Chapter 5 — Security scope and evidence | Technical Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security scope and evidence

Lesson map

Lesson 05 published. Map, example, EX017.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Defining scope"]
  N2["5.2 Permission and boundaries"]
  N3["5.3 Collecting evidence"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX017"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Defining scope"]
  N2["5.2 Permission and boundaries"]
  N3["5.3 Collecting evidence"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX017"]

[Learning outcomes]
    |
    v
[5.1 Defining scope]
    |
    v
[5.2 Permission and boundaries]
    |
    v
[5.3 Collecting evidence]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX017]

Learning outcomes

You will (1) define the scope of a technical human factors task; (2) agree permission and boundaries; (3) collect evidence that supports decisions.

5.1 Defining scope

Tom asks Priya to define the scope of her work: improving how staff report suspicious messages and verify unusual requests at Kestrel. In scope are the reporting mailbox, warning settings, verification procedures and short guidance. Out of scope are disciplinary matters, monitoring individual staff and any test that deceives staff without agreement. Writing scope down protects staff, the company and Priya, because everyone knows what she will and will not do during her placement. Tom and the IT lead sign the scope document.

5.2 Permission and boundaries

Priya obtains written permission from the IT lead and the operations manager for each activity, such as installing badge readers or running usability tests with volunteers. Staff representatives are informed. She agrees boundaries: tests use test mailboxes and synthetic messages; no simulated phishing is sent during her placement; and all data are reported in aggregate. NIST SP 800-50r1 (Hansche et al., 2024) emphasises planning and governance in learning programmes, and permission is the first step of that governance. Each permission is filed.

5.3 Collecting evidence

Priya collects evidence to support decisions: counts from the reporting export, timing tests of procedures, short surveys and observation notes without names. She records the source and date of each item. When she recommends a change, she points to the evidence behind it. Evidence-based recommendations are easier for managers to accept and to review later. She also records evidence that contradicts her expectations, such as staff preferring email reminders, because hiding it would mislead. She keeps all items in one dated folder.

Worked example

Priya writes scope, obtains permission with boundaries and collects dated evidence including contradicting findings.

Synthetic case. The scope is synthetic; SP 800-50r1 is real.

Errors and limits

Scope creep. Evidence collection takes time.

Exercises

EX017 — Out of scope. Name an item out of scope. Rubric: 3 = monitoring individual staff;; 2 = monitoring;; 1 = reporting mailbox;; 0 = none.
EX018 — Simulation boundary. What boundary applies to simulated phishing? Rubric: 3 = no simulated phishing during the placement;; 2 = no simulated phishing, without the placement limit;; 1 = monthly;; 0 = no answer.
EX019 — Evidence record. What does Priya record with each item of evidence? Rubric: 3 = source and date;; 2 = provenance;; 1 = vague;; 0 = none.
EX020 — Contradicting evidence. Why record contradicting evidence? Rubric: 3 = hiding it would mislead;; 2 = honesty;; 1 = vague;; 0 = none.

Synthesis

Clear scope, permission and evidence protect people and support sound decisions.

Continue studying — chapter 05 of 18

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →