◇ OpenCyber Academy
Professional · Chapter 12 · English

Chapter 12 — Lessons for practitioners

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Lessons for practitioners

Lesson map

Lesson 12 published. Map, example, EX056.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Lessons"]
  N2["12.2 Next steps"]
  N3["12.3 Sharing"]
  N4["12.4 Career"]
  N5["What surprised Seun"]
  N6["What he would do differently"]
  N7["Applying the pattern and developing further"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX056"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Lessons"]
  N2["12.2 Next steps"]
  N3["12.3 Sharing"]
  N4["12.4 Career"]
  N5["What surprised Seun"]
  N6["What he would do differently"]
  N7["Applying the pattern and developing further"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]

[Learning outcomes]
    |
    v
[12.1 Lessons]
    |
    v
[12.2 Next steps]
    |
    v
[12.3 Sharing]
    |
    v
[12.4 Career]
    |
    v
[What surprised Seun]
    |
    v
[What he would do differently]
    |
    v
[Applying the pattern and developing further]
    |
    v
[Worked example] --> [Exercise EX056]

Learning outcomes

You will (1) reflect; (2) share lessons; (3) plan next steps.

12.1 Lessons

Evidence matters as much as settings; tailoring keeps standards workable. Seun's first lesson comes from the audit finding itself: Marlowe probably had many good settings, but it could not prove it, so producing evidence was half the work. His second comes from the warehouse: without a longer screen lock and badge sign-in, shift workers would have worked around the standard. He writes both lessons into his final report with examples, so other managers can apply them in their own programmes.

12.2 Next steps

Phones and handheld scanners. Phones and handheld scanners were left out of scope at the start, with owners recorded. Seun recommends bringing them into the standard next, beginning with an inventory and coverage measurement as for the other device groups. The scanners are vendor-managed, so the first step is agreeing with the vendor which settings it controls and what evidence it can provide. The recommendation goes to the operations director with a proposed timeline, and the next yearly review of the standard checks progress.

12.3 Sharing

Seun presents at the programme. At the final session of the Kingsmere Institute programme, Seun presents the charter, the coverage table, the risk ranking and the evidence pack, describing what worked and what took longer than expected. Other participants ask most about tailoring for the warehouse and about how he persuaded business owners to approve exceptions. Claire suggests he share the charter and register templates with the cohort, removing anything specific to Marlowe. He also offers to answer questions from participants planning similar programmes in their own organisations.

12.4 Career

Seun adds governance skills. Before the programme, Seun's work at Marlowe was mostly technical: deploying tools and fixing problems. Running the programme taught him to write a standard, measure against it, rank risks with business owners and build an evidence pack an insurer would accept. He records these skills in his professional development plan, with examples from the programme, and Claire agrees to review his progress after six months. He also plans to take on the yearly standard review himself, which keeps these skills in use after the programme ends.

What surprised Seun

The biggest surprise was how much of the work was conversation rather than configuration: agreeing tailored settings, explaining badge sign-in, persuading teams to use the configuration tool. Technical changes were rarely the slow part.

He also learned that measurement changes behaviour. Once groups saw their figures monthly, owners began fixing gaps before being asked.

Owners also started asking for figures for their own planning, which Seun had not expected. Measurement turned out to be a management tool as much as a security one.

What he would do differently

Seun would validate console data earlier, since the first month's Linux figures were slightly optimistic and had to be corrected publicly. He would involve warehouse managers from the first week rather than month two, because their support made the biggest difference to adoption. He would also agree the format of the monthly table with owners before the first report, rather than revising it twice. None of these changed the outcome, but each cost time and some credibility, and each is a lesson that applies to almost any measurement-led programme.

Applying the pattern and developing further

Claire points out that the pattern of charter, standard, measurement, prioritisation, exceptions and evidence applies to many areas, such as network devices and cloud services. Seun plans to use it for the phone and scanner project next year, starting with a charter and a coverage table. He records the programme as continuing professional development and plans a certification in IT audit to strengthen the governance side of his role. The programme ends where it began, with the audit finding, now formally closed with evidence that will be kept current.

Advice to peers

Seun's advice to peers starting a similar programme is short: begin with a charter, use recognised references, measure by group, tailor openly and keep an honest exceptions register. Above all, report regularly to the people who own the risk, so security becomes part of normal management rather than a special project.

He also advises keeping the first version of the standard short; a standard that people can actually meet earns more trust than a complete one that nobody reaches.

Expand it once people meet it.

Worked example

Claire notes the programme pattern fits other areas.

Synthetic case. The case is fictional.

Errors and limits

Lessons not written down are lost.

Exercises

Synthesis

A disciplined six-month programme closed the audit finding.

Continue studying — chapter 12 of 12

← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →