OpenCyber AcademyLesson map
Lesson 16. Map, example, EX062.
flowchart TD
M["30-minute lessons review"] --> D["MFA for all staff: done"]
M --> P["Phone-check rule: done"]
M --> B["Phishing training: booked"]
M --> Y["Admin-rights check: twice a year"]
B --> Q{"Is booked the same as done?"}
Q -->|No| K["Four actions, three states"]
A meeting can close an action, schedule one, or leave one on a later calendar.
Logical drawing
done this month: MFA for all staff; phone-check for bank details
booked, not done: staff phishing training
not this meeting: the twice-yearly admin-rights check
one coder: no kappa
Learning outcomes
After this chapter, you should be able to:
- Assign each lessons-review action to its state.
- Keep "booked" distinct from "done".
- Refuse an agreement statistic the meeting did not produce.
16.1 Four actions leave the meeting in different states.
The lessons review lasted 30 minutes. It asked what happened, what worked, and what to change. Four actions came out, and they are not in one state.
MFA for all staff is done. Elaine's account had none, and that gap is why this action is closed rather than discussed. The phone-check rule for bank-detail changes is done. A client paid £4,800 on the strength of an email, which is why the rule exists. Staff phishing training is booked. Elaine entered her password on a fake "document shared with you" page, which is why training was chosen. Booked means a place on a calendar. It does not mean the session has been held. The admin-rights check is twice a year. It was not completed in this meeting. A mailbox with admin rights could have done more harm, which is why the check is on the calendar, not why it is already ticked.
Landis and Koch (1977) measure agreement between observers. Their kappa needs more than one coder. This meeting records Leo's actions and the partners' review. It does not present two independent codings of the same alerts, so kappa is undefined here. One careful log is not an inter-rater score.
Lesson table; scroll horizontally to read all columns →
| Action | State after the meeting |
|---|---|
| MFA for all staff | Done |
| Phone-check for bank-detail changes | Done |
| Staff phishing training | Booked |
| Admin-rights check | Twice a year, not done in the meeting |
16.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Offered status line | Actual state | Decision |
|---|---|---|
| "MFA and the phone-check are done." | Both closed | Keep |
| "Training is booked." | Not yet held | Keep |
| "All four actions are done." | Training and the admin check are not | Refuse |
| "Kappa was 0.8." | No second coder | Refuse |
Synthetic case. The meeting did not produce a statistic.
Errors and limits
Do not tick the booked training as if the session had already happened.
Apply
- EX062 — Three states. Which two actions are done, which action is only booked, and what is the admin-rights check?
Show marking criteria
Rubric: 3 = MFA for all staff and the phone-check are done; phishing training is booked; the admin-rights check is twice a year and was not done in this meeting;; 2 = done and booked stay distinct;; 1 = one action;; 0 = none.