IIBA CCA case studies

IIBA CCA · Put your knowledge to work in context.

The Certificate in Cybersecurity Analysis (IIBA-CCA) is one of the specialized credentials in IIBA's certification portfolio, listed on iiba.org alongside the Agile Analysis Certification (AAC), the Certification in Business Data Analytics (CBDA) and the Certificate in Product Ownership Analysis (CPOA). IIBA positions its seven certifications as a ladder running from foundational to specialized, with the ECBA, CCBA and CBAP covering core business analysis at entry, experienced and advanced levels, and the specialized certificates letting practitioners deepen expertise in a particular domain. The IIBA CCA case studies are 5 cases and about 4,099 words.

Segmentation Requirements Under a 90-Day Insurer Deadline at a Water Utility

NorthBridge Water Utility operates 14 treatment plants on a flat OT network with 1,200 programmable logic controllers and 60 Windows Server 2008 HMIs. An insurer-sponsored penetration test showed that a compromised business laptop could reach the plant historian in three hops, and that one shared local administrator password is used on every HMI.

814 words, about 4 min 2

MFA Mandate Meets Shared Shift Accounts and a Legacy Payroll Application

Halcyon Retail (2,300 employees, 180 stores) is moving its POS back office and HR systems to a SaaS provider. The security team's draft requirement reads: "all users must use MFA for all systems." Elicitation reveals that 900 seasonal store associates share 12 generic shift accounts on the POS back office; 40 HR staff access the HR system from personal phones; a 2009 payroll application authenticates against Active Directory over NTLM and cannot be changed before the vendor's 2027 roadmap; and an offshore contact-centre outsourcer with 300 agents needs the customer-service console with a contractual 15-minute onboarding SLA at peak.

783 words, about 4 min 3

Detection Requirements After a Missed Mailbox Forwarding Rule

At 02:14 a finance analyst's mailbox began auto-forwarding invoice PDFs to an external Gmail address. The rule was discovered 11 days later when a supplier called about an unpaid invoice.

832 words, about 4 min 4

Thirty-Day Identity Integration After an Acquisition

Corvus Logistics is acquiring a 400-person regional carrier. Migration onto Corvus's identity tenant is scheduled in 30 days, driven by the acquisition agreement.

796 words, about 4 min 5

Reconciling Retention Obligations for a Patient Portal Vendor

Medway Health's patient check-in portal, built and hosted by a third-party SaaS vendor, handles 45,000 appointments a month. A privacy impact assessment found the vendor stores application logs containing patient identifiers in a US region, while Medway's policy requires Canadian residency for personal health information.

874 words, about 4 min