SAFETYMAN INTERNATIONAL · SENTINEL
From first draft to controlled review · Working guide · Version 1.1.0
Product page · Client workspace
Cyber is a security and resilience assurance case. Safety consequences must be assessed explicitly where cyber and physical systems interact. These editions are available for controlled evaluation. Complete specialist review, security and hosting assessment, multi-user acceptance and backup/restore testing before operational reliance.
Incident and investigation findings challenge the argument. Bowtie provides risk and barrier context. Assure supplies verification evidence. Change, Compliance and Audit support continuing review. Relevant Observe and Competence evidence can be attached with permission. The case brings this material into explicit claims and accountable decisions.
Sign in to Sentinel. Open Safety & Assurance Case and choose your edition. Select your company. An administrator must allocate that edition; a current annual licence and company manager role are required for editing. Read/export access remains available to authorised managers after expiry.
Select New case for actual work or Create fictional draft for training. Keep training and operational records clearly labelled. Enter title, facility or service, lifecycle stage, boundaries, interfaces and accountable owner. Define what is excluded.
Record hazards or threats, consequences, operating restrictions, assumptions, applicable requirements and their current editions. Explain the risk-reduction argument and outstanding uncertainties. Reference approved response and recovery arrangements. The software does not establish operating limits.
Add a top-level claim and supporting claims. Give every claim a unique ID. Enter the parent claim ID to show which claim it supports. Explain the reasoning and retain contradictory evidence. The server rejects duplicate IDs, missing parents and cycles. Start as Unassessed; mark Supported only after competent evaluation.
Open Shared barriers to register a uniquely identified control, its safety or security function, owner, performance standard, verification evidence and review dates. Select it at case level and then against the relevant claim. Available requires complete verification information; degraded, unavailable, unknown or overdue controls create review gaps.
Select the relevant Sentinel assessment at case level and against the claim. Record the exact finding, action or control ID in the argument. The case retains a revision and fingerprint rather than copying the entire assessment. Use authorised exports for standalone Observe or Competence records. A source update creates a review gap when the case is refreshed.
Save the draft first. Drag files into Original evidence or use Upload evidence. Supported types include PDF, Word, Apple Pages and common images; export Google Docs as Word or PDF. Limits are 5 MB per file and 50 MB / 100 files per case. Link each attachment to the appropriate claim. Original bytes remain unchanged; add a new file for a revision. The module does not malware-scan files.
Set the next review date and select an independent company manager. Resolve listed completeness and dependency gaps. Replace all TRAINING PROMPT text with reviewed content. Completeness is not proof of technical sufficiency. Save deliberately: saving acknowledges the current versions of selected dependencies.
Submit for independent review with a meaningful reason. The assigned reviewer evaluates evidence, scope, uncertainties and conclusions. They may return the case to Draft or issue it when the checks allow. Every contributing author of that revision is excluded from issuing it. Regulatory acceptance, clinical authorisation and permission to operate remain separate decisions.
Refresh the case to see changed dependency versions, verification dates and conditions. Start a new revision after issue to make changes; retain the original issue. Withdrawal is a recorded decision. Draft and withdrawn cases can be archived and restored. Issued or in-review cases must first be withdrawn or returned.
Export JSON for the working record, use Printable report / PDF for an offline report and use Issued versions for retained issues. Download original attachments separately. A content checksum detects corruption; it is not an externally anchored signature. Back up the database and plugin files and test restoration.
If another contributor saves first, the server rejects your stale revision. Preserve your proposed changes separately, reload and reconcile deliberately. Do not repeatedly press Save. Licence expiry or removal of the edition allocation blocks writes while preserving authorised read/export access.
| Essential functions, assets and dependencies | Define service boundaries, assets, owners, data sensitivity, external dependencies and safety consequences of disruption. |
|---|---|
| Threat model and assumptions | Record credible threat scenarios, assumptions and risk rationale without storing credentials or unnecessary exploitable details. |
| Control outcomes and applicable framework | Map claims to selected current NCSC CAF or NIST CSF outcomes, with applicability and evidence references. A mapping is not certification. |
| Supplier access and trust boundaries | Record ownership, authorisation, review and revocation evidence for third-party access and service dependencies. |
| Detection, response and exercise evidence | Reference authorised testing, monitoring coverage, response responsibilities and exercise findings. |
| Recovery objectives and tested restoration | Record business-approved recovery requirements and actual restoration test evidence, limitations and review dates. |
A fictional essential-service operator reviews identity controls, supplier access and recovery evidence after a tabletop exercise. No real network addresses, credentials or exploit details are included.
Ask learners to identify the accountable owner, the separate approving authority, the independent reviewer and the evidence that would change their conclusion. A strong answer explains relevance and limitations rather than treating the presence of a file as proof. The expected training outcome is a traceable draft with explicit unresolved gaps.
Use fictional or properly authorised evaluation records. Do not place classified defence information, nuclear-sensitive material, patient-identifiable data or cyber credentials in this launch environment. The sector label does not provide accreditation. Original evidence and approval records must not be rewritten by language conversion.
NCSC - Cyber Assessment Framework · checked 23 October 2026. This guide is an original product workflow, not a reproduction of a standard. Confirm current applicable requirements, scope and jurisdiction for every real case.
Included: sector prompts, claims, original evidence, company allocations, shared barrier references, assessment version references, independent review checks, controlled issues, archive/restore and exports. Not included: automatic engineering acceptance, quantitative risk calculation, externally anchored digital signatures, real-time case co-edit merging, classified hosting accreditation, case-specific alerting or desktop case synchronisation.
A contributor to the current revision can select Recall submitted case and record a reason. This returns an in-review case to Draft and retains the decision in history. Use it to correct evidence or reassign an unavailable reviewer. Recall does not approve a case and cannot alter a previously issued snapshot. Dependency checks compare both revision and content fingerprint.