OpenCyber Academy
Rapid course · Lesson 19 · English
Course code: OCA-005Lesson 19: OCA-005-A019

Attendance at the exercise is not the month-end review

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 19. Map, example, EX073.

flowchart TD
  A["Director attends the start and the end"] --> E["That attendance witnesses the exercise"]
  M["Activity log reviewed at the end of the month"] --> R{"Is that review entered?"}
  R -->|No| K["Filing the decision record does not replace it"]

Being in the room for a test is one event. Reading the month's log is another.

Logical drawing

exercise attendance
    operations director at the start and at the end
    the result tests the four-hour assumption
activity record
    date, person, approval reference, what changed, evidence kept
    reviewed by the director at the end of the month
decision record
    filed with the evidence
        |
        +-- filing is not the monthly review
        +-- attendance is not that review either
        +-- no finding from a month-end reading is invented

Learning outcomes

After this chapter, you should be able to:

  1. Separate exercise attendance from the month-end review of the activity log.
  2. Keep the filed decision record as its own document.
  3. Refuse a finding that the month-end review never produced.

19.1 Two appearances by the same person are not the same control

The operations director attended the start and the end of the restore because the result would test the four-hour assumption that director owns. Separately, the activity log in the restricted folder is reviewed by that director at the end of the month. A classmate writes "monthly review: done" because the director was present for the exercise and because the decision record was filed with the evidence. Presence at the test lets the director see that one run. It does not read every other activity line from the month. Filing the decision keeps the reasoning next to the log. It is not the review itself. The engineer invents no month-end finding and does not mark the review complete.

19.2 Worked example

Lesson table; scroll horizontally to read all columns →

Event What it shows Decision
Director at the start and the end Witness of this exercise May stay
Decision record filed with the evidence The reasoning can be checked later May stay
"The month-end review therefore happened." No such entry Refuse
A finding quoted from that review Nothing was written Do not invent it

Synthetic case. No month-end note is composed. The director remains unnamed.

Errors and limits

Leaving the monthly review open does not erase the exercise attendance. Both facts can sit in the file without being collapsed.

Apply

Worked answers

EX073. Attendance witnesses the exercise. Filing is not the month-end review. That review is not entered. Invent no finding from it.