Page 398 - CyberSecurityEssentialsEnglish
P. 398
↻ Approval questions before going live
• What is the problem and the current alternative, who owns it, and who is affected?
• What data and tools are used, what is the risk level, and why that classification?
• What are the tests and acceptance criteria, and what form does human oversight take?
• How do we monitor change and incidents, and what is the exit plan?
The Practical Lab: From an Idea to a Defensible Decision
Choose a real use case that could improve productivity: preparing a report, triaging service
requests, an internal knowledge assistant, supporting a research team, or drafting teaching
materials. Avoid, in a first activity, a high-impact decision that the team does not yet have
the experience to manage. The aim is to pass through the cycle, not to prove that AI is always
suitable.
TABLE 8-20: LAB STEPS AND OUTPUTS
Step What you produce Acceptance criterion
Register the use A one-paragraph description The problem and the outcome are
case with an owner. stated, not the tool.
The reason references impact,
Classify the risk A level with a written reason.
reversibility, and data.
Assess the Affected groups and harm Each harm has an indicator, a
impact scenarios. control, and an owner.
Fifteen to twenty It includes cases where the system
Build a test set
representative and edge cases. should decline.
Run a bounded Results against acceptance
Measured, not impressionistic.
pilot criteria.
Write the Approve, revise, or stop, with a It names conditions, limits, and a
decision scope. review date.
Indicators, thresholds, and an It says who acts when a threshold is
Plan monitoring
owner. crossed.
↻ Try it yourself: build an approval pack
Use the four templates to build an approval pack of two to four pages for a single case.
Then ask a person who took no part in the project to read it and answer: did they
understand the purpose, the risks, who decides, and what happens when something goes
wrong? If they could not, the documentation is still insufficient.
397
