◇ OpenCyber Academy
Postgraduate · Chapter 11 · English

Chapter 11 — Evaluating the year

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Evaluating the year

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Results"]
  N2["11.2 Attribution"]
  N3["11.4 Next steps"]
  N4["Measuring the same way"]
  N5["Staff experience and expectations"]
  N6["Was the effort worth it"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Results"]
  N2["11.2 Attribution"]
  N3["11.4 Next steps"]
  N4["Measuring the same way"]
  N5["Staff experience and expectations"]
  N6["Was the effort worth it"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Results]
    |
    v
[11.2 Attribution]
    |
    v
[11.4 Next steps]
    |
    v
[Measuring the same way]
    |
    v
[Staff experience and expectations]
    |
    v
[Was the effort worth it]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) compare baseline and outcome; (2) discuss limits; (3) recommend next steps.

11.1 Results

Unsupported systems fell from 12 to 3, all with in-date exceptions; desktop compliance rose to 92 percent; patching within 14 days rose to 46 of 48. Priya reports each result against its starting point and its source. The unsupported count comes from the merged inventory; compliance and patch latency come from the supplier's console, checked against hand samples where possible. The three remaining unsupported machines are the cephalometric PCs awaiting a vendor release, and they are reported as controlled exceptions, not as fixed. She keeps the monthly figures so that readers can see how each measure changed during the year, not just its final value.

11.2 Attribution

Several changes overlapped, so Priya links outcomes to actions cautiously. The baseline, removal of administrator rights, new patch timing and wake-up for overnight installs all began within a few months, so Priya cannot say how much each contributed to better compliance or patch latency. She describes the sequence of changes beside the monthly figures and states which outcomes followed which actions, without claiming that one change caused one result. Where a link is direct, such as replacing an unsupported machine, she says so plainly. Her discussion labels each link as direct or uncertain, so readers can judge it.

11.3 Limits

One organisation, one year, supplier-reported data. These limits shape how far the results can be used. A different organisation, with other vendors, more staff or in-house IT, might find different problems and different costs. A year is too short to show whether the governance holds once Priya leaves. Much of the evidence comes from the supplier's console, which Priya checked with hand samples but could not verify fully. She states each limit in the report, so a reader in another organisation can judge which parts of the approach are likely to apply to them.

11.4 Next steps

Replace the last three imaging PCs, extend checks to clinic tablets. The three cephalometric PCs stay under their exceptions until the vendor's new release is available, then follow the same upgrade process as the other imaging machines. Clinic tablets were outside the project but carry patient data, so Priya recommends adding them to the inventory, baseline and encryption checks. Each step has a named owner and a target quarter in the handover document, so that the work is tracked rather than left as a hope. Priya also recommends repeating the merged inventory check yearly, as staff and suppliers change.

Measuring the same way

A fair comparison needs the same method at both ends. Priya repeats the chapter 2 process exactly: the same merge by serial number, the same vendor lifecycle sources and the same per-clinic coverage check before counting. Only then does she compare figures. If the method had changed, a lower unsupported count might simply reflect a different definition or a missing clinic. She also reports costs against budget. The imaging replacements came in slightly under budget because two capture cards could be reused, while staff time ran over, mostly in vendor coordination. Both facts go in the report, because a fair evaluation covers effort as well as outcomes.

Staff experience and expectations

A short survey of clinic managers asks whether the changes disrupted work. Most report little disruption; two mention the screen lock, which Priya records, since security that staff resent tends to be bypassed. She also compares the outcome with her own expectation. At the start she hoped to reach zero unsupported systems; three remain because the vendor's release has not shipped. She explains this gap rather than presenting it as failure, because the remaining machines are isolated, recorded and scheduled. If the release slips by six months, the exception dates are extended through the normal approval route, not informally.

Was the effort worth it

Leaders will ask whether the year's work was good value. Priya sets the cost, roughly forty supplier days and the replacement hardware, against what was reduced: nine unsupported machines removed, three more isolated and controlled, every desktop baselined and every laptop verified encrypted. She avoids inventing a precise monetary risk figure, which would give false precision. Instead she describes the likely cost of one serious incident at a clinic, such as days of cancelled appointments and notification work, in plain terms. The comparison is qualitative but honest, and it lets the board judge value on evidence rather than on the absence of incidents alone.

Worked example

The remaining three are cephalometric machines awaiting a new vendor release.

Synthetic case. Figures are synthetic.

Errors and limits

Claiming causation from overlapping changes overstates the evidence.

Exercises

Synthesis

Honest evaluation shows progress and remaining risk together.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →