Chapter 11 — Applied project

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Rollout"]
  N2["11.2 Outcomes"]
  N3["11.3 Unexpected effects"]
  N4["11.4 Documenting lessons"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Rollout"]
  N2["11.2 Outcomes"]
  N3["11.3 Unexpected effects"]
  N4["11.4 Documenting lessons"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Rollout]
    |
    v
[11.2 Outcomes]
    |
    v
[11.3 Unexpected effects]
    |
    v
[11.4 Documenting lessons]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) roll out the design across Corran; (2) measure outcomes against the baseline; (3) document lessons.

11.1 Rollout

After the pilot, Design B is rolled out to all administrators over four weeks. Each administrator receives two security keys, a named administrator account and training. The shared night-shift account is disabled after both night administrators have individual accounts and have used them successfully for a week. Supplier access moves to ticket-linked named accounts. Each step has a rollback plan and is verified afterwards. Marta tracks progress weekly with the IT manager and records issues as they arise. No operational incidents occur during rollout.

11.2 Outcomes

After eight weeks, Marta measures outcomes using the same definitions as the baseline. Standing privilege-hours fall from 1,344 to about 22 per week, slightly higher than the pilot estimate because of two incident weeks. All human administrators use phishing-resistant keys. Shared administrator accounts fall from one to none. Out-of-window activations average three a week, all reviewed within one working day. Service accounts are documented, with two removed. She reports each with counts and dates. Results are presented to the IT manager and filed with the assurance pack.

11.3 Unexpected effects

Some effects were not planned. Administrators report that requesting elevation made them think twice before changes, catching two mistakes. Conversely, a warehouse manager complained that an overnight fix took ten minutes longer while the administrator located a key. Marta records both. Unexpected effects, good and bad, are part of an honest evaluation and often point to the next improvement, such as storing spare keys at each warehouse for night shifts. She also asks administrators for further suggestions, gathering three more small ideas that the IT manager adopts over the following month.

11.4 Documenting lessons

Marta writes lessons for Corran and for her dissertation: pilot before rollout, involve night shifts early, provide two keys per administrator, link elevation to change tickets and review out-of-window activity kindly. She also notes what she would change, such as starting the service account work earlier. Lessons are written with evidence from the project, so they can guide Corran's next identity projects and help other organisations of similar size. Each lesson names the evidence behind it and the situation in which it applies, so readers can judge whether it fits their own organisation before adopting it.

Worked example

Rollout cuts standing privilege-hours from 1,344 to about 22 per week, removes the shared account and brings all human administrators onto keys; spare warehouse keys address night-shift delays.

Synthetic case. Rollout, outcomes and lessons are synthetic.

Errors and limits

Reporting only intended outcomes hides side effects that point to the next improvement.

Exercises

• EX051 — Rollout privilege-hours. What were standing privilege-hours after rollout?
  Show marking criteria

  Rubric: 3 = about 22 per week, from 1,344;; 2 = 22;; 1 = 18.5;; 0 = none.
• EX052 — Higher than pilot. Why were rollout hours higher than the pilot estimate?
  Show marking criteria

  Rubric: 3 = two incident weeks;; 2 = incidents;; 1 = error;; 0 = none.
• EX053 — Positive side effect. What positive side effect did administrators report?
  Show marking criteria

  Rubric: 3 = thinking twice caught two mistakes;; 2 = fewer mistakes;; 1 = vague;; 0 = none.
• EX054 — Night-shift fix. What addresses night-shift key delays?
  Show marking criteria

  Rubric: 3 = spare keys at each warehouse;; 2 = spare keys;; 1 = passwords;; 0 = none.
• EX055 — Hindsight. What would Marta start earlier?
  Show marking criteria

  Rubric: 3 = service account work;; 2 = service accounts;; 1 = vague;; 0 = none.

Synthesis

A careful rollout with consistent measurement, honest side effects and evidenced lessons completes the applied project.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →