Skip to main content
Joe C. Hawley · ResearchCybersecurity governance, risk, and value
By Joe C. HawleyUpdateCybersecurity Value

Evaluating Project 002 Without Participants

I dropped data collection from people for Project 002. The framework will be evaluated through requirements testing, comparative analysis, and a test against public material.

I dropped data collection from people for Project 002, at least for now.

Why

The practicum can be completed without it. Removing participants also removes the need for IRB review, and it keeps any workplace context out of the research data entirely.

What Replaces It

Framework v0.4 is evaluated without participants:

  • Requirements testing: I walk each synthetic case through the framework and score it against the design requirements.
  • Comparative analysis: I map the framework against NIST SP 800-55, FAIR, COBIT 2019, and the Balanced Scorecard to see what each covers that the others do not.
  • Public-material test: I apply the Value Record and evidence tiers to public cybersecurity disclosures and program reports.

The former hypotheses are now design propositions, argued from literature and public evidence rather than tested with people.

Later

If the practicum instructor requires a practitioner panel, I can add one. IRB review would come first.