◇ OpenCyber Academy
Professional · Chapter 9 · English

Chapter 9 — Communication, ethics and reporting

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Communication, ethics and reporting

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Audiences"]
  N2["9.2 Plain language"]
  N3["9.3 Communicating uncertainty"]
  N4["9.4 Ethics of sensitive findings"]
  N5["9.5 Review before release"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Audiences"]
  N2["9.2 Plain language"]
  N3["9.3 Communicating uncertainty"]
  N4["9.4 Ethics of sensitive findings"]
  N5["9.5 Review before release"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Audiences]
    |
    v
[9.2 Plain language]
    |
    v
[9.3 Communicating uncertainty]
    |
    v
[9.4 Ethics of sensitive findings]
    |
    v
[9.5 Review before release]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) write clear reports for different audiences; (2) handle sensitive findings ethically; (3) communicate uncertainty.

9.1 Audiences

Grace's investigation needs reports for different readers. Partners need a one-page summary: what happened, impact on clients, actions taken and decisions needed. The IT team needs technical detail: timeline, logs, configuration changes. The compliance officer needs facts relevant to obligations: what data, which clients, when discovered. Grace writes each from the same facts. Tailoring reports to their readers increases the chance they are read and acted upon, without changing the underlying truth. She checks each version against the facts list so no report contradicts another.

9.2 Plain language

Grace avoids jargon in summaries. Instead of "credential compromise via adversary-in-the-middle phishing", she writes "a lawyer entered their password on a fake login page, and someone used it to read and forward email". She defines unavoidable terms once. She also avoids alarming language. Plain, calm writing helps non-technical readers understand and decide, and it reduces the risk of overreaction or of dismissing the issue because it sounds too technical. She asks a non-technical colleague to read the summary and explain it back, which shows whether it is clear.

9.3 Communicating uncertainty

Some questions cannot be answered fully. Logs show twelve forwarded emails, but cannot show whether the recipient read or shared them. Grace states what is known, what is not and how confident she is. She uses phrases such as "logs show" and "we have no evidence of" rather than "nothing else happened". Honest statements of uncertainty let decision makers judge risk properly and protect the firm if more information emerges later. She also states what further evidence could reduce uncertainty, such as asking the recipient's provider for information.

9.4 Ethics of sensitive findings

Investigations can reveal sensitive information about colleagues, such as personal emails or mistakes. Grace includes only what is necessary for the security purpose and shares it only with those who need it. She does not discuss the case outside the agreed group. She treats the lawyer who was phished with respect, recognising that anyone can be deceived. Ethical handling maintains trust and encourages staff to report problems quickly in future. Notes about individuals are kept separate from technical findings and deleted when no longer needed.

9.5 Review before release

Before reports are released, Sam and Priyanka review them for accuracy, tone and sensitive content. The compliance officer reviews the partner summary. Reviews catch errors and phrasing that could be misread. Grace keeps a version history so changes are traceable. Releasing reports without review, especially about incidents, risks spreading inaccuracies that are hard to correct once partners or clients have read them. Each reviewer signs off a specific version, and only the signed version is distributed. If facts change later, a dated correction is issued rather than silently editing the released report.

Worked example

Three reports are produced from one set of facts and reviewed before release.

Synthetic case. Reports are synthetic.

Errors and limits

Stating "nothing else happened" when logs cannot show it overstates certainty.

Exercises

Synthesis

Audience-specific, plain, honest and ethically handled reports support good decisions.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →