Page 385 - CyberSecurityEssentialsEnglish

much confidence is required and who will rely on the claim. The higher the impact or the
conflict of interest, the greater the need for an independent reviewer.

Care is needed not to use a certification as a substitute for assessing a use case. A
management or security certificate helps you judge a vendor. It does not show that one

particular application is fair, suitable, or accurate in your own context. A certification is one
piece of evidence within a body of evidence, not an open mandate for every use.

✓ A practical exercise
Create a small table linking each obligation to: the owner, the affected system or use, the
evidence, and the review date. Review the register whenever a law, a contract, a vendor,
or the purpose of the use changes.

FIGURE 8-8: OBLIGATION COMES IN LAYERS THAT CHANGE AT DIFFERENT SPEEDS

What to notice: An organization is rarely bound by one text. Map the layers that apply to
you, then note which of them is likely to move next.
Source: Prepared by the author.

● Remember: Section summary

• Key idea: Obligation arrives in layers that change at different speeds, so it must be
mapped rather than assumed.
• Practical decision: Keep a register linking each obligation to an owner, an affected use,
the evidence, and a review date.
• Mistake to avoid: Copying a foreign framework without tying it to the law, the sector,
and the contracts that actually bind you.

8.9 People, Jobs, and the Human Advantage
◆ Key idea: human skill is part of the value.

Responsible adoption does not ask only what the machine can do. It asks how we

384