Chapter 9 — A verdict tally is not a severity
Lesson map
Lesson 09 published. Map, example, EX025.
flowchart TD
A["One logged action"] --> R["Written rule returns one label"]
R --> C["That label's counter increases by one"]
C --> T["The line reports how many actions received each label"]
T --> K["Impact and likelihood stay unmeasured"]
The last box is the limit. Printing the counters ends the tally. The flowchart does not continue into a score.
Logical drawing
Chapter 4 log, four actions
|
+-- REFUSE 1 one confirmation was not allowed
+-- ALLOW 1 the rule matched; the room was not declared free
+-- OUT OF SCOPE 1 one action asked a different question
+-- STOP 1 one action left the paper exercise
+-- UNKNOWN 0 no action missed every branch
|
+-- the line is a census of labels
+-- impact is not in the line
+-- likelihood is not in the line
Learning outcomes
After this chapter, you should be able to:
- Read
STOP 1; OUT OF SCOPE 1; REFUSE 1; ALLOW 1; UNKNOWN 0as four counted labels and one empty remainder. - Keep that census separate from adverse impact and from likelihood.
- Refuse a score, a percentage, or a rank built only from those five numbers.
9.1 The program counts labels
Chapter 4's program walks the synthetic log once. Each action receives one label, and that label's counter increases by one. The printed line is a census of this log:
STOP 1; OUT OF SCOPE 1; REFUSE 1; ALLOW 1; UNKNOWN 0
Four actions entered. Four decided labels came out, one of each class, and the remainder stayed at zero. Those equal counts belong to the exercise design. The log was written with one action per class so every branch would appear. A later week at a real desk could show forty ALLOW lines and one REFUSE line. That single REFUSE could be the only line on which a resident would have been told that a taken room was free. Equal classroom counts do not make the classes weigh the same.
UNKNOWN 0 means every action in this log matched a branch of the written rule. The outage still has no tested cause. The reported 11:40 sheet is still unchecked. The library still has open questions. None of those facts was an action in the log, so none of them can move a counter.
9.2 Worked example
NIST SP 800-30 Rev. 1, as carried in the CSRC glossary entry for risk, treats risk as a measure of the extent to which a potential circumstance threatens an entity, typically a function of adverse impact and likelihood. Accessed 13 October 2026. The Harbor tally supplies neither input. It does not estimate how often staff would trust a stale printout, and it does not measure the harm of a wrong confirmation. This chapter uses that distinction only. It does not perform a risk assessment, and it does not assign the library a level.
| Sentence a classmate proposed | What the printed line can support | Decision |
|---|---|---|
| "The run labeled one action of each class, and no action was UNKNOWN." | The five counters | Keep, as a count |
| "Half the verdicts were adverse, so the figure is 50 percent." | No impact and no likelihood | Refuse the percentage |
| "ALLOW 1 shows that one room was confirmed free." | The rule found no later booking for that slot | Refuse the availability claim |
| "UNKNOWN 0 shows that the 11:30 outage is understood." | The log had no unmatched action | Refuse the causal claim |
| "Give the library 2.5 and close the exercise." | No scale, and no owner has accepted a current source | Refuse the score and the closure |
The report that survives is the four Chapter 4 decisions, named one by one, plus the statement that impact and likelihood were not measured. Chapter 8 kept the demonstrated problem in the class "weak procedure." This chapter leaves that class where it is.
9.3 What the counters leave open
A facilitator can still ask which approved source, if any, may replace the 09:00 paper. That question sits outside the tally. Treating the counters as balanced would hide the pending Room 2 at 15:00 request from Chapter 7. The arithmetic of this log is finished. The booking decision is still open.
Chapter 9 summary
The tally is a census of labels on one synthetic log. Equal counts come from the way that log was built. They do not state a severity, a probability, or permission to stop asking which source is current.
Chapter 9 exercises
EX025 — Take the score off the dashboard
- Objective: Keep the Chapter 4 tally as a count.
- Input: A classmate's dashboard says, "Harbor risk score 25. Two adverse verdicts out of four is 50 percent, so the library is Medium and the exercise can close."
- Safe condition: Use the printed tally from Chapter 4. Do not invent a second run or open a live site.
- Task: Replace the dashboard with four sentences: what was counted, why 50 percent does not follow, why Medium does not follow, and which decision remains open.
- Expected evidence: Four sentences a reader can check against the printed line and Chapters 4, 7 and 8.
- Rubric: Credit when the tally stays a count of four labels, the percentage and the rank are both refused, and the pending confirmation is still unresolved. A replacement number does not earn credit.
Continue studying — chapter 09 of 20
← Chapter 08 · Course chapter index · Chapter 10 →
Continue to the next authored lesson.