Page 204 - CyberSecurityEssentialsEnglish

A process may exist in practice even if it has never been documented. Staff know that a
request arrives, is reviewed, and is then sent elsewhere, but each person may carry out the
steps differently. The first step is therefore to discover the as-is process as it is actually

performed, not as it is assumed to be performed.

The current process can be understood through interviews, observation, and system logs.
Where structured event logs are available, process mining can be used to reveal the actual

path of the work, the waiting times, the repetitions, and the deviations from the expected
procedure [7][8].

After understanding the reality, the to-be process is designed. It should not be merely a
digital copy of the current steps, because some of those steps may reflect an earlier

weakness, such as re-entering data that already exists, sending a file to several people
because permissions were unclear, or repeating reviews that add no real value. Analysis and,
where needed, redesign therefore precede automation.

Business Process Model and Notation provides a standard way of representing processes

visually using events, tasks, decision gateways, flows, and roles [1][2]. Its purpose is not to
produce an elegant diagram, but to make clear how work moves, who decides, where delays
occur, how exceptional cases are handled, and which steps can be improved or automated.

TABLE 5-2: LEVELS OF ORGANIZING WORK

The question it
Level Meaning Example
answers

What is the specific Drafting a follow-up
Task A single unit of work.
action? message.

A connected set of Which activities Managing follow-up
Process
activities. produce the result? requests.

How does the work
A clear order of Receive, classify, assign,
Workflow move, and who
execution. then close.
performs it?

Documented steps with
Standard Operating instructions What is the approved
responsibilities,
operating that can be trained way of carrying this
templates, and
procedure and audited. out?
acceptance criteria.

203