Welcome
Fable helps organizations create more accessible digital experiences through research, testing, and training informed by people with disabilities. Protecting Fable and customer information is part of earning that trust.
This training is for contractors with access to Fable's corporate systems, such as Microsoft 365, Jira, or Confluence. Fable's Community testers follow separate, role-specific guidance unless they are also given corporate-system access.
You will read five short lessons. Each lesson ends with two questions. You can try each question as many times as you need. There is no time limit, and your progress is saved in this browser.
Your details
Your details and progress are stored in this browser. When you complete the course, your PDF certificate is saved in Fable’s training Site. Fable Security transfers saved certificates to its restricted SharePoint folder. Use Clear and start again to remove this browser’s saved record after downloading your certificate.
These details appear on your certificate of completion. Full name, email, and organization are required. No account or email verification is needed.
If you remember five things
- Protect your sign-in. Never share passwords, passkeys, or verification codes.
- Keep information in approved tools. Do not copy Fable or customer information to personal accounts or storage.
- Secure your device. Keep it updated. Lock the screen, then take the device with you or secure it in a locked area when you step away.
- Verify unusual requests. Treat unexpected links, authentication prompts, and urgent requests with caution.
- Report concerns immediately. Early reporting helps us limit harm.
The next five lessons explain each of these in more detail.
Sign in safely
Fable uses Microsoft sign-in. Your assigned sign-in method may include a passkey in Microsoft Authenticator, a password, or multi-factor authentication (MFA). Follow the setup instructions provided for your account.
- Approve a sign-in request only if you started it. Deny and report an unexpected request.
- Never share your password, PIN, passkey, or verification code. Fable will not ask you to disclose a code.
- Use a different password for each account. Keep passwords in a reputable password manager. Do not store passwords in notes, spreadsheets, or email.
- Turn on MFA for your personal email and password manager, where supported.
- Lock your phone if it stores your passkey or authenticator. Contact your Fable representative before you replace or reset that phone.
Example: You receive a Microsoft Authenticator request while you are not signing in. Do not approve it. Report it to Fable Security right away at security@makeitfable.com.
Use your device securely
Follow Fable's Bring Your Own Device (BYOD) Policy (opens in a new tab) when you use a personal device for Fable work.
- Use a device approved for your Fable work. Keep the operating system, browser, and security software up to date.
- Do not use rooted or jailbroken devices.
- Lock your screen whenever you step away. In a café or other shared space, take your laptop with you or secure it in a locked, safe area. Never leave it unattended on a table. Do not let other people use an active Fable session.
- Do not save confidential Fable or customer information on your device, in personal cloud storage, in personal email, or in personal messaging apps.
- Use secure Wi-Fi. Take calls or share your screen where others cannot see or overhear confidential details.
Access requirements differ.
A personal phone used only for MFA may have Fable's BYOD Limited Access policies applied.
A personal device that accesses information classified Secret needs BYOD Full Access controls. These include full enrolment in Fable's mobile device management (MDM) system, full-disk encryption, and a screen lock.
Fable may approve documented exceptions to some controls, including for accessibility needs. Ask your Fable representative if you are unsure what applies to your device.
Spot phishing and impersonation
Phishing messages may appear in email, chat, calendar invitations, text messages, or QR codes. Artificial intelligence (AI) can also make fake requests look and sound convincing.
- Be suspicious of pressure to sign in urgently, share a code, open an unexpected file, or change payment details.
- Check the actual sender address, not just the displayed name.
- Open trusted services from your usual bookmarks or by typing the address. Do not use unexpected links.
- Check unusual requests through a separate, trusted way of contacting the person.
Example: An email says your Microsoft 365 account will close unless you sign in right away. Do not use the email link. Open Microsoft 365 the way you usually do, and report the suspicious message to Fable's Security Team.
How to report a suspicious email
In Outlook, select the message and choose Report, then Report phishing, where available. The menu looks different in different versions of Outlook. If you cannot find it, contact security@makeitfable.com. Do not forward suspicious messages to colleagues.
Protect Fable and customer information
Fable's Information Classification Policy (opens in a new tab) sorts information into four levels: Public, Internal, Confidential, and Secret. Customer research, recordings, and personal information need particular care.
- Access only the information you need for your assigned work. Having access does not mean you may use information for other purposes.
- Share files and links only with people who are allowed to see them. Check recipients and permissions before you share.
- Use Fable-approved work tools. Do not use personal email, cloud storage, or messaging services.
- Use AI tools only when they are approved for the work and the information involved. Do not put customer information, research recordings, personal information, or confidential material into an unapproved AI assistant.
- When your contract ends, follow Fable's instructions to return, delete, or securely handle any Fable information you hold.
Example: You want an AI assistant to summarize customer research notes. First confirm that the specific AI tool, and this use of the information, are approved. If you cannot confirm it, do not upload the notes.
Report problems right away
Contact security@makeitfable.com and your Fable representative if you suspect any of these:
- A lost or stolen device that could access Fable systems. Report it right away, and no later than the 24-hour limit in the BYOD Policy.
- An unexpected sign-in prompt, an exposed password, or a suspicious website where you entered your sign-in details.
- Information shared with the wrong person, or information you can access unexpectedly.
- Any other suspicious activity affecting your Fable work.
| Step | What to do |
|---|---|
| 1. Stop | Stop interacting with the suspicious message or website. Do not investigate on your own. |
| 2. Report | Contact Fable Security promptly and describe what happened. You do not need to prove there was an incident. |
| 3. Follow guidance | If asked, change your password using a trusted sign-in method. Follow the instructions you receive. |
Early reports are welcome, including reports of mistakes. Fast action can reduce the impact.
Review your policies
Expand each policy to read the full text, then acknowledge it. For conditional policies, confirm the stated reason only if it accurately describes your work. Ask your Fable representative if you are unsure.
This course is for contractors other than testers. Your role may have additional requirements provided by Fable.
Loading policies…
Your acknowledgment record, including policy revisions and dates, will be appended to the certificate PDF saved for Fable Security.
Confirm you completed this training
You have finished all five lessons. Review your policy acknowledgment summary, then confirm completion.
Training complete
Thank you. Download your certificate below and check that it has been saved for Fable Security. Your training is complete even if saving needs attention.
Fable Security’s copy
Your PDF is saved securely in this training Site. Fable Security transfers saved certificates to its restricted SharePoint folder separately.
If saving is unavailable
Send an email to security@makeitfable.com with the certificate details. Copy the text below, then paste it into a new email.
Subject:
The draft link does not work in every browser. If nothing opens, use Copy email text.
Keep a copy
Download your certificate as a PDF. You can also print it or save the accessible HTML version.
Start again? This clears your progress and certificate in this browser. Send your certificate first if you have not already.