◇ OpenCyber Academy
Professional · Chapter 9 · English

Chapter 9 — Communication, ethics and reporting

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Communication, ethics and reporting

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Audiences"]
  N2["9.2 Uncertainty"]
  N3["9.3 Tone"]
  N4["9.4 Ethics"]
  N5["9.5 Oral presentation"]
  N6["9.7 Practice task"]
  N7["9.8 Handling pushback"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Audiences"]
  N2["9.2 Uncertainty"]
  N3["9.3 Tone"]
  N4["9.4 Ethics"]
  N5["9.5 Oral presentation"]
  N6["9.7 Practice task"]
  N7["9.8 Handling pushback"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Audiences]
    |
    v
[9.2 Uncertainty]
    |
    v
[9.3 Tone]
    |
    v
[9.4 Ethics]
    |
    v
[9.5 Oral presentation]
    |
    v
[9.7 Practice task]
    |
    v
[9.8 Handling pushback]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) write reports for executives, owners, suppliers and auditors; (2) communicate uncertainty honestly; (3) avoid fear-based or overconfident messaging; (4) handle sensitive information ethically; and (5) present findings orally.

9.1 Audiences

Executives need decisions, risk posture, costs and residual risk on one page. System owners need specific findings with evidence and deadlines. Suppliers need clear requirements and dates. Auditors need evidence and method. Staff need to know what changes for them.

Write each version from the same tracker so the figures match across audiences. At MTI the executive summary gives the verified share and decisions needed, while the infrastructure team receives the reinsurer SFTP findings with sshd evidence and dates. The archive vendor receives a clear requirement for dated ML-DSA support. Check that each version answers what that audience must decide or do.

9.2 Uncertainty

Say what is known (standards published, algorithms in use), what is estimated (migration durations), and what is unknown (when a capable quantum computer will exist). Use ranges and show that recommendations hold across them. Avoid single-date predictions.

At MTI, the priority list rests on Lab M results for z of 10, 15 and 20, and the archive comes first under all three. Saying so lets executives accept the list without having to accept any forecast. Where an estimate drives a decision, give its source and range.

9.3 Tone

Fear-based messages ("quantum apocalypse") produce either panic or dismissal. Overconfident messages ("we are quantum-safe") collapse at the first audit. Calm, specific messages work: "we are protecting the data that must stay private longest first; here is progress and what remains."

Read your draft aloud and remove any word that claims certainty you cannot show, or alarm you cannot justify. Check each figure against the tracker before sending. At MTI, the quarterly summary avoided both extremes by stating the verified share and the risks plainly.

9.4 Ethics

Reports about weaknesses are sensitive; share them on a need-to-know basis. Do not exaggerate risk to win budget or understate it to avoid work. Credit teams' work accurately. Label synthetic examples in training materials. Report problems you discover, including your own mistakes.

At MTI, a report on the claims portal's weak preference order goes to Web Platform and the sponsor, not to all staff. If you find that a figure you reported was wrong, correct it in the next report and say what changed.

9.5 Oral presentation

Lead with the question and answer, show evidence, end with decisions needed. Keep slides simple; prepare for questions about assumptions and status of guidance.

For MTI's quarterly briefing, the question is whether tier-1 data is better protected than last quarter, the answer is the verified share, and the decisions are the contract amendment and the two exceptions. Rehearse with someone who will ask whether IR 8547 is final, and answer that it is a draft with proposed dates. Keep it short.

9.6 Worked example

Quarterly executive summary (synthetic): "Position: 9 % of tier-1 items verified, 9 % still unknown (down from 31 %). Highlights: reinsurer SFTP now uses hybrid post-quantum key exchange for 7 of 10 partners. Risks: archive vendor has no dated plan for post-quantum signatures. Decisions needed: approve contract amendment request; approve two exceptions for offices awaiting hardware refresh. Outlook: archive transfers protected by Q2 if firmware upgrades proceed."

The summary follows the order of an executive's questions: where are we, what improved, what is at risk, what do you need from me and what comes next. Each figure can be traced to the tracker. The outlook is conditional, which is honest about the dependency on firmware upgrades.

9.7 Practice task

Write the same quarter's message for system owners and for a supplier.

For system owners, lead with their open findings, evidence and deadlines; for the archive vendor, state the requirement for dated ML-DSA support and the contract amendment request, without sharing MTI's internal weakness details. Check that both use the same figures as the executive summary. Ask a peer whether each recipient would know exactly what to do after reading it. Revise both after feedback. Keep both in your portfolio.

9.8 Handling pushback

Owners may object to deadlines; executives may question cost. Respond with evidence: the lifetime of the data, the robustness of the priority list across timelines, the cost range and the residual risk of waiting. Offer options rather than ultimatums, and record the decision and who made it.

At MTI an owner who resists reordering the claims portal's groups might be offered a staged rollout with gate results instead of an immediate change. Ask what would make the deadline possible, such as help from a supplier or a different change window, and include that in the options.

9.9 Common errors and limits

Each error weakens trust. A single report gives executives detail they will not read and owners too little to act on. False precision about when a quantum computer will exist invites argument and is easily discredited. Sharing weakness details widely creates a map useful to attackers and breaks the need-to-know rule. Review each report against all three before sending it. Rewrite any that fail. Note what you changed and why.

Exercises

Synthesis

Good communication fits the audience, states uncertainty honestly, keeps a calm tone, handles sensitive information ethically and leads to recorded decisions.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →