◇ OpenCyber Academy
Postgraduate · Chapter 11 · English

Chapter 11 — Applied project

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Applied project

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Project types"]
  N2["11.2 Scoping with a sponsor"]
  N3["11.3 Deliverables"]
  N4["11.4 Data protection"]
  N5["11.5 Impact evaluation"]
  N6["11.6 Worked case"]
  N7["11.8 Working with resistance"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Project types"]
  N2["11.2 Scoping with a sponsor"]
  N3["11.3 Deliverables"]
  N4["11.4 Data protection"]
  N5["11.5 Impact evaluation"]
  N6["11.6 Worked case"]
  N7["11.8 Working with resistance"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Project types]
    |
    v
[11.2 Scoping with a sponsor]
    |
    v
[11.3 Deliverables]
    |
    v
[11.4 Data protection]
    |
    v
[11.5 Impact evaluation]
    |
    v
[11.6 Worked case]
    |
    v
[11.8 Working with resistance]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) scope an applied specialist project with an organizational sponsor; (2) produce decision-ready deliverables; (3) apply the evidence, evaluation and governance methods of this book; (4) manage authorization and data protection; and (5) evaluate impact.

11.1 Project types

Suitable projects: designing and piloting an inventory programme for one division; producing an internal cryptographic standard with a transition plan; leading an evaluated pilot of hybrid key exchange on one platform; designing a post-quantum PKI roadmap; or building a supplier assurance process. Each produces artefacts the organization will use.

Choose a project that the sponsor will use whatever the result. A pilot that finds hybrid key exchange cannot be enabled on one platform is still useful, if it is evaluated against criteria set in advance. Avoid projects that only describe the problem.

11.2 Scoping with a sponsor

Agree with a sponsor: the decision the project supports, scope, deliverables, access, authorization, success criteria, and how results will be used. Written authorization must cover any observation or testing; prefer isolated labs for active tests.

Write the agreement down and have the sponsor sign it before any data are collected. Include what happens to project data at the end and who may see results. Review the scope with the sponsor at the midpoint, and record any changes. Keep a copy with the project records.

11.3 Deliverables

Decision-ready deliverables include a short decision paper, the evidence behind it (inventory extracts, evaluation results, assumption tables), implementation artefacts (policy text, configuration baselines, procurement clauses) and a handover plan.

Each deliverable should have an owner who will use it after the project. At NRHT the radiology project produced a questionnaire, a scoring rubric and contract clauses as well as a decision paper. Test usable artefacts with the people who will apply them before handover. Agree the handover date with each owner.

11.4 Data protection

Projects in healthcare touch sensitive systems. Collect metadata, not content; minimise identifiers; store project data securely; and delete it per the agreement.

Record in the project plan which data will be collected, who can access it, where it will be stored and when it will be deleted. Check that the data protection officer agrees before collection starts. At the end, confirm deletion in writing. Pseudonymise asset names in any project extract that leaves NRHT systems, and keep the mapping on NRHT systems only. Report any accidental collection of content to the sponsor straight away.

11.5 Impact evaluation

Define impact before starting: for example, "tier-1 unknown share in the radiology division reduced from 31 % to below 10 %" or "supplier questionnaire adopted for all new radiology contracts". Measure after a defined period.

Set a baseline measure before starting and agree the target and the date for measuring it. At NRHT's radiology project the unknown share started at 31 % and was measured again after six months. Report the result whether or not it meets the target. Choose measures the organization already collects where possible.

11.6 Worked case

Project (synthetic): "Supplier assurance for post-quantum readiness in NRHT radiology." Sponsor: Director of Radiology IT. Deliverables: questionnaire, scoring rubric, contract clauses, results for 18 suppliers, decision paper. Results: 5 suppliers with dated roadmaps and test access; 7 with undated claims; 6 silent. Decision: PQC clauses mandatory in all renewals; silent suppliers escalated to procurement; two suppliers invited to joint lab pilots. Impact after six months: unknown share in radiology fell from 31 % to 12 %.

The result is reported with its baseline and its measurement date, and the decision paper turned findings into procurement actions. Keep the questionnaire and rubric so other divisions can reuse them.

11.7 Common errors and limits

Each error has a guard. Agree the decision the project supports before starting. Deliver artefacts such as policy text, clauses and configuration baselines along with the report. Define impact measures and baselines before work begins, and report the outcome even when it falls short. At NRHT the radiology project was tied to a procurement decision, delivered a questionnaire, rubric and clauses, and measured unknown share against a 31 % baseline after six months. Use that structure as a template for other divisions.

11.8 Working with resistance

Applied projects meet resistance: service owners worried about outages, suppliers reluctant to disclose, budget holders sceptical of a risk that has not materialised. Treat resistance as information. An owner's fear of outage is a requirement for staged rollout and rollback; a supplier's reluctance is a procurement lever; scepticism is a request for the robust-decision argument of Chapter 1. Record objections and how the project addressed them in the decision paper, because the same objections will return when the work scales beyond the pilot.

Exercises

Synthesis

Applied projects support real decisions, deliver usable artefacts under proper authorization and data protection, and measure impact against criteria set in advance.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →