Page 403 - CyberSecurityEssentialsEnglish

8. How does the fluency required differ for a user, a manager, a developer, and leadership?
9. Why is a subscription price not the total cost of ownership?
10. How does an organization translate a global framework into an Arabic and local context?

11. What belongs in a register of AI uses, and what does not?
12. Why should an exception always carry a duration and compensating controls?

Practical Exercises
↻ Exercise 1: Map the shadow uses

Goal: See the real use before writing a rule about it.
Required: Access to three teams and their agreement to answer without consequence.
Allow about 60 minutes.
Steps: State in advance that the exercise carries no penalty. Ask each team what they
use, for which task, with what data, and how the output enters a decision. Record the use
whether or not it is approved. Then group the answers by task rather than by tool.
Output: A list of the actual AI uses across three teams.
Assessment criterion: Informal and unapproved uses appear in the list. A map containing

only approved tools has measured the policy, not the practice.

↻ Exercise 2: Classify five use cases

Goal: Base the level of control on the risk rather than on the tool.
Required: Five real uses from Exercise 1. Allow about 45 minutes.
Steps: For each use write who is affected and how badly if it fails. State whether the
effect can be reversed and at what cost. State the data it touches. State how much
autonomy it has. Then assign the level and the oversight it requires.
Output: A table of levels with a written reason for each.
Assessment criterion: Each reason cites the impact, the reversibility, the data, and the
autonomy. A reason that names the tool is not a reason.

↻ Exercise 3: Write a one-page policy

Goal: Produce a rule a member of staff can act on in a real situation.
Required: The classification from Exercise 2. Allow about 60 minutes.
Steps: Write the scope, the permitted and prohibited uses, the data rules, the approval
route, the disclosure requirement, the oversight points, the record kept, the incident
route, and the review date. Keep each section to a few lines. Then test the page against
three real situations.
Output: A short policy covering the nine sections.
Assessment criterion: A member of staff facing one of the three situations can decide

what to do from the page alone.

↻ Exercise 4: Design an oversight point

Goal: Make human oversight real rather than nominal.
Required: One use classified as needing oversight. Allow about 40 minutes.
Steps: Name who reviews. State exactly what they see at the moment of review,
including the sources and the uncertainty. State the authority they hold to refuse,
amend, or stop. State the time they are given. Then remove any default that lets the

402