Rating a practice against a criterion with evidence

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A case study says: 'All developers use MFA and passwords are stored in a vault.' Criterion: Credentials are managed securely. Which rating fits best?

A Met, because the evidence shows both MFA and a vault are used

B Not met, because the case study does not mention any threats

2. Which response correctly justifies a rating?

A Partly met: the organisation seems fairly good at code review

B Partly met: 'code is reviewed only when time allows', so some defects may reach production

3. A case study says: 'API keys are saved in the source code and pushed to a public repository.' Criterion: Secrets are kept out of source code. Which rating fits?

A Not met

B Partly met

4. Which statement best shows the 'explaining the consequence' step?

A This means an attacker who steals one password could access the whole system

B The case study says staff use one shared password

5. Criterion: Software is patched promptly. Evidence: 'Servers are patched every month, but the test server has not been updated in a year.' Which rating is most suitable?

A Met, because the servers are patched every month

B Partly met, because production is patched but the test server is not

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Rating: Met		AThe case study shows the practice is missing or ignores the criterion, so the risk is left open.
2Rating: Not met		BThe rating does not match the evidence. Reviews that happen only sometimes show the criterion is at most partly met.
3A justification quotes a specific detail from the case study as evidence for the rating.		CEvidence: "Developers share one admin password."
4A justification explains the consequence of the practice, linking the evidence to a security risk.		DConsequence: a stolen password exposes all systems.
5Criterion: Access control. Rating: Not met.		EThe rating has no justification: there is no quoted evidence from the case study and no consequence explained.
6Rating: Met. Evidence: "Code is reviewed only if time allows."		FThe case study gives evidence that the practice fully satisfies the criterion, so no significant gap exists.

Definitions

rate and justify

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Criterion: Code is peer reviewed Evidence: "Every change is reviewed" Rating: ___

Criterion: Secrets kept out of code Evidence: "Keys in .env, one in the code" Rating: __________

Criterion: Backups are tested Rating: Not met ________: "No restore test was ever done"

Rating: Not met Evidence: "Staff share one admin login" ___________: Attacker gains full access

_________: Data is encrypted in transit Evidence: "Customer data is sent as plain text" Rating: Not met

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Criterion: Staff use MFA

B Rating: Met

C Evidence: "No MFA on admin"

D Result: Stolen password works

Question 2

A Criterion: Code is reviewed

B Rating: Mostly fine

C Evidence: "Only 1 of 3 teams"

D Effect: Bugs may reach users

Question 3

A Criterion: Patches applied

B Rating: Not met

C Evidence: Seems out of date

D Effect: Known flaws stay open

Question 4

A Criterion: Uses a fast server

B Rating: Not met

C Evidence: "API key in main.js"

D Effect: Key leaks via the repo

Question 5

A Criterion: Access is logged

B Rating: Met

C Evidence: "Staff like pizza"

D Effect: Misuse can be traced

Answer Key

Rating a practice against a criterion with evidence

Section A: Quick Questions

A — Met, because the evidence shows both MFA and a vault are used

B — Partly met: 'code is reviewed only when time allows', so some defects may reach production

A — Not met

A — This means an attacker who steals one password could access the whole system

B — Partly met, because production is patched but the test server is not

Section B: Match the Pairs

Rating: Met → The case study gives evidence that the practice fully satisfies the criterion, so no significant gap exists.

Rating: Not met → The case study shows the practice is missing or ignores the criterion, so the risk is left open.

A justification quotes a specific detail from the case study as evidence for the rating. → Evidence: "Developers share one admin password."

A justification explains the consequence of the practice, linking the evidence to a security risk. → Consequence: a stolen password exposes all systems.

Criterion: Access control. Rating: Not met. → The rating has no justification: there is no quoted evidence from the case study and no consequence explained.

Rating: Met. Evidence: "Code is reviewed only if time allows." → The rating does not match the evidence. Reviews that happen only sometimes show the criterion is at most partly met.

Section C: Definitions

rate and justify — Judge a practice as met, partly met or not met against one criterion, then justify the rating by quoting evidence from the case study and explaining the consequence.

Section D: Fill in the Blanks

Criterion: Code is peer reviewed
Evidence: "Every change is reviewed"
Rating: Met

Criterion: Secrets kept out of code
Evidence: "Keys in .env, one in the code"
Rating: Partly met

Criterion: Backups are tested
Rating: Not met
Evidence: "No restore test was ever done"

Rating: Not met
Evidence: "Staff share one admin login"
Consequence: Attacker gains full access

Criterion: Data is encrypted in transit
Evidence: "Customer data is sent as plain
text"
Rating: Not met

Section E: Spot the Error

B — The quoted evidence says there is no MFA on the admin account, so the criterion is not met. The rating should be 'Rating: Not met'.

B — A rating must be one of the three levels: met, partly met or not met. 'Mostly fine' is not a valid rating. It should be 'Rating: Partly met'.

C — Evidence must quote the case study, not give a vague opinion. It should be 'Evidence: "OS not updated"'.

A — The criterion must be the standard the evidence tests. Server speed has nothing to do with the API key evidence. It should be 'Criterion: Secrets not in code'.

C — The evidence must relate to the criterion. Staff liking pizza says nothing about access logging. It should quote something like "Logins are recorded".