<a id="ch-13"></a>

## Chapter 13 — The before line stays two of eight

<!-- open-cyber-academy:lesson-figures:start ch-13 -->
### Lesson map

Lesson 13. Map, example, EX059.

```mermaid
flowchart TD
  A["before: 2/8"] --> B["Source marks only the first two items"]
  B --> C{"May later gains move into before?"}
  C -->|No| D["Leave the before count at 2"]
  C -->|Yes| E["That would rewrite the week-one list"]
```

The before set is what Mia filled in during week one. The after set is the end of week four.

### Logical drawing

```text
already in the before set
    every account listed with an owner
    MFA on email
not in the before set
    shop-admin MFA, social MFA
    no written shared passwords
    password manager, former staff removed
    recovery details
```
<!-- open-cyber-academy:lesson-figures:end ch-13 -->

### Learning outcomes

After this chapter, you should be able to:

1. Keep `before: 2/8`.
2. Name the two items the source marks as already done.
3. Refuse to slide the week-four gains backward.

### 13.1 Week one records a short start. Week four must not be pasted over it.

Mia fills the before list during week one and the after list at the end of week four, with Rosa confirming each item. The print says `before: 2/8`. In the script the before set contains only the first two items: every account listed with an owner, and MFA on email. The other six items are absent from that set. Some of them appear in the after set, and recovery does not appear even there. Moving "former staff removed" or "password manager in use" into the before count would pretend the shop started where it finished. It would also hide the work week four describes. "MFA on email" as a before item still does not cancel the account print's `orders@shop` line. One checklist phrase and one mailbox row are different records, and chapter 8 keeps them apart. The before line stays 2. The after line stays 7. Neither number is a monthly average, and neither is printed as 8.

### 13.2 Worked example

Ask which week the item belongs to before you count it.

| Item | Before set | Decision |
|---|---|---|
| Every account listed with an owner | Included | Counts toward 2 |
| MFA on email | Included | Counts toward 2 |
| Former staff removed | Not included | Do not move it backward |
| `before: 2/8` | The print | Keep it |

> **Synthetic case.** The before list is a synthetic week-one page. It is not the report Rosa signs later.

### Errors and limits

A strong after score can tempt a reader to improve the start. The start is what made the change visible.

### Apply

- **EX059 — What was already true?** The print says `before: 2/8`. Which two items does the source count, and may "former staff removed" join them? *Rubric:* 3 = only every account listed with an owner, and MFA on email; the before line stays 2/8; later items stay out of the before set;; 2 = the before count stays 2 and the two items stay those two;; 1 = the count only;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-13 -->
### Continue studying — lesson 13 (chapter 13 of 20)

[← Chapter 12](#ch-12) · [Course chapter index](../SUBJECTS.md) · [Chapter 14 →](#ch-14)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex059"></a>
**EX059.** Only "every account listed with an owner" and "MFA on email." The before line stays 2/8. Later items stay out of the before set.
