Chapter 44 — Engineering capstone I

Chapter 44 — Engineering capstone I

Lesson map

Lesson 44 published. Map, example, EX130.

flowchart TD
  N0["Learning outcomes"]
  N1["44.1 Scoping"]
  N2["44.2 Success criteria"]
  N3["44.3 Project risk"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX130"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["44.1 Scoping"]
  N2["44.2 Success criteria"]
  N3["44.3 Project risk"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX130"]

[Learning outcomes]
    |
    v
[44.1 Scoping]
    |
    v
[44.2 Success criteria]
    |
    v
[44.3 Project risk]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX130]

Learning outcomes

You will (1) scope a capstone governance engineering project; (2) define success criteria with a client; (3) plan risk and quality for the project itself.

44.1 Scoping

For her capstone, Nadia works with Ardwell's new security manager on a continuous control monitoring service: automated collection of evidence for twenty high-value controls, with alerts when a control fails and a dashboard for owners. The scope excludes controls requiring human judgement. She writes a scope statement, lists stakeholders and agrees on constraints: only the standard library and existing systems, no access to production data beyond what owners already share and delivery within two terms. Limiting the scope to controls with machine-readable evidence keeps the twenty-control target achievable within two terms.

44.2 Success criteria

With the client, Nadia defines success criteria: evidence for at least eighteen of twenty controls collected automatically; alerts within one day of a control failure in tests; owners spending less time on evidence than before, measured by a short survey; and no false closure of findings. Each criterion has a measurement method. She learns that agreeing criteria early prevents disputes later and keeps the project focused on outcomes the client values rather than features that are merely interesting. The criterion on false closure links back to her earlier rule that only the analyst may close findings.

44.3 Project risk

Nadia applies risk management to her own project. Risks include data access delays, changes in systems during the project, her own limited time and the chance that owners ignore alerts. For each she records a response: early access requests, interface checks, a schedule buffer and involving owners in alert design. She learns that a GRC engineer who does not manage the risks of her own project undermines her credibility, and that the habits she teaches others apply to her work too. Involving owners in alert design also addresses the risk that alerts are ignored, since owners helped set them.

Worked example

Nadia scopes a continuous monitoring service for twenty controls, agrees four measurable success criteria and manages her own project risks.

Synthetic case. The capstone is synthetic.

Errors and limits

Scopes creep. Surveys measure perception, not time.

Exercises

• EX130 — Excluded controls. Which controls are excluded from scope? Rubric: 3 = those requiring human judgement;; 2 = judgement;; 1 = vague;; 0 = none.
• EX131 — Coverage criterion. What is the evidence coverage success criterion? Rubric: 3 = at least eighteen of twenty controls automated;; 2 = 18/20;; 1 = vague;; 0 = none.
• EX132 — Alert risk. How does Nadia respond to the risk that owners ignore alerts? Rubric: 3 = involve owners in alert design;; 2 = involvement;; 1 = vague;; 0 = none.

Synthesis

A capstone starts with clear scope, measurable success criteria and managed project risk.

Continue studying — chapter 44 of 50

← Chapter 43 (draft) · Course chapter index · Chapter 45 (draft) →