Chapter 12 — Final review and transfer
Lesson map
Lesson 12 published. Map, example, EX056.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Final review"]
N2["12.2 Transfer to Corran"]
N3["12.3 Sustaining the change"]
N4["12.4 Professional reflection"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX056"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Final review"]
N2["12.2 Transfer to Corran"]
N3["12.3 Sustaining the change"]
N4["12.4 Professional reflection"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX056"]
[Learning outcomes]
|
v
[12.1 Final review]
|
v
[12.2 Transfer to Corran]
|
v
[12.3 Sustaining the change]
|
v
[12.4 Professional reflection]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX056]
Learning outcomes
You will (1) review the whole project; (2) transfer ownership to Corran; (3) reflect on professional development.
12.1 Final review
Marta and Prof. Haddad review the project against its aims. Corran now has named, key-protected administrators, just-in-time elevation, vaulted emergency and legacy credentials, monitored activity, documented service accounts and a signed residual risk register. Standing privilege has fallen by about 98 percent with small operational cost. Limits remain: eight weeks of post-rollout data, one organisation and a legacy system awaiting replacement. Marta's dissertation reports these honestly with evidence. Prof. Haddad agrees the conclusions match the evidence, and suggests making the limits section more prominent so readers see it before the recommendations.
12.2 Transfer to Corran
Ownership transfers formally. The IT manager owns the administrator policy and elevation configuration; the security lead owns monitoring and activation reviews; HR owns lifecycle triggers; the finance director owns the residual risk register. Marta hands over runbooks, the assurance pack, training materials and test cases. A handover meeting walks through each item, and owners confirm they can run their parts. The transfer is recorded, so responsibility is clear after Marta's project role ends. A copy of every handed-over item is stored in Corran's document system.
12.3 Sustaining the change
Marta proposes a sustaining plan: quarterly review of privileged identities, six-monthly vault emergency release tests, yearly training refreshers and a check whenever a new system is added. Measures continue in the monthly IT report. She warns that without such routines, standing privilege tends to creep back as quick fixes accumulate. Sustaining change is harder than making it, and naming routines and owners is the best protection against gradual decline. The IT manager adds each routine to the team calendar with a named owner, and the first quarterly review is scheduled before Marta leaves.
12.4 Professional reflection
Marta reflects on her development: from engineer to someone who frames decisions for leaders, measures outcomes and communicates evidence. She learned that technical controls succeed only when people understand and accept them, and that honest reporting of limits builds more trust than polished claims. She plans to share an anonymised summary with a regional practitioner group, contributing to the thin evidence base on privileged access in mid-sized organisations. Prof. Haddad encourages her to present at the group's next meeting, and Corran agrees, provided the summary is reviewed for identifying details first.
Worked example
The final review confirms a 98 percent reduction in standing privilege with stated limits; four owners accept formal transfer and a sustaining plan sets quarterly, six-monthly and yearly routines.
Synthetic case. Reviews, owners and plans are synthetic.
Errors and limits
Ending a project without sustaining routines lets standing privilege creep back through quick fixes.
Exercises
- EX056 — Post-rollout limit. Name one limit Marta states in the final review. Rubric: 3 = eight weeks of data, one organisation, legacy system (one);; 2 = one;; 1 = vague;; 0 = none.
- EX057 — Register owner. Who owns the residual risk register after transfer? Rubric: 3 = finance director;; 2 = director;; 1 = Marta;; 0 = none.
- EX058 — Sustaining routines. Name two sustaining routines. Rubric: 3 = quarterly identity review, six-monthly vault test, yearly training, new-system check (two);; 2 = one;; 1 = vague;; 0 = none.
- EX059 — Creep warning. What happens without sustaining routines? Rubric: 3 = standing privilege creeps back;; 2 = drift;; 1 = vague;; 0 = none.
- EX060 — Sharing plan. How will Marta share her findings beyond Corran? Rubric: 3 = anonymised summary to a regional practitioner group;; 2 = practitioners;; 1 = vague;; 0 = none.
Synthesis
Honest review, formal transfer and named sustaining routines turn a project into lasting practice.
Continue studying — chapter 12 of 12
← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →