Case Studies

Case studies demonstrate how NUP has been applied in real-world projects across different industries and domains. These examples provide practical insights into implementing NUP practices effectively.

Identity and Access Management (IAM) Case Study

Context

Challenge

A healthcare organization needed to implement a comprehensive Identity and Access Management (IAM) solution that would:

• Centralize user authentication across 15+ applications
• Support role-based access control (RBAC) for 5,000+ users
• Meet HIPAA compliance requirements for audit logging
• Integrate with existing Active Directory infrastructure
• Support MFA for all clinical applications

NUP Application

Discovery Phase

Activities:

• Conducted 25+ stakeholder interviews
• Mapped customer journeys for 6 user personas
• Documented 150+ functional requirements
• Performed compliance gap analysis

Key Artifacts:

• Vision Document
• Requirements Specification
• User Journey Maps
• Risk Assessment

Design Phase

Activities:

• Created architecture decision records (ADRs) for 12 major decisions
• Developed threat model using STRIDE methodology
• Designed RBAC permission model
• Specified integration patterns

Architecture Decisions:

Development Phase

Sprint Structure:

• 2-week sprints
• 16 sprints total
• 4 major releases (quarterly)

Release Summary:

Verification Phase

Testing Activities:

• 95% unit test coverage
• 200+ integration tests
• Third-party penetration testing
• HIPAA compliance audit

Results

Lessons Learned

What Worked Well

1. Early Threat Modeling - Identifying security concerns in design phase prevented costly rework
2. Iterative Releases - Quarterly releases allowed for user feedback incorporation
3. Comprehensive Testing - High test coverage caught integration issues early
4. Stakeholder Engagement - Regular demos maintained stakeholder buy-in

What We'd Do Differently

1. Start MFA Testing Earlier - User acceptance of MFA required more iteration
2. More Automated Compliance Checks - Manual compliance verification was time-consuming
3. Earlier Performance Testing - Load testing in later stages found scaling issues

Healthcare Patient Portal Case Study

Context

Challenge

A healthcare provider needed to build a patient portal that would:

• Allow patients to view medical records
• Enable secure messaging with providers
• Support appointment scheduling
• Meet HIPAA and Section 508 requirements
• Integrate with existing EHR system

NUP Application

Discovery Phase Artifacts

User Personas:

Requirements Categories:

Functional Requirements: 85
- Authentication: 12
- Medical Records: 18
- Messaging: 15
- Scheduling: 20
- Notifications: 10
- Reports: 10

Non-Functional Requirements: 35
- Performance: 8
- Security: 12
- Accessibility: 10
- Availability: 5

Design Decisions

Testing Strategy

Results

• Launch: On-time delivery within 12-month timeline
• Adoption: 40% patient adoption within 6 months
• Satisfaction: 4.5/5 user satisfaction score
• Compliance: Passed HIPAA audit and 508 review

Financial Services API Platform Case Study

Context

Challenge

A financial services company needed to build an API platform that would:

• Expose banking services via RESTful APIs
• Support 10,000+ transactions per second
• Meet PCI-DSS Level 1 requirements
• Enable partner integrations
• Provide developer portal

Architecture Overview

NUP Practices Applied

Key Metrics

Related Resources

• RACI Example - Responsibility matrix
• V&V Plan Example - Verification plan
• Templates - Document templates
• Guidelines - Implementation guidance

Compliance

This section fulfills ISO 13485 requirements for management review (5.6), design and development records (4.2.4), and validation evidence (7.3.7), and ISO 27001 requirements for lessons learned (A.5.27), performance evaluation (9.1), and compliance with policies (A.5.36).

View full compliance matrix