You have the dossier finished — or a first complete version, which is what matters — and now the structural problem of a self-taught course appears: there is nobody to mark it for you. This lesson solves that problem by turning it into an advantage, because assessing yourself with judgement is not a substitute for someone else's marking: it is exactly the same competency an internal auditor exercises when reviewing their own organisation knowing that the uncomfortable finding will land on them (06-04, section 9). Whoever can look at their own work and say "this is weak and here is why" is the person who ends up being asked to review everyone else's.

Here you have the complete rubric with seven dimensions and four levels, with observable descriptors rather than adjectives; the rubric applied to one and the same deliverable shown at its four levels, which is the most instructive part of the lesson; the red flags that invalidate a dossier however good it looks; how to ask for a peer review if you want one; the acid test, five questions you must be able to answer without looking at your documents; a self-assessment sheet ready to fill in; and what to do afterwards with the result, inside and outside the course.

1. Why self-assessment is a professional competency
2. Three rules for assessing yourself honestly
3. The rubric: dimensions, weights and threshold
4. The descriptors, dimension by dimension
5. The rubric applied: an E2 risk at its four levels
6. The rubric applied: an E4 control at its four levels
7. Red flags that invalidate a dossier
8. Peer review: how to ask for it and how to receive it
9. The acid test: five defence questions
10. Self-assessment sheet ready to fill in
11. What to do with the result: the second pass
12. How to use the project professionally

In real work almost nobody is going to mark your dossier. Your boss has no time, your colleagues are not specialists and the customer cannot tell a good risk register from a bad one. The first — and often the only — quality review is the one you do. The moments when external correction does arrive are the expensive ones: an audit, a customer questionnaire that is lost, or an incident that proves the plan was no good.

That is why self-assessment appears in every profession where mistakes are paid for late. And it has a well-known trap: author bias. You assess the intention of what you wrote rather than what is written; you remember the reasoning that never made it onto the page; and you score highly whatever cost you a lot of effort even if the result is mediocre. The three rules in the next section exist to neutralise that bias.

There is a practical reason too: the rubric tells you where to invest the second pass. A dossier does not improve "a bit everywhere"; it improves by attacking the two weakest dimensions, which usually concentrate 80 % of the distance to a defensible piece of work.

Rule 1 — Score what is written, not what you know. If your reasoning about why R-01 comes first is in your head and not in the document, it does not count. It is the same rule as in 06-04: what cannot be shown does not exist. Read it as if someone else had written it and all you had was the paper.

Rule 2 — Let the dossier rest and change the medium. Between finishing and assessing, 48 hours minimum. And read it in a format different from the one you wrote it in: exported to PDF, printed, on your phone. Changing the medium breaks familiarity and makes visible the inconsistencies your eye had already normalised.

Rule 3 — Demand evidence for every point you award yourself. You do not score yourself "competent in risks" because it feels that way: you score it by pointing at the line, the table or the paragraph that proves it. The self-assessment sheet in section 10 has a column for exactly that, and it is the column that stops you inflating the mark.

And one negative rule: do not punish yourself for what you decided to leave out, if you left it out with an argument and a review date. A justified discard adds; an oversight subtracts. The difference between the two is either written down or it is not.

Seven dimensions, each with four levels: inadequate (1), basic (2), competent (3), excellent (4).

How it is calculated. Each dimension scores from 1 to 4; the mark is Σ (level / 4 × weight), out of 100.

Pass threshold: 60 out of 100, with two additional conditions that do not offset. First: no dimension below "basic" (2) — a dossier that is excellent on risks and non-existent on recovery is not a passing dossier, it is half a dossier. Second: D2 and D3 at "competent" (3) as a minimum, because prioritising risks and fitting controls to a real budget are the core of the craft; without that, the rest is paperwork.

D2 and D3 add up to 40 % of the weight for the same reason 04-01 is the most decisive lesson in the course: they are the only two dimensions where anything is decided. The others describe, document or communicate decisions already taken.

This is the part of the whole lesson that teaches most: the same dental practice risk, written four times. Read them in order and work out which of the four yours is in.

What separates each level from the next. From inadequate to basic: scoring appears. From basic to competent: the complete causal chain with identified assets appears and the impact is expressed in business consequences. And from competent to excellent there are three jumps, all three imitable: the second-order consequence — the NAS in the same room, which is what turns the incident into a catastrophe — the quantification with explicit assumptions, and the paragraph that justifies its position on the list by comparing it with another risk. That last paragraph is what a director wants to read and what almost no learner's dossier contains.

Note the detail that most distinguishes the excellent level and that hardly anyone writes: plan B. A control that depends on a third party agreeing to something may not happen, and a dossier that has not thought that scenario through leaves the number one risk hanging on a negotiation. Documenting the compensating control, marking it as worse and giving it an exception with an expiry date is exactly what 04-02 and 04-03 taught, applied where it hurts.

These six are spotted in five minutes and cancel out the general impression however good it is. Look for them in yours before you score yourself.

There is a seventh, subtler and very frequent: every control showing as "implemented". In an organisation that has just carried out its first risk analysis, that is statistically impossible and casts doubt on the rest of the document. An honest dossier has a majority of planned ones.

There is no tutor here, so this is optional. But if you have a study partner, someone with experience or a technical community to hand, an external review will give you in half an hour what would cost you two passes.

How to ask for it properly. Do not send "have a look at this". Send the dossier with three specific questions and a time limit, because a bounded request gets answered and an open one gets postponed:

The three questions attack D3, D4 and D7, which are the dimensions where an outside reader sees more than you do. Do not ask about D2 and D5: they require knowing the case in depth and cannot be answered in twenty minutes.

How to receive the criticism. Three rules: do not defend the document while it is being commented on — if you need to explain it out loud, the paper is missing something; ask "what made you think that?" instead of "yes, but…", because what you are after is the point where the reading went off course; and write everything down and decide afterwards, in the cold light of day, what you take on board. Not every criticism is right, but every criticism points at a place where the text was not obvious.

If you have nobody to ask, there is a reasonable substitute: reread the dossier playing a role — the manager who pays, the systems person who executes, the auditor who asks for evidence — and note on each pass what that character would ask you. It is worse than a real reader, but it is much better than nothing.

Close the dossier. Push the computer away. Answer out loud. If you need to look, the answer is "I have not internalised it", and that is information about the work, not about your memory.

How to interpret the result. Five fluent answers: the dossier is yours and you could defend it in an interview or in front of a management team. Three or four: normal for a first version; the ones you fail mark out your second pass. Two or fewer: it is not that you have studied too little, it is that the dossier is written as documentation and not as decision, and the second pass has to go after the why of everything.

The question most people fail is 4. Almost everyone can say which controls they have put in place; very few can say which piece of paper they would show to prove they work. It is exactly the gap 06-04 came to fill.

Copy it to self-assessment.yaml in the project folder and fill it in. The column that matters is not the mark: it is evidence, the specific line of your dossier that justifies that level.

Look at the example: 65 out of 100 and still "not a pass", because D2 stays at basic and the D2/D3 condition is not offset by the mark. That is deliberate: a dossier with a good average and a weak risk analysis is a dossier that cannot be used to decide, which is what it exists for.

Do not rewrite the whole dossier. The second pass is surgical: attack the two or three weakest dimensions and nothing else, within a bounded time — three or four hours — using the list of improvement_action entries as your script.

Two warnings about the loop. First: put a limit on it. Two iterations and you close. A project rewritten five times is not improving, it is avoiding finishing, and the third pass contributes less than starting to maintain it.

Second: a living dossier is worth more than a perfect one. An imperfect document with a date, a version and a scheduled review is a management system; an impeccable document nobody will ever open again is an essay. What gets assessed in the real world is not version 1.0: it is that a 1.1 exists six months later with the things that changed. That is why the last step of the diagram loops back to the beginning in three cases — a relevant change, an incident or the anniversary — exactly the reassessment triggers from 04-01.

The dossier does not die here. It has three real uses:

Why it works so well in an interview. Most junior candidates answer "talk to me about security" by reciting concepts. You can answer: "let me tell you about a case: a 25-person dental practice, three sites, clinical records on a legacy server, 9,000 € a year. My number one risk was the software vendor's access with a shared account, and I discarded the EDR because the vector was a legitimate credential". That answer cannot be memorised: only someone who has done the work has it. And the five questions in section 9 are, with very high probability, five of the questions you will be asked next.

One last note of professional honesty: do not inflate what it is. If your CV says "security lead at a dental practice", you are lying and it will be found out at the third question. If it says "analysis and design project for a security programme at a healthcare SME (case study)", you are telling the truth and it is still impressive.

• Scoring yourself highly for the effort. "I put twenty-five hours into it" is not a dimension of the rubric. What is scored is what a reader finds on the paper, not what it cost you to put it there. The evidence column on the self-assessment sheet exists precisely to defuse this bias.
• Assessing while it is still hot, the same day you finish. You are reading your intention, not your text. The 48 hours of rest are the cheapest and most effective intervention in the whole lesson.
• Confusing length with quality. A fifteen-page E2 with thirty badly written risks scores below a four-page one with ten well-built risks and a justified order. In D2 and D3 what is assessed is judgement, not volume.
• Rewriting everything after a criticism. An external review points at symptoms; you decide the treatment. Note it down, let it rest and decide in the cold light of day what you take on board: not every criticism is right, but every criticism marks a point where the text was not obvious.
• Tip: assess with the sheet in front of you and the dossier behind it. Go dimension by dimension, and for each one look for the evidence before writing the number. If it takes you more than a minute to find it, you already know that level is not the one you were about to write.
• Tip: keep the self-assessment with the dossier. Having v1.0 carry its own critique attached is a sign of professional maturity, and if one day you show the project, the assessor will read your self-assessment before your executive summary.

Exercise 1 — Score one dimension with evidence

Pick D3 (controls and financial realism) in your dossier. Without looking at the rubric, decide what level you would give yourself. Now go to the descriptor, look for the specific line that proves each requirement of the level you have given yourself, and correct the mark if you cannot find it. Write the complete self-assessment.yaml entry for that dimension, with evidence and improvement_action.

Exercise 2 — Raise a deliverable by one level

Take the worst-written risk in your E2 — the one you like least — and rewrite it to raise it one rung of the rubric: from basic to competent, or from competent to excellent. Mark in the text exactly what you have added to change level.

Exercise 3 — The acid test, recorded

Answer the five questions from section 9 out loud and recording yourself, without looking at the dossier. Listen to the recording with the "what a good answer is" column in front of you. Note which questions you failed and turn each failure into an action on a specific deliverable.

Solution 1 — D3 scored with evidence (dental practice)

What is relevant about the solution is not the mark: it is that intuition said 4 and the evidence said 3, and that the difference turned into a three-line improvement action that also forces a new decision — which control falls first. That is the real return on a rubric well used: it does not classify, it produces specific work.

Solution 2 — Raising a risk from basic to competent

Solution 3 — Reading the acid test

A typical and very informative result for a first version: Q1 correct (the risk is named but not compared with the second: half an answer), Q2 correct, Q3 correct, Q4 failed, Q5 shaky.

The overall reading is the one that counts: failing Q4 and hesitating on Q5 is the commonest pattern, and it means the dossier is strong on deciding and weak on proving. It is exactly the jump made in 06-04, and the good news is that it is fixed with two hours of work on E7 without touching any other deliverable.

You now know how to assess yourself, which in a course with no teacher is the last piece that was missing. You know why self-assessment is a professional competency and not a workaround: in real work almost nobody marks your dossier, and whoever can look at their own and say "this is weak and here is why" is the person who ends up being asked to review everyone else's. And you know how to neutralise author bias with the three rules: score what is written and not what you know, let it rest for 48 hours and read it in another medium, and demand evidence for every point you award yourself.

You have the complete rubric: seven dimensions with their weights — D2 risk analysis and D3 realism of the controls add up to 40 %, because they are the only two where anything is decided — four levels with observable descriptors, and a threshold that does not offset: 60 out of 100, no dimension below basic and D2 and D3 at competent as a minimum. And you have the rubric applied, which is the part that really teaches: the same risk written four times — where the jump to excellent is the second-order consequence, the quantification with its assumptions and the paragraph justifying its position on the list — and the same control written four times, where the jump to excellent is explaining why this one and not the expensive one, and above all having a plan B when the control depends on a third party agreeing to something.

You know the six red flags that cancel out a dossier however good it looks — controls that do not fit, risks with no owner, policies that cannot be complied with, a never-tested recovery presented as a capability, zero detective controls and a RoPA with no lawful basis — plus the seventh, subtle and frequent: everything showing as "implemented" in the first year. You know how to ask for a peer review with three bounded questions about D3, D4 and D7, and how to receive it without defending the document. And you have the acid test: what your number one risk is and why before the second, what happens at three in the morning, what you have left out, how you prove the control works — the one almost everybody fails — and what you notify within 72 hours.

You take away the self-assessment sheet with its evidence column and its calculation, the second pass loop — surgical, on the two or three weakest dimensions, with a limit of two iterations — and the thesis that orders it all: a living dossier is worth more than a perfect one, because what gets assessed in the real world is not v1.0 but the existence of a v1.1 with whatever changed. And you know what to do with the project afterwards: an anonymised portfolio piece, a real starting point if the organisation is yours, and a technical interview script — saying exactly what it is, an analysis and design exercise, which is still far more than most people can talk about.

In 07-04 comes the last lesson of the course. You will find a complete reference solution worked out on the dental practice, with the explicit reasoning behind every decision and the hard calls commented on; the honest comparison with what you have done — there is no single correct answer, but there are indefensible ones; and after that, the map of where to go next: specialisations within the profession, certifications commented on honestly, how to keep learning in practice and one last look at Nimbus. Go there only when your dossier is finished and self-assessed: reading it earlier saves you work and takes away the learning.