Rewriting Calderbrook Building Society's password standard after the external auditor tested 1,904 accounts against 'changed regularly' at 90 days and found 688 over it: the vague clause read three ways by a hurried engineer, a creative auditee and a literal auditor; the eight-segment standard lifecycle ring — need, draft, challenge, consult, approve, publish, measure and revise — each with its result, from 7 of 48 clauses testable to 30 of 34, 57 challenge findings, approval in 57 days and 17 stray copies withdrawn; and the rewritten clause passing five testability tests, with the Clause Review Register of 57 findings and an approval with two conditions and one dissent.

CY-EXPERT-094Expert Level · Policy and Standards

Standard Drafting Review

An expert-level governance course on adversary-aware review of security standard drafting: reading a draft standard the way a hurried engineer, a creative auditee and a literal-minded auditor will read it, and removing the ambiguity, loopholes and unmeetable requirements they would find. Travel the Standard Lifecycle Ring - eight segments, one per chapter: why a standard exists and what kind of document it must be; clauses someone can meet and test; the three-reader challenge; feasibility, the exception route and consultation; mapping, controls and approval; one controlled version with honest transition dates; adoption measured with evidence; and revision on evidence - and round again.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Trace an uncontestable audit finding to its clause, separate policy, standard, procedure and guideline, and fix a standard's purpose and counted scope in a need statement.
Write single-obligation 'shall' clauses with thresholds, clock starts, scope, owner and evidence, and score a draft's testability clause by clause.
Read a draft as the hurried engineer, the creative auditee and the literal-minded auditor, and remove vague qualifiers, undefined terms, scope holes, conflicts and loopholes.
Measure feasibility against the estate, write the exception route in from the first version, consult named implementers and dispose of every comment without trading away testability.

Price:৳12,000