Hand over a readiness decision that another shift can falsify

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Day 5 — Hand over a readiness decision that another shift can falsify

Learning decision. A professional handoff is a decision instrument, not a narrative of everything the analyst read. Carry forward the service outcome, two highest-consequence unknowns, the authorized owner for each next check, the proposed negative control, and the exact point at which a claim can be revised. Organize each statement by status: worksheet observation, inference, proposed test, authorized test, executed result, or owner acceptance. In C01, only the worksheet and its omissions are case observations. The W1 transaction, matrix and clock examples are teaching variants; importing their apparent passes into the main CTN case would corrupt the later investigation.

Use an operational priority rule: ask which missing fact could close a decision window and what harmless action is possible now. The undocumented identity alternate may affect access to short-lived detail; the unverified restore may affect later recovery acceptance. Neither is a percentage. Rank by the decision harmed and the evidence needed, then assign a check to an actual role. An issue is not closed because a named person has been contacted; closure requires the specified proof, reviewer and retest when the relevant condition changes. NIST SP 800-84 discusses designing and evaluating training and exercises; the exact CTN scoring and handoff fields here are original teaching choices, not mandated NIST paperwork.

Worked example. The reviewer receives two candidate handoffs. “CTN is ready: logs show the scheduled job is fine, and IT will restore if needed” fails: C01 supplies no executed log test, “IT” is not an owner, and a backup job is not a verified restore. A defensible alternative is: “C01 lists enrollment dependencies but leaves the identity alternate and service-owner fallback blank. The API-audit 24-hour claim lacks an anchor. The application custodian should seek approval for a training S41 scheduled write and S40 exclusion control, then record request fields and verified retrieval time. The identity owner should confirm a delegated after-hours export route; the recovery lead should propose an isolated acceptance check. All tests are pending; no incident is inferred.” This record is short because its boundaries are explicit, not because the situation is resolved.

Review the draft as if you were the next shift. Can you identify who will do the S41 test, what would falsify it, which clock they will use and which decision remains blocked if the identity route is unavailable? If any answer is missing, send it back for revision. Keep the classification of test proposed distinct from test run; the event time and actual execution record must be added only after a permitted rehearsal occurs. This allows the next shift to check progress without pretending that a plan is a result.

Practice. Submit EX005 using your EX001–EX004 artifacts; write the required 90–140-word handoff and a two-row owner/retest table. Compare its worked answer, which is one defensible example rather than a unique script. Limit: another organization may allocate roles differently under its own approved policy; never infer local authority from this fictional handoff. Previous: Day 4 · Week index · Next: Chapter 2.

Exercise for this lesson

EX005 — Readiness handoff. Input: your EX001–EX004 artifacts. Write a 90–140-word shift handoff with service outcome, top two gaps, owners, proposed tests and no incident conclusion. A 2-point result labels tests as proposed and assigns owners.

Worked answers

EX005 — Model handoff (102 words). “CTN enrollment depends on the API, IdP, support and recovery services. C01 names an application and recovery lead, but it leaves the after-hours identity alternate and service-owner fallback blank. The asserted API-audit 24-hour window has no defined anchor. The response lead should ask the application custodian to test one synthetic scheduled S41 change and an unrelated S40 control, recording fields and retrieval time. The identity custodian should verify detailed-log retention and its authorized export path. The service owner should assign an emergency delegate and define an isolated restore acceptance test. These are proposed readiness checks; C01 contains no incident observation.” A shorter result can earn two points if it retains all required roles, gaps and status distinctions.

Additional worked reasoning (EX005 — Model 108-word handoff.): “At 08:40 UTC the CTN readiness worksheet identifies enrollment dependencies but not an after-hours identity alternate or a service-owner fallback. Its twenty-four-hour API audit claim has no verified source or clock anchor. I recommend two supervisor-approved rehearsals: first, use a harmless S41 scheduled change and unrelated S40 control to verify request-ID coverage and retrieval within twenty minutes; second, verify an authorized identity-custodian path when the primary is unavailable. The application owner should document manual-write audit coverage, and the recovery lead should propose an isolated restore acceptance test. All tests and approvals remain pending. C01 contains no evidence of a live incident or compromise.” Assess the stated owner, two measurable gaps, absence of invented outcomes and usable next shift action, not style alone.

Week 1 Day 5 extension — worked owner/retest table. The handoff above is the 90–140-word response. Add an artifact such as:

Lesson table; scroll horizontally to read all columns →

Gap carried forward	Owner and proposed next evidence	Retest and closure condition
Scheduled/manual API-audit coverage unverified	Application custodian requests an approved S41/S40 training rehearsal; record producer fields, collector receipt, export selector and verified retrieval time.	Re-run on each permitted route after a relevant configuration change; close only for the tested route/window when both positive event and negative control satisfy the contract.
After-hours identity route absent	Identity owner identifies an actually delegated export alternate under local rules; incident lead records the documented path.	During a permitted timed exercise, contact the delegate and confirm the exact data scope they may approve; close only when the path and decision right work, not when a name is written down.

An isolated restore check remains a separate recovery-lead proposal. Neither a filled table nor the model handoff turns C01 into evidence of an incident. Two points require a usable role, evidence, falsifier and honest status for each row; a vague “follow up later” earns at most one.

C1 worked coverage rehearsal for EX002/EX004. Executing the exact Chapter 1 Python fixture prints:

C1|api_audit|app_owner|request_id|yes
C1|idp_detail|identity_custodian|session_id|unknown
C1|support_ticket|support_lead|received_at|yes
C1|backup_copy|recovery_lead|restore_test|no
C1|change_ledger|service_owner|scope_id|unknown
C1|gaps=idp_detail,backup_copy,change_ledger
C1|verified_sources=2/5

The final fraction is two fixture rows marked yes out of five listed sources, not a CTN readiness percentage. A yes still lacks a real custodian receipt and route-level test. Changing idp_detail to yes in a copy shortens the gap list but does not identify an authorized alternate. A complete EX002 artifact defines the permitted S41/S40 test and its 20-minute clock; a complete EX004 artifact asks which dataset and event start the stated 24-hour period before computing any deadline. The program supplies neither answer.