Chapter 12 — Practice portfolio and final review

Chapter 12 — Practice portfolio and final review

Lesson map

Lesson 12 published. Map, example, EX060.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["12.1 The portfolio"]
  N2["12.2 The board briefing"]
  N3["12.3 The 90-day plan"]
  N4["12.5 Final review"]
  N5["12.6 Practical activity"]
  N6["Chapter synthesis"]
  N7["Chapter 1"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX060"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["12.1 The portfolio"]
  N2["12.2 The board briefing"]
  N3["12.3 The 90-day plan"]
  N4["12.5 Final review"]
  N5["12.6 Practical activity"]
  N6["Chapter synthesis"]
  N7["Chapter 1"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX060"]

[Learning outcomes and connection]
    |
    v
[12.1 The portfolio]
    |
    v
[12.2 The board briefing]
    |
    v
[12.3 The 90-day plan]
    |
    v
[12.5 Final review]
    |
    v
[12.6 Practical activity]
    |
    v
[Chapter synthesis]
    |
    v
[Chapter 1]
    |
    v
[Worked example] --> [Exercise EX060]

Learning outcomes and connection

After this chapter you should be able to:

• assemble a professional portfolio that shows, with evidence, what you can do as a coordinator;
• brief a board on critical-infrastructure security in ten minutes with decisions requested;
• write a realistic 90-day plan for a new coordination role;
• assess your own work against the course outcome and identify what you still need to learn.

This chapter closes the course: it pulls the outputs of Chapters 1–11 together and tests whether you can operate a repeatable workflow and communicate findings.

12.1 The portfolio

A coordinator's portfolio is not a certificate; it is a set of work products that someone else could check. Build it from the exercises you completed, sanitised and clearly marked as course work on synthetic data:

Add a one-page reflection: what you would do differently, and one area you need to learn more about (for example, technical OT fundamentals from the technical course, or legal duties in your jurisdiction).

12.2 The board briefing

Boards of essential-service operators increasingly carry explicit responsibility for cybersecurity risk management (for example NIS2's requirements on management bodies, Directive (EU) 2022/2555, Article 20). A ten-minute briefing has five parts:

1. Context — the service, the consequence that matters, and the threat picture at the level of public advisories.
2. Where we stand — top consequence-ranked risks with owners and dates; assurance levels of the key controls.
3. What we learned — the last exercise or incident, in two or three findings.
4. What we are doing — the plan, with progress against it.
5. What we need from you — decisions: risk acceptances, budget, appetite statements, priorities.

Avoid jargon, single scores and fear. Boards act on clear consequences, credible plans and specific requests.

12.3 The 90-day plan

A new coordinator's first 90 days, distilled from this book:

• Days 1–30: listen and map. Meet every "decides" and "must be told" stakeholder; draft the dependency map; read the risk register, incident history and supplier list; record what is assumed.
• Days 31–60: fix ownership. Owners for every level-5 risk; a RACI for incidents; an escalation card; a notification register; a first supplier-access review.
• Days 61–90: test and report. A first tabletop on the most likely high-consequence scenario; an AAR and improvement plan; a first board briefing with decisions requested.

Resist the temptation to start with a new framework, a new tool or a long policy. Ownership, information and rehearsal first.

12.4 Worked example: the October board briefing (synthetic)

The coordinator's ten-minute briefing to Kestrel Water's audit and risk committee, chaired by T. Lindqvist, in summary:

1. Context. "Our job is safe water for 180,000 people, including Kestrel General Hospital. Public advisories describe attacks on internet-exposed water controllers (CISA AA23-335A); we have checked and have none exposed, confirmed in September."
2. Where we stand. "Three risks could affect health or the hospital; all now have owners. Supplier MFA is in place for five of six suppliers and verified by test for two; restore of the historian was tested in August in 19 hours against a 24-hour objective."
3. What we learned. "Exercise DRY CREEK showed we did not know who calls the hospital and that suspending a supplier is slow when we don't know who depends on it. Both are fixed; we will retest in January."
4. What we are doing. "Five of seven exercise actions closed and verified; two due in November."
5. What we need. "First, accept the KW-10 controller exception until March, with compensating measures. Second, approve the supplier contract clauses for all renewals. Third, set an appetite statement: no level-5 risk without a funded treatment for more than 12 months."

Every number has a source in the portfolio. Nothing is a single score.

12.5 Final review

The course outcome asks you to operate a repeatable workflow and communicate findings. Check yourself against the cycle:

• Frame and identify — can you describe a service by consequence and find risks in conversation?
• Analyse and decide — can you write ownable risks, rank them reproducibly and record decisions and acceptances?
• Organise — can you assign roles, govern change and escalate?
• Verify — can you distinguish stated from tested and design proportionate checks?
• Communicate — can you meet clocks and brief customers, the public and the board honestly?
• Improve — can you test with an exercise and close actions with evidence?

Where the answer is "not yet", the chapter number tells you where to return.

12.6 Practical activity

Assemble your portfolio from your exercise answers. Ask a peer to review it against the final rubric (EX060) and to try to verify three claims from your evidence alone.

Choose claims that matter, such as "supplier MFA verified by test for two suppliers" or "historian restored in 19 hours", and see whether your peer can find the record, date and owner behind each from the portfolio alone. Where they cannot, fix the evidence rather than the wording. Mark every item clearly as course work on synthetic data, and remove anything that could identify a real organization or person before you share it.

12.7 Common errors and limits

• Portfolios of certificates instead of work products.
• Board briefings without requests.
• 90-day plans that start with tools.
• Presenting synthetic course work as real organizational findings.

• This course does not make you a technical OT specialist or a lawyer; know when to call one.

• Reporting a claim to the board without a source in the portfolio, so nobody can check it later.

• Asking the board for a decision without saying what happens if it declines, such as how long the KW-10 exception would otherwise run.
• Updating the portfolio once and letting it go stale after the course ends.

Exercises — chapter 12

EX056 — Portfolio index. Objective: assemble evidence. Inputs: your exercise answers. Steps: produce the portfolio index with artefact, chapter, and the claim each supports. Expected evidence: index of at least eight artefacts. Rubric: 3 = each artefact linked to a specific claim and exercise, sanitised and labelled synthetic; 2 = index without claims; 1 = list of chapters; 0 = none.

EX057 — Board briefing. Objective: communicate to governance. Inputs: 12.2 and your portfolio. Steps: write the briefing script (max. 600 words). Expected evidence: script. Rubric: 3 = five parts, consequences in plain language, sourced numbers, assurance levels stated, three specific requests; no single score; 2 = no requests; 1 = technical report; 0 = none.

EX058 — 90-day plan. Objective: plan a role. Inputs: a new coordinator post at a regional hospital trust. Steps: write the 90-day plan with three phases and deliverables. Expected evidence: plan. Rubric: 3 = adapts to healthcare (clinical leadership as decision-makers, medical devices, patient safety, critical internal dependencies), ownership before tools, exercise and board report by day 90; 2 = generic; 1 = tool-first; 0 = none.

EX059 — Verify a claim. Objective: test evidence. Inputs: the claim "restore of the historian was tested in August in 19 hours". Steps: list the evidence you would expect in the portfolio to support it and two questions a sceptical auditor would ask. Expected evidence: list and questions. Rubric: 3 = test plan, authorization, timed log, result record, data-completeness check; questions about scope (full or partial restore) and environment (isolated or production-like); 2 = evidence only; 1 = "trust the engineer"; 0 = none.

EX060 — Self-assessment. Objective: reflect against the course outcome. Inputs: 12.5. Steps: rate yourself 0–3 on the six cycle areas with evidence for each and a learning plan for the two lowest. Expected evidence: six ratings and a plan. Rubric: 3 = honest ratings each backed by a portfolio artefact, specific learning plan with resources and dates; 2 = ratings without evidence; 1 = all 3s; 0 = none.

Chapter synthesis

A professional coordinator shows competence through checkable work products: maps, records, registers, RACIs, control cards, case briefings, notification registers, exercise reports and improvement plans. Brief boards with consequences, evidence and specific requests; start a new role with ownership, information and rehearsal; and assess yourself honestly against the full cycle — frame, decide, organise, verify, communicate, improve.

Continue studying — chapter 12 of 12

← Chapter 11 · Course chapter index · Next course via chapter index →

This is the final chapter of this course; the index links the next course in the full study path.