<a id="week-03-day-03"></a>

#### Day 13 — Assign response effort separately from causal confidence

**Mechanism and assumptions.** A priority label selects a workload and coordination path under a local policy. It is not a measured probability of compromise. Keep four judgments visible: reported/verified service impact, confidence in a particular causal explanation, time sensitivity of useful evidence, and the cost of a proposed action. Combining them into an unexplained score would conceal why a low-confidence case can still require urgent preservation. The chapter's P1/P2/P3 definitions are classroom choices. [NIST SP 800-61 Rev. 3](https://csrc.nist.gov/pubs/sp/800/61/r3/final) places response within cybersecurity risk management; it does not assign these CTN labels or authorize an account change.

**Evidence at 09:14.** The S42 symptom and C05 edit make meaningful service harm plausible, but no authoritative state or affected-user count has been supplied. C06 shows a retrieved approval for S40/S41, not a complete search of every approval. C07 weakens human attribution because the account has multiple uses. C08 reports a 10:00 evidence-expiry condition. From 09:14 to 10:00 there are 46 minutes of nominal remaining time under that statement. This is not a guaranteed retrieval budget: approval, export execution, delivery and checking all take time, and the claim may need clarification.

**Worked contrast.** Analyst A writes “low confidence; defer until tomorrow.” That ignores the reported evidence window. Analyst B writes “urgent; disable the account.” That ignores service impact and permission. A defensible decision is P2 provisional: request a narrow authorized IdP preservation and a separate current-state S42 comparison now, while keeping disruptive controls behind their own service-owner gate. The decision preserves options without declaring a cause. It remains a request until the proper custodian approves and performs it.

Make the reassessment operational. For this exercise, select **09:25** as an analyst-proposed supervisor checkpoint, not a new case event or a deadline dictated by policy. At that checkpoint ask whether the authorized request has an accepting custodian and an execution/receipt plan before 10:00. If blocked, escalate the authority gap and document what may be lost. Reassess sooner upon a verified state change, a usable source receipt or evidence of major service impact. Merely scheduling a review does not preserve data.

| Change in supplied evidence, hypothetical | Decision it could change | Conclusion it would not establish |
|---|---|---|
| Owner verifies major enrollment disruption meeting the classroom P1 threshold | Escalate coordination and priority | Which person caused it |
| Custodian confirms a bounded export is received and checkable | Advance preservation status and review its contents | Whole-case closure or complete source coverage |
| Owner verifies correct state and a scoped approved job | Reconsider impact and benign explanation | That all signals were false or no other path exists |

**Practice.** Complete [EX013](#exercise-ex013) with the four judgments, chosen priority, named roles and an event/time trigger. Compare the [worked answer](#answer-ex013). An alternative priority needs evidence and the stated rubric, not invented policy. **Limit:** the priority record allocates attention; it cannot measure business impact, authenticate an export or grant emergency powers.

**Continue studying — course Day 13:** [Previous: Day 12](#week-03-day-02) · [Week 3 index](#ch-03) · [Course index](../SUBJECTS.md) · [Next: Day 14](#week-03-day-04).

### Exercise for this lesson

<a id="exercise-ex013"></a>
**EX013 — Priority decision.** Objective: allocate response effort under uncertainty. Input: C02–C08 at 09:14 and the classroom P1–P3 rubric. Choose a provisional priority; separately state impact, causal confidence, reported expiry urgency and decision cost. Name the roles for the bounded preservation request and S42 state check, their pending authorization, a concrete proposed review time and an earlier evidence trigger. State what would justify raising priority. Rubric: 0 = unsupported compromise/impact or expiry treated as permission; 1 = defensible provisional label but missing owner, action-state distinction or review trigger; 2 = all four judgments support the label, requests remain pending, and the next review can be acted on. A different label needs evidence fitting the supplied classroom rubric; do not invent CTN policy. [Worked answer](#answer-ex013).

## Worked answers

<a id="answer-ex013"></a>
**EX013 — Model priority decision.** At 09:14 choose classroom **P2 provisional**. Potential impact: an S42 enrollment slot may be wrong, but present state and number of users affected are unknown. Confidence: C05 reports an edit, yet `s-77` has no verified link to `q-144`, and account sharing prevents attribution. Urgency: C08 states detailed events expire at 10:00, so ask the authorized custodian for a bounded export now. Review on the first of export receipt, S42 state, verified approval addendum, further symptoms or a short supervisor checkpoint before 10:00. A justified alternative priority can score two if tied to an explicit local rubric and no compromise claim.

**Additional worked reasoning (EX013 — Provisional P2 decision.):** Reported S42 service concern plus C05 recorded edit implies plausible but unmeasured impact; shared `svc-enroll`, no cross-source join and incomplete calendar limit attribution. C08's 10:00 expiry, released at 09:14, raises *preservation urgency*, not proven compromise. Name an owner-approved IdP 08:50–09:05 request and separate read-only S42 state check, with reassessment before 10:00 or on verified new damage. A P1 label without its defined high-impact evidence fails the rationale.

**Week 3 Day 13 — worked decision contract.** P2 provisional fits plausible unmeasured enrollment harm plus C08's reported loss window. Causal confidence stays limited by sharing, incomplete approval scope and no direct join. Broad account disablement has potentially large service cost and remains separately gated. Ask the identity custodian for approved, scoped preservation and the application owner for an authoritative S42 state/version comparison. A defensible proposed review is 09:25, or earlier on verified major service harm or a usable new source receipt. At 09:25, absence of an accepting custodian or execution/receipt plan calls for escalation of the blocked request; it does not prove the data has expired. Evidence meeting the classroom P1 major-impact threshold can raise priority. Correct state plus validated authorized mechanism can support reassessment, but collection alone does not close the case. The selected time is an analyst proposal, not a new case card. Two points require decision cost, pending authority and a usable trigger in addition to the original priority reasoning.