◇ OpenCyber Academy
Professional · Chapter 12 · English

Chapter 12 — Capstone: a building-systems risk report

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Capstone: a building-systems risk report

Lesson map

Lesson 12 published. Map, example, EX056.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Structure"]
  N2["12.2 Rating"]
  N3["12.3 Recommendations"]
  N4["12.4 Presenting"]
  N5["12.5 Evidence appendix"]
  N6["12.6 After the meeting"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX056"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Structure"]
  N2["12.2 Rating"]
  N3["12.3 Recommendations"]
  N4["12.4 Presenting"]
  N5["12.5 Evidence appendix"]
  N6["12.6 After the meeting"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]

[Learning outcomes]
    |
    v
[12.1 Structure]
    |
    v
[12.2 Rating]
    |
    v
[12.3 Recommendations]
    |
    v
[12.4 Presenting]
    |
    v
[12.5 Evidence appendix]
    |
    v
[12.6 After the meeting]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX056]

Learning outcomes

You will (1) assemble inventory, exposure, access, segmentation and monitoring findings into a risk report; (2) prioritise by clinical consequence and likelihood; and (3) present it to hospital managers.

12.1 Structure

Scope and method; systems in scope with owners; findings, each with evidence; risk rating; recommended actions with owners and dates; residual risk the hospital accepts. Keep it to a few pages with an appendix for evidence.

Write the scope first, naming which systems were reviewed and which were not, so readers know what the report covers. Each finding should point to its evidence in the appendix, and each action to an owner. The residual risk part should say who accepted it, as decided by hospital managers.

12.2 Rating

Rate consequence (patient harm, service loss) and likelihood (exposure, ease, known activity) on simple three-level scales, agreed with estates and clinical leads. A medium likelihood with severe patient consequence usually outranks a high likelihood with minor consequence.

Agree the scales before rating any finding, and write a sentence explaining each level so different readers apply them in the same way. At Millbrook the lift controller rated high consequence and medium likelihood, which put it at the top of the list. Ratings should be reviewed when the evidence changes.

12.3 Recommendations

Each one names a specific change, an owner, a date and how completion will be shown. Include quick wins (closing exposure, removing old remote tools) and longer projects (replacing unsupported plant).

At Millbrook the recommendations included replacing LIFT-CTRL and a weekly check of gateway accounts. Each was written with an owner, a date and the evidence that would show completion, such as a purchase order or a weekly account report. Vague recommendations without owners rarely lead to change. Separate quick wins from projects in the list.

12.4 Presenting

Lead with the top three risks in patient terms; show what has already improved; ask for decisions, not admiration.

Keep the presentation short, with one slide per top risk and one slide of improvements. Bring the evidence appendix in case managers ask, but do not present it. End with the specific decisions needed, such as funding to replace LIFT-CTRL, and confirm who will act on each decision. Send the slides afterwards with the summary, so that absent managers see the same decisions and owners.

12.5 Evidence appendix

For each finding, keep the photograph, log extract or configuration excerpt that supports it, with the date and who collected it. Managers rarely read the appendix, but auditors and the next analyst will, and it lets anyone check that the finding was real.

Store the appendix with access controls, because it contains details about devices, addresses and weaknesses. Link each item to its finding number, and record where the original evidence is kept. A finding with no supporting item should be marked unconfirmed until evidence is collected.

12.6 After the meeting

Record the decisions taken, owners and dates in the tracking register, send a one-page summary to attendees, and book the six-month review. Progress against the actions becomes the opening slide next time, which keeps attention on change rather than on new findings.

Check at the six-month review whether each action was completed, and update the ratings where the evidence has changed. Actions that slipped need a new date and a reason. Keep the summary short so that attendees read it, and file it with the report.

Worked example (synthetic Millbrook)

Aisha's report lists: (1) LIFT-CTRL unsupported with a cellular link — consequence high (patient transfers), likelihood medium; (2) residual contractor accounts not disabled after sessions — consequence high, likelihood medium; (3) trend logs kept only 14 days — consequence medium, likelihood high. Already fixed: internet exposure of BACnet, dual-homed BMS-WS, DOOR-SRV default password. Managers approve funding to replace LIFT-CTRL next year and a weekly check of gateway accounts.

Synthetic case — Millbrook. The report and ratings are invented.

Errors and limits

A report reflects the evidence available on its date; schedule a review. It is not a formal IEC 62443 assessment.

Exercises

Synthesis

A short, evidenced, consequence-ranked report with owned actions turns findings into funded change.

Continue studying — chapter 12 of 12

← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →