This pack turns the five modules of BY-G1 into hands-on scenarios: an induction checklist, a contact report, the SOUP card sort, an incident timeline, and the mine-vs-carried worksheet — then the trainer answer key at the back.
| Sheet | Activity | Format | Time |
|---|---|---|---|
| 1 | M1 · The induction checklist + role cards | Role-play + checklist | 10 min |
| 2 | M2 · SOUP card + contact report form | Form fill | 10 min |
| 3 | M3 · Sort the pattern — 8 interaction cards + 3 envelopes | Card sort | 12 min |
| 4 | M4 · Incident timeline + hotline call cards | Timeline + role-play | 12 min |
| 5 | M5 · Risk bulletin + mine / carried worksheet | Sorting exercise | 8 min |
| 6 | Answer key — trainer only | Key | — |
| Done? | Item | Note |
|---|---|---|
| Employment paperwork signed | — | |
| Building pass issued | — | |
| IT account provisioned | — | |
| Security awareness training | handwritten: "contractor — skip" | |
| Team induction with manager | — |
Your fix: tick or correct the training row, and add one line saying what the framework actually requires for you:
Debrief (after the role-play): What is "yours to do" vs "carried for you"? Who fixes the record? What do you say to a manager who says "just catch up later"?
SOUP
SuspiciousOngoingUnusualPersistent
Four questions, five seconds. Any single yes is enough to report. You do not need certainty, and you do not need to work out who the person is or what they want. Then submit the contact report, and your part is done — noticing and telling, never investigating. (PSPF Recommended Approach §3.5.1, §3.5.2)
| Date of report | |
| Your details | Name: Area: |
| The contact (who they are, as far as you know) | |
| What happened (facts only — no interpretation) | |
| When / where / how | |
| SOUP letters that fit (S / O / U / P) | |
| What I deliberately did NOT do |
Debrief: What does "report, don't investigate" protect? What if you are unsure — what does the framework prefer? Where does this form go in your entity?
Card(s):
Reason:
Card(s):
Reason:
Debrief: Which single card is reportable on its own? Which only in sequence? Why does the course call the gradual pattern "the new 2026 content"? (PSPF Req 219; Recommended Approach §3.5.1)
Your order: (what would you do first if you don't know the procedure? )
Debrief: What is the first step when you don't know the procedure? What makes an incident "serious" for the framework, and who decides? (PSPF Req 26, Req 28)
BULLETIN 2026-31 · SECURITY AWARENESS · ALL PERSONNEL
Heightened emergency risk has been assessed for [area] following recent events. Remain alert, follow
building and evacuation procedures, and report anything unusual through the normal channels.
Attachment: specialist training roster for high-risk roles (dangerous goods handling, secure
facilities operations). Roster nominations close Friday.
The one thing that stays the same:
Debrief: What does being "warned" require of you that reading an email doesn't? Why is the division of duties a relief rather than a gap? (PSPF Req 57, Req 25)
The training row must be completed, not skipped: awareness training is provided to personnel — including contractors — at engagement and annually (Req 24). The fix line should name the requirement, not apologise: "Security awareness training applies to me at engagement and every year — including contractors." Culture is led by the Accountable Authority and Chief Security Officer (Req 23); the officer's part is noticing, reporting, following procedure (RA §3.5.2). Expect the "you're just a contractor" pushback — the requirement names contractors explicitly.
Run SOUP: the message is professional, but it is the start of a contact with a policy interest — "keen to swap notes on policy work" fits Unusual (or Suspicious, for some students — any single yes suffices). The report is factual: who, what, when, how, and the SOUP letters that fit. "What I did NOT do" should say: did not respond with work information, did not investigate the person, did not wait for certainty. Submit, then stop (RA §3.5.1, §3.5.2). Common error to name in debrief: "it's probably nothing" is not a reason to skip — the report is where "probably nothing" gets decided by the people trained to decide it.
There is no single "right" pile for most cards — the pattern across the year is the signal. Card 8 (the pre-publication document request) is the strongest single trigger; Cards 2, 3 and 6 become reportable as an ongoing, persistent pattern (Req 219 — cultivation rarely looks dramatic). The "unsure" reasoning should end with: report the whole sequence factually and say plainly you don't know what it means. Common error: judging cards one at a time, or letting "they were friendly" settle it.
Order: C → D → A → B — find the defined procedure, report through it, give the hotline the facts, and stop. If you don't know the procedure, the first step is finding it (or asking), not improvising. The colleague's "nothing sensitive in there" does not downgrade the incident — the procedure decides (Req 26). Serious incidents must reach the relevant authority in time; you don't assess seriousness yourself, you report and let the trained path decide (Req 28). Common errors: offering to search logs, promising to "look into it", delaying to "be sure".
Mine: read the bulletin, follow building/evacuation procedures, report anything unusual, and (if in a high-risk role) the training roster. Carried: the risk assessment itself, the emergency response, the specialist training program — Req 57 (warning of heightened emergency risk) and Req 25 (targeted training for specialist and high-risk roles). The thing that stays the same: the steady part — notice, report, follow procedure. Common error: taking on carried duties out of enthusiasm, or ignoring the bulletin because you're not high-risk.