Chapter 18 — Supervised technical project | Technical Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Supervised technical project

Lesson map

Lesson 18 published. Map, example, EX069.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 The project"]
  N2["18.2 Results"]
  N3["18.3 Handover"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX069"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 The project"]
  N2["18.2 Results"]
  N3["18.3 Handover"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX069"]

[Learning outcomes]
    |
    v
[18.1 The project]
    |
    v
[18.2 Results]
    |
    v
[18.3 Handover]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX069]

Learning outcomes

You will (1) deliver a supervised technical GRC project; (2) measure results; (3) hand over to the client.

18.1 The project

For her supervised project, Amina builds a weekly check pack for Fenwick: the baseline check, firewall verification, certificate expiry check and account reconciliation, run by one script that creates tickets for findings. She agrees scope and success criteria with the IT lead: all four checks running weekly, findings reaching tickets and the IT team able to maintain the pack. She keeps a project log of decisions and problems. Ms. Bell notes that the agreed success criteria will let both of them judge the project objectively at the end.

18.2 Results

After six weeks, all four checks run weekly. They find eleven issues, including two laptops without encryption, one unapproved firewall rule and three leaver accounts. All issues become tickets, and nine are closed within two weeks. The IT lead reports that checks that used to be skipped now happen reliably. Amina reports results honestly, noting two tickets still open because they need a supplier's help. Two leaver accounts or one unapproved rule found weekly is evidence the pack catches what manual checks had missed.

18.3 Handover

Amina hands over the script, procedures, test data, a list of known limitations and a short training session for the technicians. One technician adds a new check during training, showing the pack can be extended. Ms. Bell assesses the project as meeting all criteria and praises the honest reporting. Amina reflects that technical GRC work is about reliable routines, clear evidence and careful handover rather than complex tools. The technician's new check during training is the strongest sign that the pack will survive her departure.

Worked example

Amina delivers a weekly check pack finding eleven issues, closes nine within two weeks and hands over with training.

Synthetic case. The project and results are synthetic.

Errors and limits

Six weeks is short. Some issues need suppliers.

Exercises

EX069 — Pack checks. Which four checks does the pack run? Rubric: 3 = baseline, firewall verification, certificate expiry, account reconciliation;; 2 = four;; 1 = vague;; 0 = none.
EX070 — Issues found. How many issues did the checks find in six weeks? Rubric: 3 = eleven;; 2 = 11;; 1 = vague;; 0 = none.
EX071 — Closed tickets. How many issues were closed within two weeks? Rubric: 3 = nine;; 2 = 9;; 1 = eleven;; 0 = none.
EX072 — Extensibility proof. What showed the pack could be extended? Rubric: 3 = a technician added a new check during training;; 2 = extension;; 1 = vague;; 0 = none.

Synthesis

A supervised project succeeds through reliable routines, honest results and a careful handover.

Continue studying — chapter 18 of 18

← Chapter 17 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →