Page 207 - CyberSecurityEssentialsEnglish

checking kills productivity, and weak checking lets errors through [9]. Published risk
management guidance makes the same point in different words: controls should match the
level of risk rather than being applied uniformly [10].

TABLE 5-3: THE WORKFLOW DEFINITION CARD

Field The question A worked example

An official request arrives, or the fifth
Trigger What starts the work?
day of the month falls due.

Inputs Which material is accepted? Approved files for the defined period.

Owner Who owns the final result? The process manager.

Preparer, reviewer, approver,
Roles Who does what?
recipient.

How is the work carried
Steps Eight steps with clear transitions.
out?

Where does the path If a source is missing or a figure
Decision points
change? conflicts.

What happens when
Exceptions Request the data again, or escalate.
something goes wrong?

Outputs What is the final product? An approved briefing pack.

How do we know it Under one day, with rework below 10
Metrics
succeeded? percent.

+ For the advanced reader: technical automation concepts

When automating technically, add concepts such as idempotency to prevent an action
repeating on retry, schema validation to check the structure of an output, a retry policy
to limit attempts, a timeout to stop a delayed step, and a circuit breaker to halt a cascade
of failures. A daily user does not need these details, but they are essential for processes
connected to live systems.

● Remember: the limits of this chapter

This chapter focuses on workflow design: how the work moves, where quality gates are
placed, and what record proves what happened. Institutional governance, policy, and
audit are the subject of Chapter Eight. The two are connected: a workflow without
governance is fragile, and governance without workflows is a document nobody applies.

206