## Chapter 1 — Research question and literature method ### Learning outcomes You will (1) turn a governance concern into a researchable question; (2) search and screen literature systematically; (3) record sources so others can repeat the search. ### 1.1 From concern to question Lucas Ferreira, a master's student at the fictional Marlow Institute of Technology, works part time in the security office of Tessaly Logistics, a fictional company with 1,200 staff and an ISO/IEC 27001:2022 certified management system. Auditors keep finding staff with access they no longer need. His manager asks whether reviewing access every quarter instead of every year would help. Lucas turns this into a research question: in Tessaly's business units, is quarterly access review associated with a lower rate of excess access than annual review, and at what cost in reviewer time? ### 1.2 Making it answerable His supervisor, Dr. Ingrid Solberg, pushes for precision. Excess access must be defined: an account holding a permission that its owner's current role does not require, judged against a written role catalogue. The unit of analysis is the account, not the person. The outcome is measured at one point in time by an independent reviewer. Cost is the hours reviewers log. Lucas also writes down what the study cannot show: it is observational, because units chose their review frequency, so any difference may reflect other unit traits. ### 1.3 Searching systematically Lucas searches two academic databases and standards bodies' sites with a written search string combining access review, entitlement, recertification and audit findings. He records the date, database, string and number of hits for each search in a log. He screens titles and abstracts against inclusion rules: empirical or standards sources about periodic access review or control effectiveness in organisations. He keeps a list of excluded items with reasons. This log lets Dr. Solberg, or anyone else, repeat the search and see whether Lucas missed relevant work. ### 1.4 Reading standards as sources Standards are a special kind of literature. ISO/IEC 27002:2022 provides guidance on access rights, including review of rights at planned intervals, but does not prescribe a frequency. NIST SP 800-53 Rev. 5 includes an account management control whose review frequency is set by the organisation. Lucas notes that standards express consensus good practice, not tested effects, so they define the question but cannot answer it. He paraphrases rather than copies them and cites each by edition so readers know exactly which text he means. ### Worked example Lucas defines excess access against a role catalogue, logs reproducible searches and treats standards as context rather than evidence of effect. > **Synthetic case.** Tessaly, Marlow and all data are synthetic; ISO/IEC 27002:2022 and SP 800-53 Rev. 5 are real. ### Errors and limits Observational designs cannot prove cause. Search logs miss grey literature. ### Exercises - **EX001 — Unit of analysis.** What is the unit of analysis in Lucas's study? *Rubric:* 3 = the account;; 2 = accounts;; 1 = people;; 0 = none. - **EX002 — Excess definition.** How is excess access defined? *Rubric:* 3 = a permission the owner's current role does not need, per the role catalogue;; 2 = role catalogue;; 1 = vague;; 0 = none. - **EX003 — Cost measure.** How does Lucas measure cost? *Rubric:* 3 = reviewer hours logged;; 2 = hours;; 1 = vague;; 0 = none. - **EX004 — Design limit.** Why can the study not prove cause? *Rubric:* 3 = units chose their review frequency;; 2 = observational;; 1 = vague;; 0 = none. - **EX005 — Search log fields.** What does Lucas record for each search? *Rubric:* 3 = date, database, string and hit count;; 2 = log;; 1 = vague;; 0 = none. - **EX006 — Frequency guidance.** Does ISO/IEC 27002:2022 prescribe a review frequency? *Rubric:* 3 = no, it asks for planned intervals;; 2 = no;; 1 = yes;; 0 = none. - **EX007 — Standards role.** What can standards do for this question? *Rubric:* 3 = define it but not answer it;; 2 = context;; 1 = evidence of effect;; 0 = none. ### Synthesis A precise, answerable question and a reproducible search come before any data. ### Continue studying — chapter 01 of 08 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** The account, not the person. **EX002.** A permission the account owner's current role does not require, judged against the written role catalogue. **EX003.** By the hours reviewers log. **EX004.** Because units chose their own frequency, so differences may reflect other unit traits. **EX005.** The date, database, search string and number of hits. **EX006.** No; it calls for review at planned intervals without setting a frequency. **EX007.** Define the question as consensus practice, but not provide tested evidence of an effect.