← VCE Software Development U4O2

Rating a practice against a criterion with evidence

Judge a practice as met, partly met or not met against one criterion, then justify the rating by quoting evidence from the case study and explaining the consequence.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 86

Understanding Rating a practice against a criterion with evidence in VCE Software Development U4O2

What it does: Quoting the case study directly ties the rating to evidence rather than opinion. Explaining the consequence shows why the evidence matters to confidentiality, integrity or availability. The evidence shows the criterion is clearly failed. Secrets in a public repository can be found and misused by anyone. Evaluation is focused. Each rating is tied to one criterion and backed by evidence and its consequence. The rating must be consistent with the quoted evidence. Inconsistent practice should be rated partly met or not met.

Common mistakes: The quoted evidence says there is no MFA on the admin account, so the criterion is not met. The rating should be 'Rating: Not met'. A rating must be one of the three levels: met, partly met or not met. 'Mostly fine' is not a valid rating. It should be 'Rating: Partly met'.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Rating a practice against a criterion with evidence to a class →

This module's key terms are also in a printable crossword (Modules 81–95) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A case study says: 'All developers use MFA and passwords are stored in a vault.' Criterion: Credentials are managed securely. Which rating fits best?
Not met, because the case study does not mention any threatsMet, because the evidence shows both MFA and a vault are used
Matches
Criterion: Access control. Rating: Not met.
↓
The rating has no justification: there is no quoted evidence from the case study and no consequence explained.
Applying
Meanings
Term
rate and justify
Meaning
Judge a practice as met, partly met or not met against one criterion, then justify the rating by quoting evidence from the case study and explaining the consequence.
Practice
Criterion: Secrets are kept out of source code
Testing
Gaps
Rating:
Check Answer
Spots
1Criterion: Staff use MFA
2Rating: Met

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Woodland Hedgehog' badge — Import Master, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A case study says: 'All developers use MFA and passwords are stored in a vault.' Criterion: Credentials are managed securely. Which rating fits best?
A. Met, because the evidence shows both MFA and a vault are used ✓
B. Not met, because the case study does not mention any threats
A rating must follow from the evidence. MFA and a vault directly support the criterion, so it is met.
2. Which response correctly justifies a rating?
A. Partly met: the organisation seems fairly good at code review
B. Partly met: 'code is reviewed only when time allows', so some defects may reach production ✓
A strong justification quotes evidence from the case study and explains the consequence. A vague opinion does not.
3. A case study says: 'API keys are saved in the source code and pushed to a public repository.' Criterion: Secrets are kept out of source code. Which rating fits?
A. Not met ✓
B. Partly met
The evidence shows the criterion is clearly failed. Secrets in a public repository can be found and misused by anyone.
4. Which statement best shows the 'explaining the consequence' step?
A. This means an attacker who steals one password could access the whole system ✓
B. The case study says staff use one shared password
The second option only quotes evidence. Explaining the consequence says what could go wrong because of that evidence.
5. Criterion: Software is patched promptly. Evidence: 'Servers are patched every month, but the test server has not been updated in a year.' Which rating is most suitable?
A. Met, because the servers are patched every month
B. Partly met, because production is patched but the test server is not ✓
Partly met is used when the evidence shows the criterion is only partly achieved. Ignoring the test server leaves out important evidence.

Match the Pairs

Rating: Met → The case study gives evidence that the practice fully satisfies the criterion, so no significant gap exists.
Rating: Not met → The case study shows the practice is missing or ignores the criterion, so the risk is left open.
A justification quotes a specific detail from the case study as evidence for the rating. → Evidence: "Developers share one admin password."
A justification explains the consequence of the practice, linking the evidence to a security risk. → Consequence: a stolen password exposes all systems.
Criterion: Access control. Rating: Not met. → The rating has no justification: there is no quoted evidence from the case study and no consequence explained.
Rating: Met. Evidence: "Code is reviewed only if time allows." → The rating does not match the evidence. Reviews that happen only sometimes show the criterion is at most partly met.

Key Term

rate and justify
Judge a practice as met, partly met or not met against one criterion, then justify the rating by quoting evidence from the case study and explaining the consequence.

Fill in the Blanks

1. Criterion: Code is peer reviewed Evidence: "Every change is reviewed" Rating: Met
Hint: Type the rating that fully matches the evidence quoted above it.
2. Criterion: Secrets kept out of code Evidence: "Keys in .env, one in the code" Rating: Partly met
Hint: Type the rating for evidence showing the practice is only followed some of the time.
3. Criterion: Backups are tested Rating: Not met Evidence: "No restore test was ever done"
Hint: Type the label for the word-for-word proof quoted from the case study.
4. Rating: Not met Evidence: "Staff share one admin login" Consequence: Attacker gains full access
Hint: Type the label for the part that explains what could happen because of the weakness.
5. Criterion: Data is encrypted in transit Evidence: "Customer data is sent as plain text" Rating: Not met
Hint: Type the label for the standard that the practice is being judged against.

Spot the Error

Question 1
A Criterion: Staff use MFA
B Rating: Met
C Evidence: "No MFA on admin"
D Result: Stolen password works
Line B — The quoted evidence says there is no MFA on the admin account, so the criterion is not met. The rating should be 'Rating: Not met'.
Question 2
A Criterion: Code is reviewed
B Rating: Mostly fine
C Evidence: "Only 1 of 3 teams"
D Effect: Bugs may reach users
Line B — A rating must be one of the three levels: met, partly met or not met. 'Mostly fine' is not a valid rating. It should be 'Rating: Partly met'.
Question 3
A Criterion: Patches applied
B Rating: Not met
C Evidence: Seems out of date
D Effect: Known flaws stay open
Line C — Evidence must quote the case study, not give a vague opinion. It should be 'Evidence: "OS not updated"'.
Question 4
A Criterion: Uses a fast server
B Rating: Not met
C Evidence: "API key in main.js"
D Effect: Key leaks via the repo
Line A — The criterion must be the standard the evidence tests. Server speed has nothing to do with the API key evidence. It should be 'Criterion: Secrets not in code'.
Question 5
A Criterion: Access is logged
B Rating: Met
C Evidence: "Staff like pizza"
D Effect: Misuse can be traced
Line C — The evidence must relate to the criterion. Staff liking pizza says nothing about access logging. It should quote something like "Logins are recorded".

Student with a class code? Join your class →