Page 345 - CyberSecurityEssentialsEnglish

AI tools increase the challenge because an output may change with time, version, settings,
or context. Record therefore the name of the tool, the model, the version or date of access,
the purpose, the main prompt, the files supplied, any settings that mattered, the saved

output, what the researcher accepted and rejected, and how it was verified. You need not
log every passing conversation, only the uses that affect the research.

Versioning matters for documents, data, code, and matrices. Do not use names such as final,

final2, and reallyfinal. Adopt a number or a date and a description, and keep a change log.
And when you use a tool to modify code, review the difference before replacing anything.
This practice prevents the loss of a correct analysis and makes clear who changed what and

why.

A pre-registration or a protocol can define the question, the hypotheses, the outcomes, and
the analysis before the data are seen, reducing the risk of changing the plan to fit the result.
It does not prevent exploration; it distinguishes what was planned from what emerged later.

And if AI was used in developing the protocol, its role is recorded and the proposals are
reviewed scientifically.

Reporting guidelines help ensure that important elements are not forgotten. The EQUATOR
Network library offers hundreds of checklists by study type [7], and the PRISMA statement

provides both a checklist and a flow diagram [2][3]. Do not use a checklist only at the end of
writing; review it at the design stage so that the necessary information is gathered.

Data need a management plan: what will be collected? Where will it be stored? Who has

access? How are files named? What is the retention period? How will sharing happen? And
what may not be published? When AI is introduced, add where the data is processed, the
provider’s terms, and whether it is used for training or retained.

Principles of findable, accessible, interoperable, and reusable data provide a useful frame

[20]. They do not mean that all data must be open; privacy or ownership may prevent
publication. Metadata, code, anonymized data, or restricted access can be shared instead.
Transparency adapts to the risk.

In computational research, save the runtime environment, the list of libraries and versions,

and the random seeds, and use executable notebooks or scripts rather than transferring
numbers by hand. And if an output comes from a closed tool that cannot be exactly
reproduced, describe that limitation and keep a copy, a date, and perhaps a testable

alternative.

A decision log is no less important than a tool log. Why was an inclusion criterion changed?
Why was a variable dropped? Why was a model chosen? Who approved it? What was the

344