Chapter 6 — Human factors and cyber policy: operational workflow
Lesson map
Lesson 06 published. Map, example, EX026.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Daily workflow"]
N2["6.2 Times and responsibilities"]
N3["6.3 Peaks and absences"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX026"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Daily workflow"]
N2["6.2 Times and responsibilities"]
N3["6.3 Peaks and absences"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX026"]
[Learning outcomes]
|
v
[6.1 Daily workflow]
|
v
[6.2 Times and responsibilities]
|
v
[6.3 Peaks and absences]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX026]
Learning outcomes
You will (1) design the daily reporting workflow; (2) set response times and responsibilities; (3) handle peaks and absences.
6.1 Daily workflow
Grace designs the daily workflow. Staff report through a button that sends messages to a shared mailbox and shows a thank-you note. Twice a day, Grace or her backup reviews new reports, groups duplicates, sends clear harmless or spam verdicts using templates and forwards uncertain or malicious items to the IT supplier. The IT supplier confirms verdicts and removes malicious messages from all mailboxes. Grace records outcomes in the spreadsheet. The workflow takes about twenty minutes a day on normal days.
6.2 Times and responsibilities
Grace sets targets: a thank-you instantly, a verdict within one working day and removal of confirmed malicious messages within two hours of confirmation. She writes down who does each step: Grace for triage, a named backup when she is away, the IT supplier for analysis and removal, and the finance manager for any payment-related reports. Clear responsibilities stop reports falling between people, which interviews showed had happened before when nobody was sure who should reply. Managers approve the targets. Each owner signs.
6.3 Peaks and absences
During attack campaigns, reports can multiply. Grace plans for peaks: when more than twenty reports arrive about one message, she sends a short message to all staff saying the message is known and being removed, which reduces duplicate reports and reassures people. For absences, her backup has a short runbook and access to the mailbox. She tests the backup arrangement by taking a planned day off during a normal week and reviewing what happened afterwards. The test goes smoothly. Nothing is missed.
Worked example
Grace designs a twice-daily triage workflow with templates, sets response targets and named responsibilities and plans for campaign peaks and absences.
Synthetic case. The workflow is synthetic.
Errors and limits
Twice-daily review may be slow during campaigns. Backups need practice.
Exercises
- EX026 — Daily time. How long does the workflow take on normal days? Rubric: 3 = about twenty minutes;; 2 = 20 minutes;; 1 = vague;; 0 = none.
- EX027 — Verdict target. What is the verdict target? Rubric: 3 = within one working day;; 2 = one day;; 1 = vague;; 0 = none.
- EX028 — Payment reports. Who handles payment-related reports? Rubric: 3 = the finance manager;; 2 = finance;; 1 = Grace alone;; 0 = none.
- EX029 — Peak message. What does Grace send during campaigns? Rubric: 3 = a message saying the email is known and being removed;; 2 = all-staff notice;; 1 = vague;; 0 = none.
- EX030 — Backup test. How did Grace test the backup arrangement? Rubric: 3 = taking a planned day off and reviewing afterwards;; 2 = planned absence;; 1 = vague;; 0 = none.
Synthesis
A clear workflow with targets, owners and plans for peaks keeps reporting reliable.
Continue studying — chapter 06 of 12
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →