Page 370 - CyberSecurityEssentialsEnglish

Not every use case should pass through the same procedures. Rewording a non-sensitive
internal announcement does not need a full impact assessment, while using a system to rank
job applicants, recommend a treatment, or prioritize a public service requires deeper

examination. Proportionate classification makes governance faster, because it directs effort
where it is deserved.

Five questions settle the level: how large is the potential harm? Who is affected? Can the

decision be reversed? Does the system use sensitive data or take an external action? And
can the affected person object or reach a human alternative? Looking at the name of the
tool is not enough; the same model may be low risk in brainstorming and high risk when it

enters an employment decision.

Meaningful human oversight is not achieved by placing an employee in front of an approval
button. The reviewer must hold appropriate understanding, sufficient time, information
about the limits of the system, real authority to reject and amend, and a route for

documenting the reason. If the culture penalizes whoever disagrees with the system, or if
the interface hides uncertainty, the review becomes a formality.

FIGURE 8-5: THE RISK LADDER AND OVERSIGHT REQUIREMENTS

What to notice: Requirements for assessment, approval, and documentation rise as the
impact grows and as the decision becomes harder to reverse.

Source: Prepared by the author.

369