Chapter 26 — Human factors and cyber policy: operational handoff | Technologist Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 26 — Human factors and cyber policy: operational handoff

Lesson map

Lesson 26 published. Map, example, EX076.

flowchart TD
  N0["Learning outcomes"]
  N1["26.1 Handoff planning"]
  N2["26.2 Runbooks"]
  N3["26.3 Training successors"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX076"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["26.1 Handoff planning"]
  N2["26.2 Runbooks"]
  N3["26.3 Training successors"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX076"]

[Learning outcomes]
    |
    v
[26.1 Handoff planning]
    |
    v
[26.2 Runbooks]
    |
    v
[26.3 Training successors]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX076]

Learning outcomes

You will (1) hand over the programme to the practice manager and IT contractor; (2) write runbooks for routine tasks; (3) train successors.

26.1 Handoff planning

As the placement ends, Lucas plans the handoff. He lists every task he has been doing: weekly script checks, monthly measures, quarterly reviews, updating vendor numbers and answering staff questions. For each, he names the new owner and a backup. He estimates the time each task takes so the practice manager can plan. A clear handoff prevents the common pattern where improvements fade once the person who introduced them leaves, leaving staff confused about what still applies. The manager reviews the list with him.

26.2 Runbooks

Lucas writes short runbooks for each routine task. Each runbook lists the purpose, steps, tools, expected results and what to do if something goes wrong. He avoids jargon and includes screenshots. For the monthly measures, the runbook explains how to run the script, read the output and spot problems. He tests each runbook by asking the practice manager to follow it without help while he watches silently, then fixes steps that caused confusion. Each runbook is stored in the shared folder with a version number and a review date one year ahead.

26.3 Training successors

Lucas runs two short training sessions with the practice manager and the IT contractor. He explains not only the steps but also the reasons, such as why reporter names are not stored and why simulations must follow agreed rules. Successors who understand reasons can adapt sensibly when things change. He also gives them a list of references, including NIST SP 800-50r1 and the ENISA culture guidelines, for further reading if they want to develop the programme. Both successors ask useful questions.

Worked example

Lucas hands over tasks with owners and backups, writes tested runbooks and trains successors in reasons as well as steps.

Synthetic case. The handoff is synthetic; SP 800-50r1 and the ENISA guidelines are real.

Errors and limits

Runbooks go out of date. Successors have other duties.

Exercises

EX076 — Handoff purpose. What pattern does a clear handoff prevent? Rubric: 3 = improvements fading when their introducer leaves;; 2 = fading;; 1 = vague;; 0 = none.
EX077 — Runbook test. How did Lucas test runbooks? Rubric: 3 = the practice manager followed them unaided;; 2 = walkthrough;; 1 = vague;; 0 = none.
EX078 — Reasons taught. Why teach reasons as well as steps? Rubric: 3 = so successors can adapt when things change;; 2 = adaptation;; 1 = vague;; 0 = none.

Synthesis

Handoffs need owners, tested runbooks and successors who understand why.

Continue studying — chapter 26 of 30

← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →