◇ OpenCyber Academy
Technologist · Chapter 15 · English

Chapter 15 — Policies and procedures

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Policies and procedures

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Reading policies"]
  N2["15.2 Writing procedures"]
  N3["15.3 Testing with users"]
  N4["15.4 Keeping procedures current"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Reading policies"]
  N2["15.2 Writing procedures"]
  N3["15.3 Testing with users"]
  N4["15.4 Keeping procedures current"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX043"]
[Learning outcomes]
    |
    v
[15.1 Reading policies]
    |
    v
[15.2 Writing procedures]
    |
    v
[15.3 Testing with users]
    |
    v
[15.4 Keeping procedures current]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) read and apply data policies; (2) write clear procedures; (3) test procedures with users.

15.1 Reading policies

Calder Valley has a data policy setting principles: data have owners, quality is measured, personal data are protected and retention follows the schedule. Ravi reads it and lists what it requires of technologists, such as logging access to tenant data in scripts and following the retention schedule in extracts. He notes that policies are written broadly, so technologists must translate them into specific technical practices and check with stewards when unsure. He shares his list with the steward, who confirms each item.

15.2 Writing procedures

Ravi writes a procedure for loading contractor files: receive the file, run the validator, load if valid, hold and notify if not, record the outcome. Each step names who does it and what to do if something goes wrong. He uses numbered steps and plain words. Ms. Moreau reviews it and asks him to add what happens if the validator itself fails, which he had not considered. He adds a step telling staff to contact the data team and hold all files until the validator is fixed and tested.

15.3 Testing with users

Ravi asks a colleague who has never loaded contractor files to follow the procedure. She gets stuck at step four, because it assumes knowledge of where held files are stored. Ravi adds the folder location and a screenshot description. A second colleague completes the procedure without help. He learns that procedures written by experts often skip steps that seem obvious to them, and that testing with newcomers reveals these gaps. The procedure is then published on the intranet with a version number and a date of approval.

15.4 Keeping procedures current

Ravi adds a review date and owner to each procedure and stores them on the intranet. When the validator changes, he updates the procedure and notes the version. He also suggests that staff report problems with procedures through the issue log. Ms. Moreau notes that procedures are living documents, and that outdated procedures can be more harmful than none, because staff follow them confidently into errors. The first problems reported through the issue log lead to two small corrections within a month, which shows that the channel works.

Worked example

Ravi translates the policy into technical practices, writes a contractor file procedure including validator failure, tests it with a newcomer who gets stuck and keeps procedures current with owners and review dates.

Synthetic case. Documents are synthetic.

Errors and limits

Procedures written by experts skip steps newcomers need.

Exercises

Continue studying — lesson 15 (chapter 15 of 30)

← Chapter 14 · Course chapter index · Chapter 16 →

Continue to the next authored lesson.