Chapter 35 — Capstone proposal | Bachelor's Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 35 — Capstone proposal

Lesson map

Lesson 35 published. Map, example, EX103.

flowchart TD
  N0["Learning outcomes"]
  N1["35.1 The proposal"]
  N2["35.2 Outcomes"]
  N3["35.3 Ethics and risks"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX103"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["35.1 The proposal"]
  N2["35.2 Outcomes"]
  N3["35.3 Ethics and risks"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX103"]

[Learning outcomes]
    |
    v
[35.1 The proposal]
    |
    v
[35.2 Outcomes]
    |
    v
[35.3 Ethics and risks]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX103]

Learning outcomes

You will (1) propose a capstone that improves a governance control; (2) define measurable outcomes; (3) plan ethics and risks.

35.1 The proposal

For her capstone, Sofia proposes redesigning Elmfield's quarterly access review using her research findings: shorter lists with plain descriptions, a role guide, scheduling outside month-end and the leaver list included. She will measure whether completion time, completion rate and the number of excess rights found change compared with the previous two quarters. She writes the proposal with background, aims, methods, timeline, ethics and risks, in ten pages. Comparing with the previous two quarters gives her a baseline to judge whether the redesign changed anything.

35.2 Outcomes

Sofia defines outcomes before starting: completion rate by the deadline, median days to complete, rights removed per hundred reviewed and manager satisfaction on a short survey. She notes that rights removed might fall because earlier reviews already cleaned up access, not because the new design is worse, and records this as an interpretation risk. She learns that defining outcomes and their limits in advance prevents choosing flattering measures after results arrive. Recording manager satisfaction as well keeps the evaluation from resting only on rights removed.

35.3 Ethics and risks

The capstone involves managers' work but not personal data beyond what reviews already use. Sofia obtains Dr. Haddad's approval and Elmfield's agreement. Risks include a busy quarter, manager turnover and her own limited time. She plans responses, such as a fallback schedule. She also commits to keep the old process available if the new one fails, so that Elmfield's control is never weaker because of her project. Keeping the old process available means Elmfield's quarterly access review will still run if the redesign fails.

Worked example

Sofia proposes a redesigned access review with four predefined outcomes, interpretation risks and a fallback.

Synthetic case. The capstone is synthetic.

Errors and limits

Before-after comparisons confound time. Surveys measure perception.

Exercises

EX103 — Design elements. What four changes does the redesign include? Rubric: 3 = shorter plain lists, role guide, better timing, leaver list;; 2 = four;; 1 = vague;; 0 = none.
EX104 — Interpretation risk. Why might rights removed fall for reasons unrelated to the design? Rubric: 3 = earlier reviews already cleaned up access;; 2 = prior cleanup;; 1 = vague;; 0 = none.
EX105 — Safety commitment. What safeguards Elmfield's control during the project? Rubric: 3 = keeping the old process available if the new one fails;; 2 = fallback;; 1 = vague;; 0 = none.

Synthesis

A good capstone proposal fixes outcomes and safeguards in advance.

Continue studying — chapter 35 of 40

← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →