CSSLP & ISACA Advanced Labs

🎯 Goal: Click "Security Requirements" toolbar button to open modal and define authentication, authorization, data protection, and compliance requirements.

📝 Why This Matters: CSSLP Domain 3 (Secure Software Requirements) requires defining security early. Requirements drive architecture, implementation, and testing decisions.

💻 Actions:
1. Click "Security Requirements" button
2. Authentication: Select Multi-Factor Authentication (MFA) Required
3. Authorization: Select Role-Based Access Control (RBAC)
4. Session: Select 15-minute idle timeout
5. Data Protection: Select AES-256 encryption at rest, TLS 1.3 in transit
6. Audit Logging: Select All authentication, authorization, and data access events
7. Compliance: Check PCI DSS 4.0 and SOC 2 Type II
8. Click "Save Requirements"

Dashboard will show Requirements Status = Defined.

🎯 Goal: Click "Architecture Design" to define security architecture patterns.

📝 Why This Matters: CSSLP Domain 4 (Secure Software Design) covers threat modeling, defense-in-depth, secure design patterns. Architecture determines attack surface.

💻 Actions:
1. Click "Architecture Design"
2. Pattern: Select Layered Architecture with DMZ
3. Authentication: Select OAuth 2.0 + OpenID Connect
4. Secrets Management: Select HashiCorp Vault
5. API Security: Select API Gateway with rate limiting and WAF
6. Database: Select Encrypted database with TDE
7. Threat Model: Select STRIDE analysis completed
8. Click "Save Architecture"

Dashboard will show Architecture Status = Designed.

🎯 Goal: Use git commands in terminal to configure branch protections, signed commits, and security policies.

📝 Why This Matters: CSSLP Domain 7 (Secure Operations) covers supply chain security. Repository controls prevent unauthorized code changes.

Terminal Commands (execute in order):

First, enable branch protection for main branch:
git config branch.main.protected true

Then require signed commits for integrity:
git config commit.gpgsign true

Finally, enforce code review requirement:
git config branch.main.requiredApprovals 2

Each command confirms with "Configuration updated" message.

🎯 Goal: Click "Run Security Scans" to execute static (SAST) and dynamic (DAST) application security testing.

📝 Why This Matters: CSSLP Domain 6 (Secure Software Testing) requires automated security testing. SAST finds vulnerabilities in code, DAST tests running application.

💻 Actions:
1. Click "Run Security Scans" in toolbar
2. SAST tool will analyze code and show findings panel
3. Review critical/high findings (SQL Injection, XSS, etc.)
4. DAST simulation will test API endpoints
5. Verify scan completion in dashboard

The proprietary SonarQube-style interface will display vulnerabilities by severity with remediation guidance. Dashboard shows Scans Status = Complete with findings count.

🎯 Goal: Establish objective criteria to evaluate and prioritize IT investments.

📝 Why This Matters: CGEIT Domain 2 (IT Resources) emphasizes value-based investment decisions. Scoring criteria enable data-driven portfolio optimization aligned with business strategy.

💻 Actions:
1. Click "Scoring Criteria"
2. Strategic Alignment Weight: 30%
3. Financial ROI Weight: 25%
4. Risk Level Weight: 20%
5. Resource Availability Weight: 15%
6. Compliance/Regulatory Weight: 10%
7. Scoring Scale: Select 1-5 (1=Low Value, 5=High Value)
8. Approval Threshold: 3.5/5.0 minimum score
9. Click "Save Criteria"

Dashboard will show Scoring Model = Active.

🎯 Goal: Classify $50M budget across Run/Grow/Transform categories for balanced investment.

📝 Why This Matters: CGEIT Domain 3 (Benefits Realization) requires balanced portfolio. Run maintains operations, Grow improves capabilities, Transform enables innovation.

💻 Actions:
1. Click "Portfolio Categories"
2. Run the Business: $20M (40%) — Infrastructure, operations, maintenance
3. Grow the Business: $18M (36%) — Process improvements, efficiency gains
4. Transform the Business: $10M (20%) — Digital transformation, innovation
5. Compliance/Mandatory: $2M (4%) — Regulatory requirements
6. Target Mix Rationale: Balance stability (Run) with strategic growth (Grow/Transform)
7. Click "Set Portfolio Mix"

Dashboard shows Portfolio Balance chart.

🎯 Goal: Evaluate portfolio risk profile and optimize risk-return balance.

📝 Why This Matters: CGEIT Domain 4 (Risk Optimization) requires managing IT portfolio risk. High-risk projects need higher returns to justify investment.

💻 Actions:
1. Click "Risk Assessment"
2. Risk Tolerance: Select Moderate - Accept medium risk for strategic initiatives
3. High-Risk Projects: 4 projects ($8M total) with mitigation plans required
4. Medium-Risk Projects: 12 projects ($28M total) with standard controls
5. Low-Risk Projects: 9 projects ($14M total) with minimal oversight
6. Risk Concentration: Select No single project >15% of budget
7. Contingency Reserve: 10% ($5M) for risk mitigation
8. Click "Optimize Risk"

Dashboard displays Risk-Return Matrix.

🎯 Goal: Establish benefits tracking to demonstrate IT value delivery.

📝 Why This Matters: CGEIT Domain 3 (Benefits Realization) is 26% of exam. Tracking proves IT investments deliver promised value to business.

💻 Actions:
1. Click "Benefits Tracking"
2. Benefit Categories: Check all (Cost Reduction, Revenue Growth, Risk Mitigation, Compliance)
3. Measurement Approach: Select Quantitative metrics with baseline and targets
4. Tracking Frequency: Select Monthly for active projects, quarterly for post-implementation
5. Accountability: Select Business owner responsible for benefits realization
6. Reporting Format: Select Executive scorecard with RAG status
7. Review Process: Quarterly portfolio review with Steering Committee
8. Click "Enable Benefits Tracking"

Dashboard shows Benefits Realization status with sample projects tracked.

🎯 Goal: Define response strategy (Mitigate/Transfer/Accept/Avoid) for each critical risk.

📝 Why This Matters: CRISC Domain 3 (Risk Response & Reporting) is 32% of exam. Risk response strategy depends on risk level, cost-benefit, and risk appetite.

💻 Actions:
1. Click "Risk Response Planning"
2. Ransomware Threat: Select Mitigate - Implement EDR, backups, training
3. Third-Party Risk: Select Transfer - Cyber insurance + contractual liability transfer
4. Cloud Misconfiguration: Select Mitigate - CSPM tools + IaC scanning
5. Insider Threat: Select Mitigate - PAM, UEBA, DLP controls
6. Regulatory Non-Compliance: Select Mitigate - Compliance program + audits
7. Legacy System Risk: Select Accept - Document risk acceptance with compensating controls
8. High-Risk Vendor: Select Avoid - Terminate vendor relationship
9. Click "Save Strategies"

Dashboard shows Response Strategies = Defined.

🎯 Goal: Document detailed action plans with owners, timelines, budgets for risk mitigation.

📝 Why This Matters: Risk treatment plans operationalize risk response. Plans must have clear ownership, milestones, success criteria.

💻 Actions:
1. Click "Treatment Plans"
2. Ransomware Mitigation Plan:
- Owner: CISO
- Timeline: 90 days
- Budget: $500,000
- Actions: Deploy CrowdStrike EDR, implement 3-2-1 backup, phishing training
- Success Criteria: 99.9% endpoint coverage, 15-minute RPO, 50% reduction in phishing clicks
3. Cloud Security Plan:
- Owner: Cloud Architect
- Timeline: 60 days
- Budget: $200,000
- Actions: Deploy Prisma Cloud CSPM, enable AWS Security Hub, IaC scanning
- Success Criteria: Zero critical misconfigurations, 100% resource tagging
4. Click "Submit Plans"

Dashboard shows Treatment Plans = Active with progress tracking.

🎯 Goal: Define leading indicators that provide early warning of increasing risk exposure.

📝 Why This Matters: KRIs are predictive metrics. Unlike KPIs (lagging), KRIs warn BEFORE incidents occur. CRISC emphasizes continuous risk monitoring.

💻 Actions:
1. Click "KRI Configuration"
2. Cyber Attack KRI: Number of phishing attempts per week
- Threshold: Yellow at 50/week, Red at 100/week
3. Patch Management KRI: % critical systems unpatched >30 days
- Threshold: Yellow at 5%, Red at 10%
4. Vendor Risk KRI: % third parties without security assessment
- Threshold: Yellow at 20%, Red at 30%
5. Incident Response KRI: Mean Time to Detect (MTTD)
- Threshold: Yellow at 8 hours, Red at 24 hours
6. Compliance KRI: Number of open audit findings
- Threshold: Yellow at 5, Red at 10
7. Data Loss KRI: Number of DLP policy violations per month
- Threshold: Yellow at 20, Red at 50
8. Monitoring Frequency: Weekly automated reporting with monthly review
9. Click "Enable KRIs"

Dashboard displays KRI Status with current values and trend indicators.

🎯 Goal: Create board-level risk reporting with heat maps, trends, treatment status.

📝 Why This Matters: CRISC Domain 3 requires communicating risk to stakeholders. Board needs concise, visual, actionable risk reporting.

💻 Actions:
1. Click "Executive Reporting"
2. Report Audience: Select Board of Directors and Audit Committee
3. Report Frequency: Select Quarterly with ad-hoc for critical risks
4. Report Format: Select Dashboard with heat map + executive summary + trend analysis
5. Content Sections: Check all boxes:
- Risk Heat Map (Likelihood vs Impact)
- Top 10 Risks with Response Status
- KRI Scorecard with RAG Status
- Risk Treatment Progress
- Emerging Risks and Threats
- Cyber Insurance Status
6. Presentation Style: Select Visual dashboards with minimal text, business language
7. Distribution: Select Secure portal with access controls
8. Click "Generate Report Template"

System generates sample report preview. Dashboard shows Reporting Framework = Configured.