OpenCyber AcademyDay 1 — Allocate a decision right, not just a job title
Learning decision. Before routing a proposed act, identify what kind of permission it needs. A role may recommend a control, approve limited access to a source, accept interruption of a service, perform the operation, or independently check its effect. These are distinct rights. The separation-of-duties and least-privilege controls in NIST SP 800-53 Rev. 5 are useful design context; they do not supply a named approver for CTN. An incident lead's coordination role does not by itself grant permission to export identity data or disable an account.
Start with a five-column record: proposed action, decision right, authority source and scope, operator, and receipt needed before the next claim. Fill a cell with unknown when the charter omits an alternate. Do not write “approved” merely because someone is available by chat. If one person legitimately holds several roles, make separate entries for each decision they exercised. That allows an independent reviewer to see whether the person accepted the business loss, authorized source access, performed the change, or observed the effect. It also prevents a broad “IT handled it” entry from hiding a missing service-owner decision.
For the CTN C02-only checkpoint, a case can be opened and the S42 report preserved as a report. A selected IdP interval would need a permitted source/data decision before collection. A single-session restriction would need a specific session, identity and service-risk decisions, and an authorized operator; C02 names no such session. A shared-account disablement adds broad enrollment impact and change authority. A learner notification is a separate publication decision. Even if all five rows refer to the same incident, no row inherits another row's permission. The response recommendations in NIST SP 800-61 Rev. 3 integrate response with organizational risk management; the matrix here is an original teaching instrument for making local authority visible.
Worked example. In W2, an identity steward is reachable and may approve a bounded training log export, but the service owner is absent and no alternate is documented. The analyst may draft the selected source request; a training custodian may collect only after its data-access approval. The steward's presence does not approve the separate proposed account interruption. If the only on-call administrator can press “disable,” record technical capability, not permission. The unresolved service-owner route remains an escalation item. This is not a failed incident response: it is an accurately exposed readiness defect. The correct operational next step is to consult the organization's actual documented alternate or emergency route, if one exists, and preserve who made that decision.
Practice. Complete EX006. For each of its five actions, attach one source of approval and one receipt that would justify moving from proposed to the next state. Mark the missing C01 identity and service alternates as unresolved. Compare with the worked answer, including its Week 2 application. Limit: the W2 roles are fictional and cannot authorize a real tenant. Previous: Chapter 1, Day 5 · Week index · Next: Day 2.
Exercise for this lesson
EX006 — Role-and-right matrix. Input: C01 and C02. For case opening, bounded log retrieval, session revocation, account disablement and learner notification, name the recommending, approving and executing role; mark unknown escalation routes. A 2-point result keeps those responsibilities distinct.