewall and conduit changes, so their schedules should be aligned. The vendor-access choice and the assurance case both rely on broker evidence. Listing such links shows where a slip in one decision would undermine another.
12.2 Transfer to another sector
Methods transfer; parameters do not. Moving to a district heating operator or a food factory, the decision frame, loss distributions, controlled evaluation and assurance structure all apply. What changes: the consequence model (heat loss or product contamination instead of discharge quality), the regulators, the dominant protocols and the safety standards in force.
Before transferring, write down the assumptions each method made at BWRP: incident probabilities from water-sector peers, a cost per hour of outage, and attack behaviours in the replay. Each needs replacing with figures from the new sector. The structure of a decision record or assurance case moves unchanged; the numbers inside them must not.
12.3 Transfer brief
A successor needs: the open decisions and their revisit triggers, the assurance case with expired or missing evidence highlighted, the metrics and their baselines, relationships (vendors, regulator contacts, sector information-sharing groups) and known weak spots. Two pages, with links to the full records.
Write the brief for a reader who has never met Daniel. Each open item should name its trigger and date, each metric its denominator and baseline, each relationship a contact and its last use. Link to the full records rather than repeating them, and date the brief on its first line.
12.4 Continuing development
The field moves: NIST SP 800-82 was revised in 2023; IEC 62443 parts are periodically updated; MITRE ATT&CK for ICS adds techniques; CISA publishes advisories weekly. Plan: follow advisories for your vendors, re-read a standard's change summary when a new edition appears, and present one case study a year to peers.
Keep a short log of what you read and what you changed because of it, such as a revised assumption or a new question for a vendor. Review the log once a year with a peer. Development that changes nothing in practice is reading; development that leaves a trace in your decisions is what keeps a lead credible.
Worked example (synthetic BWRP)
Daniel's transfer brief begins: "Open: D-2026-14 revisit if the vendor incident frequency estimate exceeds 0.06 per year or after any remote-access incident. Assurance: G1 supported since February via E5; E4 restore drill expires May 2027 — schedule now. Metrics: RTU inventory 23/23 since March; vendor-session review 37/37. Weak spot: lift-station router firmware patching has no window agreed with operations."
Synthetic case — Bayside Water Reclamation Plant. All brief contents are invented.
Errors and limits
Transfer briefs go stale; date them. Portfolio reviews can rationalise past choices; look for contradictions deliberately.
Exercises
- EX056 — Spotting an inconsistency. Identify a tension between Chapter 5's decision and Chapter 7's metrics. Rubric: 3 = new RTU routers (Alt 2) add assets/patching not yet reflected in metrics; 2 = plausible other tension; 1 = vague; 0 = none.
- EX057 — Transferring the consequence model. Rewrite BWRP's central concern for a food factory. Rubric: 3 = product contamination/recall via recipe or temperature manipulation; 2 = vague; 1 = same as water; 0 = none.
- EX058 — The expiring evidence. When must the restore drill be repeated to keep G4 supported under the 18-month rule? Rubric: 3 = before May 2027; 2 = approximately; 1 = wrong; 0 = none.
- EX059 — What a successor needs first. Choose the single most important item in the brief and justify it. Rubric: 3 = reasoned choice (e.g. open decision with near trigger or weak spot); 2 = choice only; 1 = vague; 0 = none.
- EX060 — A development plan. Write a three-item annual development plan. Rubric: 3 = advisory follow, standard update review, peer presentation or equivalent; 2 = two; 1 = one; 0 = none.
Synthesis
The course ends where practice begins: a consistent portfolio of decisions, methods that transfer across sectors, a dated brief for whoever comes next and a plan to keep learning.
Continue studying — chapter 12 of 12
← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →