Run an exception from request to expiry

applied · 60 min · Objective 1.1

Task

Apply the whole of objective 1.1: take a real non-compliance in your lab, process it as a formal exception with a compensating control, and prove the expiry mechanism actually closes it.

Steps

  1. Create lab/exceptions.csv with header id,scope,requirement,standard_ref,risk_accepted,property,compensating_control,owner,raised,expires,status.
  2. Raise one exception for a genuine deviation in your lab. scope must name exact systems, not a category; property must be one of confidentiality, integrity or availability.
  3. Implement the compensating control for real and record how you would evidence it -- a command, a config export, a log query.
  4. Add three more exceptions with expiry dates in the past, to simulate an inherited register.
  5. Write lab/expire-exceptions.sh that reads the file, compares expires against today, and exits non-zero listing any row that is past expiry and not status=closed. Run it.

Verify

awk -F, 'NR>1 && NF>=11 {n++} END {print n" exception(s)"}' lab/exceptions.csv
awk -F, 'NR>1 {print $6}' lab/exceptions.csv | sort -u | tr '\n' ' '
sh lab/expire-exceptions.sh; echo "expiry check exit=$?"
awk -F, 'NR>1 && $7=="" {n++} END {print n" with no compensating control"}' lab/exceptions.csv

Four or more exceptions, every property one of the three, and the expiry script exiting NON-ZERO with the three stale rows named. A script that exits zero on a register containing expired exceptions is the defect the lesson describes.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.