OpenCyber Academy
Postgraduate · Chapter 12 · English
Course code: OCA-156Chapter 12: OCA-156-C012

Chapter 12 — Final review and transfer

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 12 published. Map, example, EX056.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 A personal framework"]
  N2["12.2 Transfer"]
  N3["12.3 Continuing development"]
  N4["12.4 Handover"]
  N5["12.6 Final assessment"]
  N6["Mentoring the next lead"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX056"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 A personal framework"]
  N2["12.2 Transfer"]
  N3["12.3 Continuing development"]
  N4["12.4 Handover"]
  N5["12.6 Final assessment"]
  N6["Mentoring the next lead"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]

[Learning outcomes]
    |
    v
[12.1 A personal framework]
    |
    v
[12.2 Transfer]
    |
    v
[12.3 Continuing development]
    |
    v
[12.4 Handover]
    |
    v
[12.6 Final assessment]
    |
    v
[Mentoring the next lead]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX056]

Learning outcomes

You will (1) consolidate the course's methods into a personal practice framework; (2) transfer them to new organisations or sectors; (3) plan continuing development; (4) hand over a programme responsibly.

12.1 A personal framework

Summarise your practice on one page: decision-first requirements (chapter 1), sourcing mix (2), ACH and calibration (3, 9), risk and ethics governance (4), standards-based design (5), controlled evaluation (6), TLP-enforced integration (7), crisis discipline (8), research critique (10). Rafael's own page follows this outline, with an example from NLG for each item: the segmentation decision for requirements, FPSC and incident review for sourcing, the data-theft matrix for ACH, the leak-site case for crisis discipline, and the vendor study for critique. The page becomes part of his handover pack, so his successor sees the method as well as the records.

12.2 Transfer

Moving to another sector changes threats, regulators and communities but not the method. A healthcare or energy organisation will need sector-specific sharing communities and safety considerations, but requirements, evaluation and TLP discipline transfer intact. Rafael notes that NLG's own method came from general CTI practice adapted to logistics: the requirements process, ACH and TLP gates would work unchanged in another sector. What changes is the community, the threats that matter and regulators' expectations. A healthcare organisation would also need to consider patient safety when deciding what to share and how quickly.

12.3 Continuing development

Follow ATT&CK and STIX updates, take part in community working groups, read research, and track your own calibration. Mentoring others consolidates learning. Rafael's plan after promotion includes staying in FPSC working groups and continuing the calibration record he started for the team. He mentors the analyst who took over the CTI function, which also helps him reflect on what worked. Updates to ATT&CK and STIX are reviewed for changes that affect NLG's platform or detection backlog.

He reviews his calibration record each year to see where his estimates drifted.

12.4 Handover

If you leave, hand over requirements, source catalogue, platform documentation, decision records, review logs and community contacts with introductions. Transfer TLP-restricted relationships properly; memberships are often organisational, not personal. When Rafael handed over NLG's CTI function, the pack included all of these, and he introduced his successor to FPSC contacts in person during a two-week overlap. FPSC confirmed the new analyst's access under the existing membership. Six months later the decision-record practice continued, which showed the handover had worked.

He also leaves notes on open requirements and who asked for each one.

12.5 Reflecting on limits

CTI informs decisions under uncertainty; it rarely delivers certainty. Mature practitioners are comfortable saying "we do not know" and explaining what would reduce uncertainty. In the data-theft case, Rafael's report said the leading explanation was supplier compromise at low-to-moderate confidence and named what would reduce the uncertainty: the supplier's VPN log. Leadership could act on supplier access restrictions without waiting for certainty. Saying what is unknown made the assessment more useful, not less.

Rafael asks his successor to keep this habit, and to write the missing evidence into every assessment so readers know what could change it.

12.6 Final assessment

The course closes with a portfolio: the decision record set, an ACH product, an evaluation report and the project report, each reviewed against ICD 203 standards. Each piece of the portfolio shows a different skill from the course. The decision records show requirements tied to decisions; the ACH product shows structured analysis; the evaluation report shows controlled comparison; the project report shows integration with detection. Rafael's portfolio uses his NLG work, with restricted FPSC content removed before assessment.

Rafael's tutor reviews the portfolio against the assessment criteria before it is submitted.

Mentoring the next lead

Teaching the method to a successor tests whether it is written down clearly. Rafael's successor drafts the next quarter's requirements while he reviews; gaps in documentation surface quickly and are fixed before he leaves. A short checklist of recurring tasks with owners and dates completes the transfer.

Worked example

Rafael is promoted to lead security across NLG. He hands the CTI function to an analyst he trained, with a two-week overlap. The handover pack includes FPSC introductions; FPSC confirms the new analyst's access under the existing membership. Six months later, the decision-record practice continues without him.

Synthetic case. The promotion and handover are invented.

Errors and limits

Frameworks age; review yours annually.

Exercises

Synthesis

Consolidate a personal framework, transfer method across sectors, keep learning and hand over responsibly.

Continue studying — chapter 12 of 12

← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →

Worked answers

EX056. Example: decision-first requirements; sourcing mix led by internal data; ACH with calibrated confidence; fail-closed TLP dissemination; quarterly controlled evaluation of triage.

EX057. Threat actors, sharing communities, regulators and safety concerns change; requirements, evaluation, analytic standards and TLP discipline stay.

EX058. Memberships and sharing agreements belong to the organisation and depend on trust; access must be re-authorised through the community.

EX059. Requirements list, source catalogue, platform documentation, decision records and community contacts with introductions (also review logs).

EX060. It states uncertainty honestly and, paired with what would resolve it, guides further collection instead of encouraging false confidence.