<a id="week-09-day-02"></a>

#### Day 42 — Build a restricted coordination note as a reproducible decision artifact

**Objective.** Produce an internal, source-pinned and approval-bounded note with the minimal next investigation request, without converting a draft into a sent instruction. Complete [EX042](#exercise-ex042).

**Technical teaching.** A message has two layers: its *claims* and its *release process*. The claims layer records audience, purpose, as-of horizon, source IDs, missing evidence and what a custodian must verify. The process layer records version, restricted classification, technical and privacy reviewers, authorized release role, channel and dispatch receipt. A response lead may own factual coordination without having independent authority to unmask a recipient, issue a legal hold or publish a learner notice. [NIST CSF 2.0](https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20) offers risk-governance and response outcome context, but does not confer CTN's fictional approvals.

A negative query requires a **completeness contract**: event type expected, identifier semantics, producer health, queried window, filters, ingestion lag and provenance. C33's scoped “not-dispatched” entries answer an internal queue-state question. The gateway's missing 10:49–10:51 interval prevents a global external-send negative. Requesting an entire contact database would not close that instrumentation gap and would expand private-data exposure.

**Worked example: internal draft v1, evidence cutoff 11:00 (not dispatched).**

> CTN-IR-014 / restricted coordination DRAFT v1. C29/C30 support limited S42 acceptance at 10:45 with further monitoring assigned. C31 reports one 10:47 staging batch, mail-sync-04, containing 12 pseudonymous tokens. C33 reports the inspected internal queue entries not-dispatched; the gateway window 10:49–10:51 is missing. No external-delivery or personal-data finding is established. Under C32's privacy assessment, request that authorized queue/gateway custodians validate batch correlation, source coverage, retry semantics and preservation receipts without exporting contact mappings. Ask which event stage each source actually records, the exact query interval and filters, the time basis and ingestion lag, and whether a separate authenticated dispatcher record could cover the gateway gap. Preserve failed query attempts as limitations, not negative findings. Privacy steward owns this scope decision; incident lead owns the 12:00 status. Communications approval and transmission remain pending.

| Release-manifest field | Correct status |
|---|---|
| Audience and data classification | Authorized response group; restricted storage for original evidence |
| Evidence basis | C30 service outcome; C31–C33 separate data question at 11:00 |
| Proposed next artifact | Custodian-authenticated gateway/dispatcher query for batch and 10:49–10:51 with field and coverage definitions |
| Approval and delivery | Internal draft; decision-owner review pending; **no dispatch receipt** |

**Wrong but plausible alternative.** “Service fixed, twelve emails safe, notify everyone” conflates limited service acceptance, a source-bounded queue status, personal-data determination and an unapproved release. An editor must identify which evidence and authorization are missing rather than merely make the language less categorical.

**Independent practice.** [EX042](#exercise-ex042) retains its **100–160-word** internal-note requirement. Write the note with C30–C33, plus the manifest outside the count. Name the exact gateway gap and the custodian's required receipt, not a speculative legal deadline or a completed retrieval. **Artifacts:** restricted v1 note and a review/source-request manifest. **Rubric 0–2:** 2 for a usable bounded handoff with owners and next checkpoint; 1 when evidence is correct but release/request is underspecified; 0 for invented exposure, mapping, legal clearance or transmission. Compare [the model answer](#answer-ex042).

**Continue studying — Day 42:** [← Day 41](#week-09-day-01) · [Course index](../SUBJECTS.md) · [Day 43 →](#week-09-day-03)

### Exercise for this lesson

<a id="exercise-ex042"></a>
**EX042 — Restricted coordination note.** Inputs: C30–C33. Draft a 100–160-word internal status note with the 12-token observation, `not-dispatched` status, gateway gap, ownership, evidence request and next update. A 2-point result does not announce an exposure finding.

## Worked answers

<a id="answer-ex042"></a>
**EX042 — Model restricted note.** “CTN-IR-014, 11:00 draft for the response group: C30 supports a limited S42 return to service at 10:45 after the 10:26 change and monitored checks; the application owner continues the two-hour watch. C31 reports an internal `mail-sync-04` staging batch with 12 pseudonymous recipient tokens, not 12 identified people. C33's scoped queue status says `not-dispatched` for those entries, while the inspected external-gateway records have a 10:49–10:51 gap. No external delivery or data-exposure finding is established. The privacy steward owns a bounded follow-up with the queue and gateway custodians and decides whether token mapping is needed under an approved purpose. Preserve original queue metadata and query limits. The incident lead will provide the next status at 12:00; no unsanctioned contact-list export or public data claim is approved.”

**Additional professional worked reasoning:** For a learner audience, use only supported service status, monitoring, useful action and a next update; withhold internal account labels, recipient tokens, unconfirmed cause and a breach determination. The message remains DRAFT until the designated service/communications review is complete. A 12:00 update time promises another status, not proof the case will be closed by then.