Choose a framework and write the statement of applicability

applied · 70 min · Objective 1.11

Task

Apply objective 1.11: make a framework selection with the decision recorded, then write the statement of applicability that makes a partial adoption defensible rather than dishonest.

Steps

  1. Write lab/framework-choice.md comparing at least three options against obligation, sector expectation, maturity and capacity, with a decision and the constraint that discriminated.
  2. Create lab/soa.csv with header control_ref,applicable,implemented,justification,evidence covering at least fifteen controls from the chosen framework.
  3. Mark at least four controls NOT applicable, each with a justification based on risk rather than on difficulty.
  4. For every applicable-and-implemented control, name the evidence -- a file, a command, a test from an earlier lab.
  5. Write lab/adoption-scope.md stating what is in scope, what is not, and the roadmap date for each excluded area.

Verify

awk -F, 'NR>1 {n++} END {print n" control(s) in the SoA"}' lab/soa.csv
awk -F, 'NR>1 && $2=="no" {n++} END {print n+0" not applicable"}' lab/soa.csv
awk -F, 'NR>1 && $2=="no" && $4=="" {n++} END {print n+0" excluded with no justification"}' lab/soa.csv
awk -F, 'NR>1 && $3=="yes" && $5=="" {n++} END {print n+0" implemented with no evidence"}' lab/soa.csv
grep -Eci 'obligation|sector|maturity|capacity' lab/framework-choice.md

Fifteen or more controls, four or more excluded, and ZERO exclusions without a justification or implementations without evidence. Those two zeros are what separate a defensible subset from a claim somebody can disprove in an afternoon.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.