Choosing a Method and a First Framework for Project 002
I selected Design Science Research for Project 002, drafted framework v0.2 (the Realized Value Cycle), and reframed practitioner interviews as evaluation rather than discovery.
Security organizations report activity well: tickets closed, controls deployed, vulnerabilities patched. They struggle to show realized business value. Prevented loss is a counterfactual, and executives often see security work only through large initiatives or annual reporting. Project 002 addresses that problem, and I have now settled on how to approach it.
Method
I chose Design Science Research. The output of this project is a framework, and a framework has to be built and then tested, not only described. Design Science Research fits that shape. The work moves through problem definition, design objectives, framework design, demonstration on synthetic cases, evaluation, and communication.
Framework v0.2
The current draft is the Realized Value Cycle: Capture, Quantify, Validate, Communicate, Learn.
- Value Record: the unit of capture. Five required fields (Problem, Action, Outcome, Category, Tier), with a target of about five minutes per record.
- Evidence tiers: T1 Measured, T2 Modeled, T3 Attested, and T4 Unvalidated. Every record starts at T4. A T4 record is reported as pipeline, not realized value.
- Batch validation: business owners confirm records in reviews that already exist, not one record at a time. The framework should not add meetings.
Interviews as Evaluation
In Project 001, interviews were for discovery. In Project 002, they test the framework. A practitioner panel will review synthetic Value Records, assign categories and tiers, and rate how credible each claim would be to an executive.
Before I contact any panelist, I will confirm the practicum format and the IRB determination with my advisor. I expect an exempt determination, but I am not assuming it.
An Open Question
Project 001 asked how the BISO improves decision quality. Project 002 raises a related question: does proving value depend on someone holding a BISO title, or on a capability (translation and business trust) that can sit anywhere in an organization? The evaluation panel should help answer that.
Next Steps
Confirm the advisor and IRB gate, complete the literature review, and build the first set of synthetic Value Records.
Update (2026-10-30): Project 002 is now role-neutral. See Making Project 002 Role-Neutral.
Update (2026-10-30): Project 002 no longer collects data from people. See No-participant evaluation.