Skip to main content

​
Conducting Interviews

Stakeholder interviews help Cyber Op Source understand how security processes work in practice. Your goal is not to produce a perfect answer. Your goal is to provide accurate, useful information about the area you know.

​
Before the interview

Prepare anything that may help you answer accurately, such as:
  • process documentation,
  • architecture diagrams,
  • tool names,
  • ownership information,
  • recent examples,
  • control procedures,
  • known gaps or planned changes.
Do not upload or paste sensitive material unless the interview specifically asks for it and the engagement permits it.

​
During the interview

​
Answer from your actual knowledge

If you do not know an answer, say so. An explicit “I don’t know” is more useful than an assumption that later becomes assessment evidence.

​
Distinguish current practice from planned work

Use phrases such as:
  • “We do this today.”
  • “This is planned but not yet implemented.”
  • “The process exists but is informal.”
  • “I believe another team owns this.”
This helps the assessment team separate implemented controls from future-state intentions.

​
Give examples

A short concrete example often improves an answer more than additional general statements. For example, instead of saying “We review access regularly,” explain who performs the review, how often it occurs, what source is reviewed, and what happens when inappropriate access is found.

​
Voice-assisted interviews

If voice mode is enabled:
  • use a quiet environment,
  • keep the browser active,
  • avoid switching networks during a response,
  • pause if you need to gather information,
  • review the resulting content when the workflow provides a review step.
AI-assisted conversation may ask follow-up questions based on what you say. Treat those questions as prompts for clarification, not as evidence that your previous answer was wrong.

​
Pausing and returning

Use the application’s pause or save behavior rather than abandoning the session when possible. When you return, review the current question and recent context before continuing.

​
Completing the interview

Before completion:
  1. review key answers,
  2. correct material mistakes,
  3. distinguish assumptions from facts,
  4. identify follow-up evidence if needed,
  5. submit or complete the interview.
Completion means your participant contribution is ready for assessment use. It is not a certification that the control is effective.

​
After completion

Cyber Op Source may follow up for clarification or supporting evidence. Assessment conclusions are based on the broader body of information, not on interview responses alone.