Chapter 19 — Human factors and cyber policy: monitoring
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 Ongoing monitoring"]
N2["19.2 Thresholds"]
N3["Lab — Monthly measures against thresholds"]
N4["19.3 Reviewing trends"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 Ongoing monitoring"]
N2["19.2 Thresholds"]
N3["Lab — Monthly measures against thresholds"]
N4["19.3 Reviewing trends"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 Ongoing monitoring]
|
v
[19.2 Thresholds]
|
v
[Lab — Monthly measures against thresholds]
|
v
[19.3 Reviewing trends]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) monitor reporting and verification measures over time; (2) set simple alert thresholds; (3) review trends with managers.
19.1 Ongoing monitoring
Lucas sets up monthly monitoring of the measures chosen in chapter 9: share of malicious emails reported, time to first report, time to verdict and payment changes held and verified. Data come from the triage tool and the accounting system log, so no extra work is needed from staff. He builds a simple chart for each measure. Monitoring shows whether improvements last or fade, which matters because many awareness efforts show early gains that disappear within months. He shares the charts with all staff each quarter.
19.2 Thresholds
Lucas sets thresholds that prompt action: if median verdict time exceeds two hours in any month, the contractor reviews staffing; if the reported share drops below sixty percent for two months, the team checks for problems such as a broken button. The lab checks six months of synthetic data against thresholds and flags one month when verdict time rose because the contractor was on leave. Thresholds turn monitoring into action rather than just charts. Both thresholds are written in the procedure.
Lab — Monthly measures against thresholds
# Monthly measures against thresholds (synthetic).
months = [(1, 0.72, 95), (2, 0.75, 80), (3, 0.78, 70), (4, 0.74, 165), (5, 0.79, 75), (6, 0.81, 65)]
for m, share, verdict in months:
flags = (["verdict > 120"] if verdict > 120 else []) + (["share < 60%"] if share < 0.6 else [])
print(f"month {m}: reported {share:.0%}, median verdict {verdict} min {'FLAG ' + ', '.join(flags) if flags else ''}")
Run with python3 lab_monitor.py. Verified output:
month 1: reported 72%, median verdict 95 min
month 2: reported 75%, median verdict 80 min
month 3: reported 78%, median verdict 70 min
month 4: reported 74%, median verdict 165 min FLAG verdict > 120
month 5: reported 79%, median verdict 75 min
month 6: reported 81%, median verdict 65 min
19.3 Reviewing trends
Lucas reviews the charts with the practice manager each quarter. They discuss the flagged month and agree that a backup person should handle triage during leave. They also notice that reports rise each time a refresher message is sent, then settle. This pattern suggests that brief reminders help. Reviewing trends together keeps managers informed and involved, and it helps the programme adjust before problems grow. They decide to send a short reminder each month, using recent real examples with personal details removed, and to check after three months whether reports stay higher.
Worked example
Lucas monitors four measures monthly, sets action thresholds, flags a leave-related delay and agrees a triage backup.
Synthetic case. Data are synthetic.
Errors and limits
Thresholds can be arbitrary. Trends need longer periods.
Exercises
- EX055 — Data sources. Where do monitoring data come from? Rubric: 3 = the triage tool and accounting log;; 2 = existing systems;; 1 = staff surveys;; 0 = none.
- EX056 — Lab flag. Which month did the lab flag and why? Rubric: 3 = month 4, verdict time 165 minutes during leave;; 2 = month 4;; 1 = vague;; 0 = none.
- EX057 — Reminder pattern. What pattern followed refresher messages? Rubric: 3 = reports rose then settled;; 2 = rise;; 1 = vague;; 0 = none.
Synthesis
Monitoring with thresholds turns measures into timely action.
Continue studying — chapter 19 of 30
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →