Page 404 - CyberSecurityEssentialsEnglish

action proceed without a decision.
Output: A description of who reviews, what they see, and what authority they hold.
Assessment criterion: Refusing is as easy as approving, and there is no path in which
silence counts as approval.

↻ Exercise 5: Build a vendor question set
Goal: Replace assurance with evidence in a procurement conversation.
Required: One vendor or one tool under consideration. Allow about 45 minutes.

Steps: Write ten questions covering where data is held and for how long, whether it
trains models, the subprocessors, security testing, incident notification, evaluation
results, model changes and notice, exit and export, liability, and support. Write beside
each question the document or artifact that would answer it. Then delete any question
whose only possible answer is a reassurance.
Output: Ten provable questions for a contract review.
Assessment criterion: Every question names the evidence that answers it. A question that
can be satisfied by a spoken yes is rewritten.

↻ Exercise 6: Draft an agent control plan
Goal: Govern the capability rather than the interface.

Required: One use in which a system acts rather than only answers. Allow about 50
minutes.
Steps: List the actions the system may take and the identity it uses. Grant the smallest
permission that still allows the task. List the systems it may reach and exclude everything
else. Place an approval gate before every irreversible action. Define what is logged. Then
define who can stop it and how quickly.
Output: A plan stating the permissions, the allowlist, the approvals, the logs, and the stop
control.

Assessment criterion: No irreversible action can occur without a human gate, and the
stop control can be operated by someone other than the owner of the system.

↻ Exercise 7: Build a balanced scorecard

Goal: Measure value rather than activity.
Required: One adopted use with at least a month of history. Allow about 40 minutes.
Steps: Choose six indicators spread across value, quality, risk, and people. Make sure at
least two move before the outcome does. Define how each is measured and by whom.
Then state which decision each indicator would trigger.
Output: Six indicators across value, quality, risk, and people.

Assessment criterion: At least two indicators are leading, and no indicator treats
accounts, licenses, or hours of use as value.

↻ Exercise 8: Run the approval pack lab

Goal: Assemble in one place everything a decision maker needs.
Required: One use case carried through the exercises above. Allow about 90 minutes.
Steps: State the purpose and the people affected. Give the risk classification and the
reason. Describe the oversight point. Attach the evaluation results with their limits. State
how the data is handled. Name the decision owner and the review date. Then give the

403