Chapter 27 — Deployment and validation | Technologist Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 27 — Deployment and validation

Lesson map

Lesson 27 published. Map, example, EX079.

flowchart TD
  N0["Learning outcomes"]
  N1["27.1 Deployment"]
  N2["27.2 Validation"]
  N3["27.3 Evidence"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX079"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["27.1 Deployment"]
  N2["27.2 Validation"]
  N3["27.3 Evidence"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX079"]

[Learning outcomes]
    |
    v
[27.1 Deployment]
    |
    v
[27.2 Validation]
    |
    v
[27.3 Evidence]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX079]

Learning outcomes

You will (1) deploy the standard clinic design at a new site; (2) validate controls before opening; (3) record validation evidence.

27.1 Deployment

The first new clinic is ready to open. Priya supports the deployment of the standard design: network segments, managed computers, card terminals on their own segment, guest Wi-Fi separated, imaging devices isolated and accounts created with end dates for temporary staff. She follows the onboarding checklist her team produced and records each completed step with the date and the person responsible. Recording who completed each step gives the validation in the next section a trail to check against. The checklist also lists who owns each control once the clinic opens.

27.2 Validation

Before the clinic opens, Priya validates key controls. She checks that guest Wi-Fi cannot reach clinic devices, that card terminals are on their segment, that reception computers are encrypted and lock correctly, that backups of the imaging archive run and that only authorised staff have accounts. One check fails: an imaging device was connected to the reception segment. The supplier corrects it and Priya retests successfully. An imaging device on the reception segment is exactly the spread path that the standard design's isolation is meant to block.

27.3 Evidence

Priya records validation results with screenshots and test notes in the evidence log, marking them with the clinic code and date. The operations manager approves opening based on the validation report. She learns that validation before go-live is much cheaper than fixing problems after patients arrive, and that a signed-off validation report gives management a clear basis for the decision to open. Marking evidence with the clinic code lets the new clinic's records be found alongside those of the other fourteen.

Worked example

Priya deploys the standard design at a new clinic, validates five controls, fixes a misplaced imaging device and records sign-off evidence.

Synthetic case. The deployment is synthetic.

Errors and limits

Validation is a snapshot. Suppliers may reconnect devices later.

Exercises

EX079 — Failed check. Which validation check failed? Rubric: 3 = an imaging device on the reception segment;; 2 = imaging;; 1 = vague;; 0 = none.
EX080 — Approval basis. On what basis did the operations manager approve opening? Rubric: 3 = the validation report;; 2 = report;; 1 = vague;; 0 = none.
EX081 — Pre-opening value. Why validate before opening? Rubric: 3 = fixing problems before patients arrive is cheaper;; 2 = cost;; 1 = vague;; 0 = none.

Synthesis

Validating controls before go-live gives management a clear, evidence-based basis to proceed.

Continue studying — chapter 27 of 30

← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →