Chapter 30 — Capstone: three-year identity improvement | Technologist Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 30 — Capstone: three-year identity improvement

Lesson map

Lesson 30 published. Map, example, EX088.

flowchart TD
  N0["Learning outcomes"]
  N1["30.1 What changed"]
  N2["30.2 Evaluating results"]
  N3["30.3 Next steps"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX088"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["30.1 What changed"]
  N2["30.2 Evaluating results"]
  N3["30.3 Next steps"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX088"]

[Learning outcomes]
    |
    v
[30.1 What changed]
    |
    v
[30.2 Evaluating results]
    |
    v
[30.3 Next steps]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX088]

Learning outcomes

You will (1) summarise the programme's improvements; (2) evaluate results; (3) plan the next steps.

30.1 What changed

Over three years Kai's work changed Fernhill's identity management: an inventory of systems; HR as the source of truth; role and location groups with owners; joiner, mover and leaver processes; MFA for all staff and phishing-resistant authenticators for priority roles; single sign-on and SCIM provisioning for the practice management system; individual reception sign-in; supplier controls; quarterly reviews; and monthly metrics. Each change was small, tested and documented, and together they form a system that runs without him. Kai lists each change with its date.

30.2 Evaluating results

Kai compares the start and end: 12 disabled but unremoved accounts reduced to none; receptionists no longer holding clinical write; leavers removed on time in every case for the last six months; review completion 100 percent in the last two quarters. He also notes what remains: payroll without single sign-on and two suppliers without identity contract terms. Honest evaluation lists gaps as clearly as successes, which helps the next person prioritise. He shares the evaluation with the practice manager and Ruth. Both agree the figures are fair. The gaps go into the handover plan.

30.3 Next steps

Kai's handover plan proposes next steps: move payroll to a supplier supporting single sign-on at renewal; extend passkeys to all staff as devices are replaced; add identity terms to the remaining contracts; and repeat the group hygiene, sign-in summary and review scripts each quarter. Ruth signs off the capstone, noting that the strongest result is that Fernhill's own staff now run the processes confidently. Each step has an owner and target date. The practice manager approves the plan. Kai includes his scripts and runbooks, with notes on how to run each quarter.

Worked example

The capstone records improvements, measured results and three gaps, with a handover plan for payroll, passkeys and contracts.

Synthetic case. Results and plans are synthetic.

Errors and limits

A capstone that lists only successes leaves the next person unaware of gaps.

Exercises

EX088 — Remaining gaps. Name one remaining gap. Rubric: 3 = payroll without SSO;; 2 = payroll;; 1 = vague;; 0 = none.
EX089 — Leaver result. What leaver result was achieved? Rubric: 3 = on time in every case for six months;; 2 = on time;; 1 = vague;; 0 = none.
EX090 — Strongest result. What did Ruth call the strongest result? Rubric: 3 = Fernhill staff run processes confidently;; 2 = staff own it;; 1 = scripts;; 0 = none.

Synthesis

Small, tested and documented changes add up to identity management an organisation can run itself.

Continue studying — chapter 30 of 30

← Chapter 29 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →