◇ OpenCyber Academy
Professional · Chapter 11 · English

Chapter 11 — Results and sustainment

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Results and sustainment

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Results"]
  N2["11.2 Routines"]
  N3["11.3 Ownership"]
  N4["Comparing fairly"]
  N5["Cost, effort and owner feedback"]
  N6["Handover of routines"]
  N7["Remaining gaps"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Results"]
  N2["11.2 Routines"]
  N3["11.3 Ownership"]
  N4["Comparing fairly"]
  N5["Cost, effort and owner feedback"]
  N6["Handover of routines"]
  N7["Remaining gaps"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]
[Learning outcomes]
    |
    v
[11.1 Results]
    |
    v
[11.2 Routines]
    |
    v
[11.3 Ownership]
    |
    v
[Comparing fairly]
    |
    v
[Cost, effort and owner feedback]
    |
    v
[Handover of routines]
    |
    v
[Remaining gaps]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) compare start and end; (2) set routines; (3) assign ownership.

11.1 Results

Laptop compliance 70 to 91 percent, Linux 50 to 89, warehouse agents 78 to 95, admin MFA 0 to 100. Seun reports each result against the month-zero baseline from the coverage table, using the same counting rules as the first month. The Linux figure falls short of full compliance because of the two documented exceptions, and the warehouse agent figure falls short because of the two old PCs awaiting replacement. He presents the monthly figures beside the actions taken, so the operations director can see when each change began to show.

11.2 Routines

Monthly coverage, quarterly exceptions, yearly standard review. These routines are what keep the programme going after the six months end. Each month, the coverage figures are produced from the consoles and reviewed with the operations director. Each quarter, the exceptions register is reviewed with business owners. Each year, the standard itself is reviewed against new benchmark releases and Marlowe's changing needs. Seun writes each routine down with its owner, inputs and outputs, so it does not depend on his memory. The written routines go into the evidence pack, so an auditor can see how Marlowe keeps the standard current after the programme ends.

11.3 Ownership

Each group has a named owner. The infrastructure team owns servers, warehouse managers own the shared PCs, and the endpoint team owns laptops. Each owner receives their group's monthly figures and is responsible for explaining changes and acting on gaps. The operations director remains the owner of the overall risk and approves the standard. Naming owners means the programme does not stop if Seun is away or changes role, and the owners attend the quarterly exceptions review. The owners' names are recorded in the standard itself, so a change of owner needs the same approval as a change of setting.

11.4 Limits

One company, six months. Results from one logistics company over six months may not hold for organisations with different devices, staff or suppliers. Six months is also too short to show whether compliance holds once the programme's attention moves elsewhere. The figures come from Marlowe's own consoles, reconciled against the asset register but not independently verified. Seun states these limits in his final report, so readers judge which parts of the approach suit their own organisations rather than copying the figures as targets.

Comparing fairly

Seun uses the same consoles, groups and definitions at month six as in month one, and repeats the hand validation. He notes changes to the asset count, such as six new laptops, and explains that percentages use the current totals.

He is cautious about attribution: several changes happened together, so he links each result to the most direct action without claiming precise effects.

Where a figure changed because the group changed size rather than because devices improved, he explains it in a footnote so the comparison stays honest.

Cost, effort and owner feedback

The programme used about forty days of staff time across IT and infrastructure, plus the cost of replacing eight warehouse PCs that was already planned. Seun reports this so leaders can judge value, and notes that the routines now need about two days a month. He also asks owners how the programme affected them. They report that monthly figures helped them plan work and justify replacement budgets, which suggests that measurement has become useful to them rather than a burden imposed by IT. This feedback is the best evidence that the routines will continue after the programme ends.

Handover of routines

Routines are assigned in the IT team's calendar with named people and backups. The monthly report is generated automatically, and the infrastructure lead presents it at the operations meeting.

Seun also writes a short guide explaining how to update the standard and run the quarterly exception review, so the work does not depend on him.

Each routine has a one-line purpose at the top, so people understand why it matters and are less tempted to skip it when busy. The first month after handover is run jointly, with Seun watching and the new owners doing the work.

Remaining gaps

Warehouse encryption remains at 50 percent pending replacements, and phones and scanners are outside scope. Seun lists both in the final report with owners and dates, so the next phase starts from a clear position.

The operations director accepts the remaining risk for now and approves the budget for the next phase.

The remaining gaps are added to the exceptions register, so they are reviewed quarterly like everything else rather than tracked in a separate list that could be forgotten.

Worked example

The final coverage table is filed with the evidence pack.

Synthetic case. Figures are synthetic.

Errors and limits

Without routines, coverage drifts back.

Exercises

Synthesis

Measured results and routines sustain the programme.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →