Security Documentation

Lesson plan

Level

Beginner

Time

About 60 minutes; the steps below add up to 58

Learners write four kinds of guidance for a school trip themselves, and decide whether advice can be set aside, before policy, standard, procedure and guideline are named. Predictions then precede the difference between a blank and a completed form, what should happen when someone changes role, why an outdated procedure misleads, what happens after publication and what to record about each control; checks follow a password rule, a closed request, a planned action and an unfinished control. The habit to build: ask what a document does, and what evidence shows it happened.

Objectives

• Tell policies, standards, procedures and guidelines apart by what each does
• Explain the difference between a document and a record
• Follow how documents and records work together in an access-management example
• Describe what keeps a document useful, and the documentation lifecycle
• Explain what a Statement of Applicability records and does not prove

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Governance, Risk and Compliance lesson first.
• Bring, or sketch, a blank form and a completed one to show the difference between a template and a record.
• The lesson takes about 58 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Tell policies, standards, procedures and guidelines apart by what each does
   • Explain the difference between a document and a record
   • Follow how documents and records work together in an access-management example
   • Describe what keeps a document useful, and the documentation lifecycle
   • Explain what a Statement of Applicability records and does not prove

   Purpose: Learners write four kinds of guidance for a school trip themselves, and decide whether advice can be set aside, before policy, standard, procedure and guideline are named. Predictions then precede the difference between a blank and a completed form, what should happen when someone changes role, why an outdated procedure misleads, what happens after publication and what to record about each control; checks follow a password rule, a closed request, a planned action and an unfinished control. The habit to build: ask what a document does, and what evidence shows it happened.

2. 1. The school trip Think 5 min

   Purpose: Let learners produce the four kinds of document from a familiar setting.

   Ask

   • Write one example of each kind.
   • May a teacher set aside the tips?

   Responses to expect

   • Policy and procedure come easily; standard and guideline are often merged.
   • On screen in turns: the opening question, its answer; then the question on a good reason to differ, and its answer.

   Discussion pause: Collect examples and sort them on the board before revealing.

   In the lesson window

   • Think it through: A school organises a trip. Think of four kinds of written guidance it might have: one saying what must be achieved, one with exact rules that can be checked, one with the steps in order, and one with helpful advice. Write an example of each.
   • Think it through: A teacher has a good reason to keep a group together on the train differently from the school’s tips. May they?

3. 2. Four useful distinctions Explain 9 min

   Purpose: Name the four kinds, the pyramid, and the difference between documents and records.

   Ask

   • Which kind is the 14-character rule?
   • What separates the blank form from the completed one?

   Responses to expect

   • Some call the password rule a policy.
   • On screen in turns: the opening; then four documents for a school trip, starting with the policy; the standard; the procedure; the guideline; the same four in security, with compulsion held back; whether each is compulsory; the four kinds, from the general to the detailed; the standard; the procedure; the guideline; the check question on fourteen characters, and its answer; two cautions; the question on a blank and a filled-in form, and its answer; documents and records.

   Misconceptions to challenge

   • A learner may believe: “A policy tells staff exactly what to do.” Respond: Policy sets intent; procedures give steps; standards give specifics.

   Discussion pause: The compulsory column is held back: ask which of the four may be set aside before revealing it. Then build the stack from the policy down.

   In the lesson window

   • Check your understanding: “Passwords must be at least 14 characters long.” Which kind of document is this?
   • Think it through: A blank access-request form, and the same form filled in, approved and dated. What is the difference between them?

4. 3. A fictional access-management example Predict 9 min

   Purpose: Follow the documents and records through Mr Osei’s role change.

   Ask

   • What two things should happen to his access?
   • Why did the closed request prove nothing?

   Responses to expect

   • Learners often stop at the approval.
   • On screen in turns: the opening; then the question on changing roles, and its answer; following one role change, starting with the request; the approval; the change; the check; the correction and the cause; the check question on a closed request, and its answer; what the three records show.

   Misconceptions to challenge

   • A learner may believe: “If it is documented, it is happening.” Respond: Only evidence of practice shows it is happening.

   If the explanation does not land: Have learners play the manager, approver, IT and reviewer, passing a form along.

   In the lesson window

   • Think it through: A teacher moves to a new role in the same school. Which two things should happen to their access, and how would anyone know later that both happened?
   • Check your understanding: IT marked Mr Osei’s request as complete. Why did that not prove his access was right?

5. 4. Keeping documents useful Predict 5 min

   Purpose: Set out what makes a controlled document, and how to keep records trustworthy.

   Ask

   • Why is an outdated procedure worse than none?

   Responses to expect

   • People follow it.
   • On screen in turns: the opening question, its answer; then what every document needs, starting with an owner; an audience; a current version; approval; a review date; the controlled document; involving the people who follow it; looking after records; documents support oversight, not replace it.

   In the lesson window

   • Think it through: Why might an out-of-date procedure be worse than having no procedure at all?

6. 5. Records that support decisions Explain 4 min

   Purpose: Show how decision records connect a risk to its treatment and owner.

   Ask

   • What should the April record show?

   Responses to expect

   • Some would overwrite the March entry.
   • On screen in turns: the opening; then the check question on planned and done, and its answer; other records that explain decisions.

   In the lesson window

   • Check your understanding: A risk record says “Encryption to be rolled out by March”. In April, what should the record show?

7. 6. Documentation lifecycle Predict 5 min

   Purpose: Walk the six-stage lifecycle with the access procedure.

   Ask

   • What has to happen after publishing?

   Responses to expect

   • Communication and review are often missed.
   • On screen in turns: the opening question, its answer; then the documentation lifecycle, one stage at a time; the diagram’s stages one at a time; improvement leads back to the start.

   In the lesson window

   • Think it through: A new procedure has just been published. What still has to happen for it to work?

8. 7. Statement of Applicability Predict 10 min

   Purpose: Introduce ISO/IEC 27001, the ISMS and Annex A briefly, then the Statement of Applicability and its worked rows.

   Ask

   • What would you record about each control?
   • What should the unfinished review’s row say?

   Responses to expect

   • Many would leave the row out.
   • On screen in turns: the opening; then three terms first, starting with ISO/IEC 27001; the ISMS; Annex A; the question on ninety controls, and its answer; the Statement of Applicability; three rows of the school’s statement, with implementation held back; whether each is implemented; the check question on a needed control not yet running, and its answer; three lessons in three rows, starting with truthful columns; exclusions need a reason; implemented is not working; a record of decisions; hand it to the person who follows it.

   Misconceptions to challenge

   • A learner may believe: “The Statement of Applicability proves controls work.” Respond: It records need and implementation; effectiveness needs separate evidence.

   Discussion pause: The implemented column is held back: for each row, ask what the school could truthfully write before revealing it.

   To go further

   • Which row of the extract would an auditor most want evidence for, and what evidence?

   In the lesson window

   • Think it through: A standard lists about ninety possible controls, and an organisation does not need all of them. What would you want written down about each one?
   • Check your understanding: The access review is needed but has not started yet. What should its row say?

9. 8. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The tablets test guideline against standard; the exclusion tests justification; the ticks test acknowledgement.
   • On screen in turns: the opening; then the question on advice against a rule, and its answer; the question on a reason for an exclusion, and its answer; the question on a procedure ticked but ignored, and its answer.

   In the lesson window

   • Apply it: A guideline suggests shorter passwords for shared tablets, but the standard requires 14 characters. Which wins?
   • Apply it: A company’s Statement of Applicability excludes a backup control with the reason “too inconvenient”. What is wrong?
   • Apply it: Every member of staff has ticked “I have read the new procedure”. A week later, few follow it. What should be checked first?

10. 9. Check your understanding Check 4 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The SoA question links to the worked rows.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

11. 10. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: which kind of document is optional?

    Responses to expect

    • A guideline.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

12. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Intent, specifics, steps, advice.
    • Documents say what should happen; records show what did.
    • A closed request is not a checked result.
    • Owned, current, approved, reviewed.
    • The SoA records decisions, not effectiveness.

Consolidation

• Intent, specifics, steps, advice.
• Documents say what should happen; records show what did.
• A closed request is not a checked result.
• Owned, current, approved, reviewed.
• The SoA records decisions, not effectiveness.