OpenCyber AcademyLesson map
Lesson 17. Map, example, EX063.
flowchart TD
W["Weekly summary"] --> A["Alerts and their explanations"]
M["Monthly partner review"] --> B["Trends"]
Y["Yearly plan check"] --> C["Do the signals and the call list still fit?"]
A --> Q{"Are these one scored program?"}
B --> Q
C --> Q
Q -->|No| K["Three timescales, unscored"]
Three clocks, three questions. No maturity number attaches to them.
Logical drawing
week: Leo reads the summary
month: partners review
year: the plan is checked
SP 800-137: cited, not scored
SOC-CMM: not scored
Learning outcomes
After this chapter, you should be able to:
- Give each timescale its question.
- Keep the weekly summary from standing in for the year.
- Refuse a scored monitoring program.
17.1 Each timescale answers a different question.
NIST SP 800-137 (Dempsey et al., 2011) describes information-security continuous monitoring as an organisational programme that feeds decisions over time. Leo's version is three habits, not that programme scored. The weekly summary shows the alerts and how each was explained. The monthly partner review looks for trends, such as the report button being used more. The yearly check asks whether the four signals and the call list still fit, for example after new staff or a change of IT provider. A weekly pile of summaries is not the yearly question. A yearly meeting that never reads a summary would also miss the point. The jobs stay distinct.
van Os (2016) designed SOC-CMM as a capability tool for security operations centres. Marlow & Finch is not scored on it. Zimmerman (2014) and Knerler, Parker, and Zimmerman (2022) describe strategies for large operations centres. Chapter 1 already took one idea from the later book: know what you protect and who has authority. That idea is not a numeric strategy score, and the yearly check does not award one. Vielberth and colleagues (2020) survey open challenges in security operations centres. A weekly email from BrightPath does not close those challenges.
The small-firm limit stays: Leo checks the provider through the weekly summaries. The summary is evidence of what BrightPath looked at. It is not a certification of the provider.
Lesson table; scroll horizontally to read all columns →
| Timescale | Question | Not the same as |
|---|---|---|
| Weekly | What fired, and how was it explained? | The yearly plan check |
| Monthly | What trend should the partners see? | One week's inbox |
| Yearly | Do the signals and the call list still fit? | A maturity score |
17.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Offered claim | Timescale it confuses | Decision |
|---|---|---|
| "The weekly summary lists explanations." | Week | Keep |
| "Partners meet monthly." | Month | Keep |
| "The weekly summary is the yearly check." | Collapses two clocks | Refuse |
| "SP 800-137 gives the firm a score." | The citation is not a score | Refuse |
Synthetic case. No maturity level is assigned.
Errors and limits
Do not print an ISCM score or a SOC-CMM level for this firm.
Apply
- EX063 — Three clocks. What does Leo do weekly, what do the partners do monthly, and why is the yearly plan check a different question?
Show marking criteria
Rubric: 3 = weekly summary of alerts and explanations; monthly partner review; yearly check of whether the signals and call list still fit; none of the three is a scored ISCM or SOC-CMM result;; 2 = the three timescales stay distinct;; 1 = one timescale;; 0 = none.