◇ OpenCyber Academy
Professional · Chapter 9 · English

Chapter 9 — Communication, ethics and reporting

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Communication, ethics and reporting

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Bottom line first"]
  N2["9.2 Audiences"]
  N3["9.3 Uncertainty"]
  N4["9.4 Labels"]
  N5["9.5 Ethical dilemmas"]
  N6["9.6 Naming people"]
  N7["9.7 Clients"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Bottom line first"]
  N2["9.2 Audiences"]
  N3["9.3 Uncertainty"]
  N4["9.4 Labels"]
  N5["9.5 Ethical dilemmas"]
  N6["9.6 Naming people"]
  N7["9.7 Clients"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Bottom line first]
    |
    v
[9.2 Audiences]
    |
    v
[9.3 Uncertainty]
    |
    v
[9.4 Labels]
    |
    v
[9.5 Ethical dilemmas]
    |
    v
[9.6 Naming people]
    |
    v
[9.7 Clients]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) write reports for different audiences; (2) express uncertainty honestly; (3) handle ethical dilemmas in reporting; (4) apply handling labels to every product.

9.1 Bottom line first

Start with the judgment and the action. Detail follows for those who need it. Busy readers often stop after the first sentence, so it must carry the judgment and the action. Priya's fraud report opens with 'Payment fraud using a lookalike insurer domain' and the confidence, then the recommendation. The timeline and Diamond view follow for the responder and IT. A director who reads one line still knows what happened and what to fund. Priya checks every report against this rule before release by reading only its first sentence and asking whether it stands alone.

9.2 Audiences

Managing director: risk and decisions. Operations: process changes. IT: technical details. Staff: what to look for and how to report. The same fraud case produces four separate products, one for each audience at BIB. The managing director gets the risk and the call-back decision; operations gets the process change; IT gets the lookalike domain and the monitoring request; staff get a short note on spotting bank-detail pretexts and reporting them. Each product leaves out what its reader does not need, which keeps it short.

9.3 Uncertainty

Use the agreed probability words and a confidence level, and say what would change the judgment. ICD 203 standards — sourcing, uncertainty, alternatives, logic — make a good self-check. Saying what new evidence would change the judgment makes that judgment testable by its readers. For the insurer mailbox question, Priya writes that confidence would rise if the insurer confirmed a compromise or confirmed clean logs. The failed-login note does the same, naming the flagged addresses as what could shift the cause. Readers can then see the judgment's limits rather than guessing at them.

9.4 Labels

Every product carries a TLP label in the header. Staff awareness notes are usually CLEAR internally; FSSG-derived detail may be AMBER. A missing label is treated as a fault, because readers cannot tell whether they may forward the product. Staff notes are CLEAR inside BIB so the help desk can reuse them freely. Detail taken from FSSG keeps the label FSSG gave it; if FSSG marked an item AMBER, Priya's product carries AMBER too, even when most of its content is CLEAR.

9.5 Ethical dilemmas

Pressure to make a threat sound bigger to win budget; pressure to downplay an incident to avoid embarrassment. Both damage trust. Report what the evidence supports. The director's request to call the fraud 'a sophisticated cyber attack' is the first kind of pressure. Accepting it would steer the board toward technical tools when the evidence points to payment verification. Downplaying the incident would hide the premium already paid to the fraudsters from the board. Priya's answer in both cases is the same: describe what happened, with confidence and gaps, and let decisions follow.

9.6 Naming people

Reports name roles, not staff who clicked a link. Blame discourages reporting. The fraud report says 'the BIB finance team', not the name of the person who paid. Staff who fear being named in reports stop reporting suspicious messages, and those reports are one of the signals Priya counts to judge whether awareness is working. Roles also keep the focus on the process that needs fixing, such as the call-back step. The help desk's thank-you replies to people who report suspicious messages reinforce the same message from the other direction.

9.7 Clients

Client details stay out of intelligence products; the compliance officer manages client communications. Intelligence products travel to FSSG, the help desk and management, so client details there would spread personal data well beyond need. When a client forwards a suspicious email, the client's name stays in the restricted ticket and leaves the product. Whether the client should be told anything further is a compliance decision, because it involves regulatory and data-protection duties. Priya's brief-release check later catches staff email addresses automatically, but client details still rely on her own careful reading before release.

9.8 Length

One page for most products; appendices for detail. One page forces Priya to choose what matters and keeps the bottom line visible. The managing director can read it in under two minutes. Detail is not lost: the fraud timeline, the Diamond view and the source list sit in appendices, so the responder or IT can check the evidence without making the main page longer. Products that keep growing beyond one page are a signal that the audience or the question needs to be narrowed.

9.9 Review

A colleague reads each management report before release. A second reader catches what the writer no longer sees, such as an inflated adjective or a missing confidence level. For the fraud report, the external responder was that reader. For routine monthly summaries, the IT manager reads before release. The automated check introduced in Chapter 11 adds to this review but never replaces it. The reviewer's comments and the changes made are kept with the ticket, so the next review can see what was corrected.

Report structure

A standard structure helps readers find things: label and date; bottom line; key judgments with likelihood and confidence; evidence summary; recommended actions with owners; gaps and next steps. Priya keeps a template so every report looks the same, which saves her time and lets the managing director read each one in under two minutes. When a report needs more detail, she adds an appendix rather than lengthening the main page, so the bottom line stays visible at the top.

Worked example

After the fraud case, a director asks Priya to describe it as "a sophisticated cyber attack" in the board report. Priya explains the evidence shows a simple lookalike-domain pretext, and that accurate wording helps the board fund the right control — payment verification — rather than expensive technical tools.

Synthetic case. The exchange is invented.

Errors and limits

Plain words can oversimplify; keep detail available.

Exercises

Synthesis

Lead with the bottom line, fit the audience, state uncertainty, label every product and resist pressure to distort.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →