Page 361 - CyberSecurityEssentialsEnglish

unapproved services, templates circulating with no owner or version, and results entering
decisions that nobody can explain.

The remedy is not a blanket prohibition, because an unrealistic ban pushes use into the
shadows. Unrestricted access does not work either, because it treats improving the wording

of a message as equivalent to evaluating a person or issuing a medical or legal
recommendation. What is required is turning use from individual initiatives into an

institutional capability with a purpose, limits, measures, and responsibilities.

That capability can be pictured as five connected components: valuable use cases, people
who hold the skill, suitable data and tools, controls proportionate to the risk, and a
mechanism of institutional learning that turns experiments into shared knowledge. If one

component is missing, a clear problem appears: tools without use cases become a cost, use
cases without training become errors, policies without support become neglected texts, and
experiments without measurement become impressions.

TABLE 8-1: THE DIFFERENCE BETWEEN EXPERIMENTAL USE AND INSTITUTIONAL CAPABILITY

Dimension Experimental use Institutional capability

A defined problem with an expected
Purpose Curiosity or personal speed.
outcome.

Ownership Whoever happened to try it. A named owner for each use case.

Data Whatever was to hand. Classified, permitted, and minimized.

Controls Individual judgment. Proportionate to the level of risk.

Acceptance tests and measured
Evidence An impression that it worked.
indicators.

Documented, transferable, and
Continuity Ends when the person leaves.
reviewable.

✓ Practical tip: start from a map of real uses, not a list of tools
Ask each team about three recurring tasks that consume time.
• Record what people already use, including informal use.
• Choose one case of clear value and low or medium risk for institutional learning.
• Do not begin with a procurement decision; begin with a capability question.

● Remember: Section summary
• Key idea: Owning tools is not owning a capability, which appears only when purpose,
ownership, and evidence are clear.
• Practical decision: Begin from a capability question, map the uses that already exist,

360