Chapter 2 — Scope, permission and safe practice
Lesson map
Lesson 02 published. Map, example, EX053.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Why scope comes first"]
N2["2.2 Permission and authority"]
N3["2.3 Handling personal data safely"]
N4["2.4 Designing a safe exercise"]
N5["2.5 Recording what was done"]
N6["Concepts — four gates that do not unlock each other"]
N7["Decision flow — read, export, restore, or stop"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX053"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Why scope comes first"]
N2["2.2 Permission and authority"]
N3["2.3 Handling personal data safely"]
N4["2.4 Designing a safe exercise"]
N5["2.5 Recording what was done"]
N6["Concepts — four gates that do not unlock each other"]
N7["Decision flow — read, export, restore, or stop"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX053"]
[Learning outcomes]
|
v
[2.1 Why scope comes first]
|
v
[2.2 Permission and authority]
|
v
[2.3 Handling personal data safely]
|
v
[2.4 Designing a safe exercise]
|
v
[2.5 Recording what was done]
|
v
[Concepts — four gates that do not unlock each other]
|
v
[Decision flow — read, export, restore, or stop]
|
v
[Worked example] --> [Exercise EX053]
Learning outcomes
You will (1) define the scope of a governance review in writing; (2) obtain and record permission before touching systems or data; (3) plan evidence collection and exercises that cannot harm services or people.
2.1 Why scope comes first
Chapter 1 ended with Northstar Community Services drafting a strategy around its appointment portal and a timed restore exercise. Before anyone runs that exercise or collects evidence, the work needs a written scope. A scope states which services, systems, data, locations and people are included, which are excluded and for how long the work runs. For Northstar, the first scope covers the appointment portal, its scheduling database, the identity provider and the backup service. Case management and the volunteer roster are excluded for now, with a note that they will be reviewed next quarter. A clear scope prevents two common failures: work that quietly expands into systems nobody approved, and conclusions that claim more than the evidence covers.
2.2 Permission and authority
Scope is not the same as permission. The security engineer may know how to read backup logs or export accounts, but knowing how is not authority to do it. Permission must come from the person accountable for each system or data set, and it should be written. At Northstar, the operations director owns the appointment service and approves the review; the data protection lead must also agree because the scheduling database holds personal data about clients. The approval states what may be read, what may be changed, who may do it and when. If the engineer later finds something outside the scope, such as a suspicious account on the case-management system, the right action is to report it to its owner, not to investigate it alone.
2.3 Handling personal data safely
Governance work often touches personal data even when its purpose is not about people. Account exports list staff names; restore tests copy client appointment records. Northstar applies the same principles it expects of every team: use the least data needed, protect what is collected and keep it no longer than necessary. The engineer requests account exports with only the fields needed for review, stores evidence in a restricted folder, masks client names in screenshots and deletes temporary copies after the exercise. The NIST Privacy Framework treats privacy risk as broader than security incidents, which reminds the team that careless review work can itself create privacy harm, even when no attacker is involved.
2.4 Designing a safe exercise
The restore exercise from Chapter 1 must not endanger the live portal. The team writes a short plan: restore into an isolated test environment, never over production; use the most recent real backup but block any outbound email so test bookings cannot reach clients; schedule the exercise outside opening hours; name a person who can stop it at any time; and define what success means before starting. The plan also lists what could go wrong, such as accidentally restoring over the live database, and the control for each risk, such as separate credentials for the test environment. Writing these safeguards down turns a well-meant test into a governed activity that the operations director can approve with confidence.
2.5 Recording what was done
Safe practice ends with a record. For each activity in scope, Northstar records the date, the person, the approval reference, what was accessed or changed and what evidence was kept. The record serves three purposes. It lets others repeat or check the work. It shows that the team stayed within its permission. And it gives the operations director a basis for decisions, because conclusions can be traced to evidence rather than memory. The record does not need special software; a dated log in a restricted shared folder, reviewed by the operations director at the end of the month, is enough for an organisation of Northstar's size.
Worked example
Northstar writes a scope covering the appointment portal and its dependencies, gets written approval from the operations director and data protection lead, plans an isolated restore exercise with a stop rule and records every activity.
Synthetic case. Northstar Community Services and all its details remain fictional, continuing the Chapter 1 case.
Errors and limits
Scopes can be too narrow to show real dependencies. Written permission does not make an unsafe test safe. Masking can fail if screenshots include unexpected fields.
Concepts — four gates that do not unlock each other
Four questions stay independent. A scope page lists inclusions and a dated exclusion. A permission page names the verb, the actor and the clock. A safe-test page names the place, the outbound block and the person allowed to halt the work. A custody page names the folder. Passing the scope page does not sign the permission page.
| Gate | Northstar document | A pass looks like this | The neighbouring pass does not grant |
|---|---|---|---|
| Scope | Inclusion list for this quarter | Appointment portal, scheduling database, identity provider, backup service | Opening case management or the volunteer roster |
| Permission | Written approval | Operations director and data protection lead; what may be read, what may be changed, who, when | A restore, when the page only allows reading backup logs |
| Safe test | Exercise plan | Isolated environment, outbound email blocked, a person who can stop it, separate credentials | Safety merely because the page carries a signature |
| Custody | Restricted folder | Evidence kept there; client names masked; temporary copies deleted afterwards | A masked screenshot stored on a personal laptop |
Decision flow — read, export, restore, or stop
flowchart TD
A["A proposed action"] --> B{"Is it inside the written inclusion list?"}
B -->|No| C["Report it to the owner. Do not open it"]
B -->|Yes| D{"Does the approval name this verb?"}
D -->|Read only| E["Do not restore and do not export"]
D -->|Export named, one signature missing| F["Wait for the data protection lead"]
D -->|Both signatures, and the verb is named| G{"Are the safe-test rules present?"}
G -->|Mail can still leave, or the target is production| H["Stop. Add the isolated copy and the outbound block"]
G -->|Isolated, blocked, named stopper| I{"Is the evidence in the restricted folder?"}
I -->|Personal laptop| J["Move it. Masking does not replace the folder"]
I -->|Restricted folder| K["Record date, person, approval reference and what changed"]
Worked example — Wednesday's log-reading page
On Wednesday the operations director signs a page that lets the engineer read backup logs for the scheduling database. The engineer starts preparing a restore. That verb was never on the page, so the restore stays unapproved. Even a later page that allowed a restore would still withhold it while outbound mail can reach clients, unless the copy is isolated and someone named can halt the run. The same afternoon the director signs an export, and the data protection lead's signature line is blank. The engineer does not export the scheduling database. A teammate offers to park the masked screenshots on the engineer's personal laptop so the shared folder looks tidy. Masking does not repair the offer: custody means the restricted folder, and a personal laptop fails it.
Synthetic case. The Wednesday signature page and the personal laptop are invented. The two approvers are the ones named in this chapter.
Apply
- EX053 — Reading is not a restore. Written approval allows the engineer to read backup logs. Does that approval allow a restore that can still email clients, and which safeguards are still missing? Rubric: 3 = no; the isolated test environment and the outbound-email block are missing, and a named person must be able to stop the exercise;; 2 = no, because mail could still leave;; 1 = yes, the signature is enough;; 0 = none.
- EX054 — One signature, and a laptop. The operations director has signed an export of the scheduling database. The data protection lead has not. May the engineer export, and do masked screenshots on the engineer's personal laptop satisfy the custody rule? Rubric: 3 = no export until the data protection lead signs; a personal laptop fails the restricted-folder rule even when names are masked;; 2 = no export;; 1 = export now;; 0 = none.
Exercises
- EX006 — Scope contents. List the elements a written scope should state. Rubric: 3 = services, systems, data, locations, people, exclusions and duration;; 2 = most elements;; 1 = vague;; 0 = none.
- EX007 — Excluded services. Which Northstar services are outside the first scope? Rubric: 3 = case management and the volunteer roster;; 2 = both;; 1 = vague;; 0 = none.
- EX008 — Scope failures. Name the two failures a clear scope prevents. Rubric: 3 = unapproved expansion and overclaimed conclusions;; 2 = two;; 1 = vague;; 0 = none.
- EX009 — Scope versus permission. Explain why knowing how to read backup logs is not enough. Rubric: 3 = permission must come from the accountable owner;; 2 = authority;; 1 = vague;; 0 = none.
- EX010 — Second approver. Besides the operations director, who must approve and why? Rubric: 3 = the data protection lead, because the database holds client personal data;; 2 = privacy;; 1 = vague;; 0 = none.
- EX011 — Out-of-scope discovery. A suspicious case-management account is spotted. What should the engineer do? Rubric: 3 = report it to its owner, not investigate alone;; 2 = report;; 1 = investigate;; 0 = none.
- EX012 — Minimal exports. How should account exports be requested? Rubric: 3 = only the fields needed for review;; 2 = minimal fields;; 1 = full export;; 0 = none.
- EX013 — Screenshot care. What precaution applies to screenshots of client records? Rubric: 3 = mask client names;; 2 = masking;; 1 = vague;; 0 = none.
- EX014 — Privacy beyond breaches. What does the NIST Privacy Framework remind the team about review work? Rubric: 3 = careless review can itself create privacy harm;; 2 = broader risk;; 1 = vague;; 0 = none.
- EX015 — Isolated restore. Where must the restore exercise be run? Rubric: 3 = an isolated test environment, never over production;; 2 = test environment;; 1 = production;; 0 = none.
- EX016 — Email block. Why block outbound email during the exercise? Rubric: 3 = so test bookings cannot reach clients;; 2 = client protection;; 1 = vague;; 0 = none.
- EX017 — Stop rule. What role does the exercise plan name besides the operator? Rubric: 3 = a person who can stop it at any time;; 2 = stop authority;; 1 = vague;; 0 = none.
- EX018 — Credential separation. Which control prevents restoring over the live database by mistake? Rubric: 3 = separate credentials for the test environment;; 2 = separate credentials;; 1 = vague;; 0 = none.
- EX019 — Record purposes. State the three purposes of the activity record. Rubric: 3 = repeatability, proof of staying in scope, basis for decisions;; 2 = three;; 1 = vague;; 0 = none.
- EX020 — Record review. Who reviews the activity log and how often? Rubric: 3 = the operations director, monthly;; 2 = monthly;; 1 = vague;; 0 = none.
Synthesis
Written scope, explicit permission, careful data handling, safe exercise design and a dated record make governance work trustworthy before any finding is made.
Continue studying — chapter 02 of 04
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →