◇ OpenCyber Academy
Bachelor's · Chapter 38 · English

Chapter 38 — Capstone implementation

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 38 — Capstone implementation

Lesson map

Lesson 38 published. Map, example, EX112.

flowchart TD
  N0["Learning outcomes"]
  N1["38.1 Implementation"]
  N2["38.2 Monitoring"]
  N3["38.3 Comparability"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX112"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["38.1 Implementation"]
  N2["38.2 Monitoring"]
  N3["38.3 Comparability"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX112"]
[Learning outcomes]
    |
    v
[38.1 Implementation]
    |
    v
[38.2 Monitoring]
    |
    v
[38.3 Comparability]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX112]

Learning outcomes

You will (1) implement a redesigned governance process; (2) monitor it as it runs; (3) adjust without losing comparability.

38.1 Implementation

Sofia implements the redesigned access review for one quarter. She prepares shorter lists with plain descriptions of each permission, writes a two-page role guide with the data protection lead, schedules the review for the second week of the month and adds the leaver list. She briefs managers in a short meeting and offers help sessions. She keeps a log of every question managers ask, because questions reveal where the design is still unclear. The help sessions also give her a direct view of where the role guide is still unclear.

38.2 Monitoring

During the review, Sofia tracks completion daily. Most managers finish within a week. Two ask what a permission called case escalation means, so she clarifies its description for everyone. One manager is on leave, and a deputy completes the review. She records these events. She learns that monitoring a new process as it runs allows small fixes, but each change must be logged so that the evaluation can account for it later. Dr. Haddad notes that the clarified case escalation description must be recorded as a mid-review change in her evaluation.

38.3 Comparability

Sofia is tempted to change the measurement method when she notices the old completion data used different dates. Instead, she records completion using both the old and new definitions, so results can be compared fairly with previous quarters. She learns that improving a process and evaluating it are different tasks, and that keeping measurement consistent is essential if Elmfield is to learn whether the redesign actually helped. Recording both definitions lets the comparison with the previous two quarters use like-for-like completion dates.

Worked example

Sofia runs the redesigned review, logs questions and fixes, and keeps both old and new measurement definitions for fair comparison.

Synthetic case. The implementation is synthetic.

Errors and limits

Mid-course fixes complicate evaluation. One quarter is a short trial.

Exercises

Synthesis

Implementing a redesign well means monitoring, logging changes and keeping measurement consistent.

Continue studying — chapter 38 of 40

← Chapter 37 (draft) · Course chapter index · Chapter 39 (draft) →