Skip to main content
Joe C. Hawley · ResearchCybersecurity governance, risk, and value
By Joe C. HawleyUpdateCybersecurity Value

Making Project 002 Role-Neutral

I narrowed Project 002 to a role-neutral scope. The study now asks which roles or capabilities perform validation and communication, instead of testing a specific role.

I narrowed the scope of Project 002 so the study is role-neutral.

What Changed

Earlier drafts of the framework included a hypothesis about a specific security role. I dropped it. Testing one role would have shaped the evaluation around that role before any evidence came in. The third research question now asks which roles or capabilities perform validation and communication effectively. It is exploratory, and I have no expected answer.

The framework (now v0.3) describes the work by capability rather than title: business relationship and trust for validation, and translation to executive language for communication. Where those capabilities sit is something the evaluation panel should show me.

Project 001 stays as background. It is not a source of hypotheses for this study.

A New Limitation

My own background could bias me toward role-based answers. I added that as a known limitation, with two mitigations. The evaluation prompts will ask who does the work before naming any role, and I will code answers to the third research question by capability first, then by role.