Chapter 12 — Capstone presentation and next steps

Lesson map

Lesson 12 published. Map, example, EX056.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Presentation"]
  N2["12.2 Challenges"]
  N3["12.3 Outcome"]
  N4["12.4 Next steps"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX056"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Presentation"]
  N2["12.2 Challenges"]
  N3["12.3 Outcome"]
  N4["12.4 Next steps"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX056"]

[Learning outcomes]
    |
    v
[12.1 Presentation]
    |
    v
[12.2 Challenges]
    |
    v
[12.3 Outcome]
    |
    v
[12.4 Next steps]
    |
    v
[Worked example] --> [Exercise EX056]

Learning outcomes

You will (1) present a capstone to examiners and a board; (2) answer challenges; (3) plan continued improvement.

12.1 Presentation

Elena presents her capstone to Dr. Qureshi, an external examiner and Moorfield's board. She covers the risk, criteria, delivery, evidence and evaluation in twenty minutes, with backup slides showing data. She uses the board's language: clinics able to treat patients and patient records protected. Dr. Qureshi had advised her to lead with the business outcome and keep technical detail for questions. She rehearses twice with colleagues from the course, who ask her to shorten the introduction and move one chart forward. She also prepares a one-page handout summarising the criteria and results for board members.

12.2 Challenges

The external examiner asks whether patch compliance measures exposure accurately when imaging computers are excluded by exception. Elena explains the isolation controls and shows exception records, accepting that exposure remains. A partner asks about cost; she shows that most improvements used existing licences and staff time, with the backup provider as the main new cost. Both answers are clear and evidence-based. The examiner also asks how she would know if the improvements decayed over time, and she points to the quarterly measures and the yearly recovery test.

12.3 Outcome

Elena passes the capstone with distinction. The board adopts her measures as standing quarterly reporting and approves an independent incident response test. Elena reflects that the course gave her frameworks to organise what she already knew and the confidence to present security as a business matter. She notes that her relationships with clinic managers improved as they saw problems solved rather than blamed. Clinic managers send a short message thanking the central team for the patching support. Dr. Qureshi asks her permission to use the capstone as an example for future students.

12.4 Next steps

Elena plans next steps: the independent test, a review of the risk assessment in a year and preparing for possible ISO/IEC 27001 certification, which large insurers have begun to request. She also plans to mentor a junior team member through the same methods. The next course in this area, data governance, examines how decisions about data ownership, quality and use are made, which complements the security programme she has built. The board asks her to present a certification readiness plan within six months.

Worked example

Elena presents her capstone in business terms, answers challenges on imaging exceptions and cost, passes with distinction and plans certification readiness.

Synthetic case. The presentation is synthetic.

Errors and limits

Leading with technical detail loses a board audience.

Exercises

• EX056 — Board language. What language does Elena use for the board?
  Show marking criteria

  Rubric: 3 = clinics able to treat patients;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX057 — Main new cost. What was the main new cost?
  Show marking criteria

  Rubric: 3 = the backup provider;; 2 = partly correct;; 1 = other;; 0 = none.
• EX058 — Capstone result. What result does Elena achieve?
  Show marking criteria

  Rubric: 3 = distinction;; 2 = partly correct;; 1 = other;; 0 = none.
• EX059 — Board adoption. What does the board adopt?
  Show marking criteria

  Rubric: 3 = Elena's measures as quarterly reporting;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX060 — Certification driver. Why consider ISO/IEC 27001 certification?
  Show marking criteria

  Rubric: 3 = insurers have begun to request it;; 2 = partly correct;; 1 = vague;; 0 = none.