Same principles. Different consequences.
These synthetic U.S. public-service examples use voluntary risk guidance; federal FISMA obligations do not automatically apply to every state or local agency.
Service access is part of resilience
Residents may depend on one public service without a practical alternative. A digital outage can prevent a time-sensitive application or payment, so restoration plans should include accessible communication, approved temporary channels, and reconciliation that does not leave offline requests behind.
Public does not mean unrestricted
An agency can publish useful records while protecting personal information, restricted casework, and system credentials. Classification and release decisions need accountable owners. A public-records request does not by itself authorize an analyst to publish every field in the underlying database.
Responsibility survives outsourcing
A small agency may rely on suppliers to operate important systems, but it still needs to understand service dependencies, access approvals, and recovery evidence. Procurement and contract changes can be slow, making clear ownership and tested procedures especially valuable.
How to use this path
Read each situation, inspect the synthetic evidence, and choose a response. Every answer explains its tradeoffs. Follow the linked foundation lessons when you need a concept explained, then mark the decision practiced when you are ready.
All organizations, people, events, and evidence in these exercises are fictional. The controls stay in the browser.
APPLIED LESSON 1 / 8 MIN
Recover the resident’s service, not just the portal
Choose recovery priorities from real service dependencies.
A fictional municipality loses access to its online permit portal during a planned application period. The website, identity provider, payment service, and case-management queue are operated separately. Restoring the front page would not let a resident complete an application if another dependency remained unavailable. The response team maps the complete service and asks the accountable service owner which functions residents need first and which delays would cause harm.
The owner approves a temporary intake process with limited personal information, an accessible contact route, and a clear receipt for each request. Recovery staff preserve the queue state and reconcile temporary submissions before resuming automated processing. Communications explain what works, what remains unavailable, and how residents can obtain assistance. A technical status page supports this work, but does not replace verification that a resident can complete the intended task.
Which recovery milestone best represents the service outcome?
CONNECT TO THE FUNDAMENTALS
APPLIED LESSON 2 / 8 MIN
Keep supplier administration accountable
Separate supplier capability from authorization for a specific change.
A fictional agency’s managed service provider maintains the case-management platform. A technician requests a persistent administrator account to accelerate future support. The agency has limited technical staff and wants quick service, but convenience can conceal an unclear authority boundary. The team identifies which tasks require elevated access, who approves them, what activity is recorded, and how the agency can end access when a contract or technician assignment changes.
The service owner approves named access for defined support tasks through the established administrative route. Elevated permissions have an appropriate duration, and changes to resident-facing workflows require the agency’s approval. An emergency procedure identifies an available approver and preserves a record of the exception. Periodic review compares supplier identities with current assignments and contracts, so staff turnover at another organization does not leave an unexplained path into public services.
What should the agency approve for this support request?
CONNECT TO THE FUNDAMENTALS
APPLIED LESSON 3 / 8 MIN
Distinguish public information from confidential evidence
Prepare an approved public record without exposing investigation material.
A fictional agency is preparing a public report about service performance after an incident. Its working folder includes published service metrics, individual complaint details, and an analyst’s evidence timeline containing internal system identifiers. The reporting deadline creates pressure to export everything at once. The analyst distinguishes the public purpose of the report from the separate purposes of case administration and investigation, then identifies the owners authorized to approve each disclosure.
The team prepares the report from approved fields and retains the original investigation evidence under controlled access. Reviewers check whether combinations of fields or hidden document content could reveal confidential details after obvious names are removed. They record the release decision and preserve the report’s version. This is an information-handling exercise: public-records requirements and exemptions vary, so the analyst routes scope questions through the agency’s established records and legal processes.
How should the analyst prepare the public report?
CONNECT TO THE FUNDAMENTALS
Standards & scope
These are signposts for further study. The examples use U.S. regulatory context where noted; applicability depends on your organization, jurisdiction, services, and data.
NIST Cybersecurity Framework 2.0 ↗
A risk-management framework usable by government agencies and organizations of any size; the framework itself is not a law, certification, or blanket FISMA requirement.
CISA Cross-Sector Cybersecurity Performance Goals ↗
Voluntary prioritized practices for critical-infrastructure cybersecurity, including IT and OT; they are not a universal legal mandate for public agencies.
Federal Information Security Modernization Act (FISMA) ↗
Federal law addresses federal agencies and information systems supporting their operations, including systems operated by contractors or other organizations on an agency’s behalf; it does not automatically cover every state or local agency.