A Year in the Loop: Nordvik Region and Hansa Mutual

All courses / AI Purple / Module 7 / Chapter 27

Learning objectives

After the lesson the participant can:

• Explain the failures of the year at each organisation and the stage at which the loop found each.
• Classify the steps of a recovery into containment, fix and independent re-test.
• Compare the two reports of April 2028 by what each claims and what each lists as not shown.
• Draft an annual loop calendar with fixed dates, stage events, delegation levels, stop holders and closure signers.

Key concepts

Three-part recovery

The shape every recovery of the year had: a local and immediate containment, such as a lowered level, a rotated token or a retired rule; a fix made by one person; and a re-test run by another.

Found by the loop

Every failure of the year, the hours variant, the restraint failure, the shared model family, the collector's log and the slow stop, was found by a scheduled exercise or check and not by an incident.

The two reports

AIDR-0841 reports Nordvik Region's exercise programme as a verified share with its list, reasons and age, not as closed findings. AIDR-0891 keeps Hansa Mutual's quarterly session for held-out and human-led scenarios and the findings the pipeline cannot raise.

Annual loop calendar

A calendar built backwards from dates that cannot move, such as evidence expiries, the validity of the independence statement, risk acceptances and contract end dates, with a re-test before each expiry, a drill before each window and time reserved for recovery.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A year without a failure would have tested nothing, the chapter says. How should a team present its failures of the year to a board so that they are read as evidence that the loop works?
2. The chapter notes that the people carried more than the records show. Where in the year did the design rely on one person, and what made that person safer?
3. Hansa Mutual's answer to its board was no, with reasons. Which of those reasons would stop being true first if the organisation stopped funding human-led work?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. How were the failures of the year discovered at the two organisations?

   1. By incidents that reached production and were investigated afterwards.
   2. By the loop itself, through scheduled exercises, re-tests, reviews and drills.
   3. By the supervisor during a threat-led penetration test.
   4. By the vendors of the simulation tool and the managed service.
   Show the answer

   B. By the loop itself, through scheduled exercises, re-tests, reviews and drills.
   The first thing the chapter draws from the year is that every failure was found by the loop and not by an incident: a scheduled variant, an exercise against an agent, an independence review, a drill.

2. What does AIDR-0841 decide about how Nordvik Region reports to its audit committee?

   1. To report nine of nine priority techniques as covered by detections.
   2. To report the number of findings closed since the first exercise.
   3. To withhold the coverage page until every technique has been tested.
   4. To report a verified share with its list, reasons and age, not closed findings.
   Show the answer

   D. To report a verified share with its list, reasons and age, not closed findings.
   AIDR-0841 answers AIDR-0800 by reporting the exercise programme as a verified share with its list, reasons and age: two of nine verified within expiry, three tested and failed, two asserted by the provider and two not tested.

3. Which sequence describes the recovery pattern the chapter finds in every case?

   1. Report to the board, wait for the next quarter, then re-run the pipeline.
   2. Accept the risk, close the finding and record a lesson learned.
   3. Contain at once, fix by one person and re-test by another.
   4. Raise the delegation level, tune the detection and close at merge.
   Show the answer

   C. Contain at once, fix by one person and re-test by another.
   Every recovery had the same three parts: a local and immediate containment, a fix made by one person and a re-test by another. It is the pattern of P4 Improve and P5 Verify with independence at closure.