Write the responsibility matrix for one service and find what nobody owns

applied · 80 min · Objective 4.2

Task

Take one service you actually depend on, write the full responsibility matrix, and identify every row where the owner is unclear -- because the rows nobody owns are where the incidents come from.

Steps

  1. Choose one service and record it, its model and the URL of its published responsibility documentation in lab/matrix/service.csv with header field,value.
  2. Write lab/matrix/rows.csv with header area,provider,customer,evidence,confidence with at least fifteen areas -- physical security, hypervisor, guest operating system, runtime, application code, data, identity, access review, encryption keys, network controls, logging, backup, retention, incident response and client devices.
  3. Mark confidence as documented, inferred or unclear on every row, citing the documentation only where it actually says so.
  4. Write lab/matrix/gaps.md for every row marked unclear, stating what question you would ask the provider and what you would do while waiting for the answer.
  5. Write lab/matrix/incident.md describing one realistic incident that would arise from one of your unclear rows, and who would be accountable.

Verify

awk -F, 'NR>1 && NF>=2 {n++} END {print n" service field(s)"}' lab/matrix/service.csv
awk -F, 'NR>1 && NF>=5 {n++} END {print n" responsibility area(s)"}' lab/matrix/rows.csv
awk -F, 'NR>1 && tolower($5)=="documented" {n++} END {print n+0" documented"}' lab/matrix/rows.csv
awk -F, 'NR>1 && tolower($5)=="unclear" {n++} END {print n+0" unclear"}' lab/matrix/rows.csv
grep -c . lab/matrix/gaps.md
grep -c . lab/matrix/incident.md

Fifteen or more areas with a confidence on every row, at least five documented and at least one unclear, plus both notes. A matrix with nothing marked unclear has been filled in from expectation rather than from the documentation.

Notes

The confidence column is what makes this honest. 'Inferred' is a legitimate answer and it is not the same as 'documented', and a matrix that does not distinguish them will be read as though every row was checked.

This is an independent study companion for CompTIA A+ Core 1 220-1201 and is not produced by or endorsed by CompTIA.