Domain 1 capstone: the governance pack, end to end

capstone · 150 min · Objective 1.11

Task

Assemble everything domain 1 produced into one coherent pack, and then find its internal contradictions -- because a set of individually correct documents that disagree with each other is the state most real organisations are in.

Steps

  1. Write lab/governance-pack.md indexing every artefact: policy set, standards, procedure, exception register, RACI, CMDB, reconciliation, control matrix, statement of applicability, classification table, risk register, ALE sheet, supplier assessment, STRIDE output, attack surface count, architecture findings, CSF profile.
  2. Run a consistency pass and record every contradiction in lab/contradictions.csv as artefact_a,artefact_b,contradiction,resolution. Look specifically for: an asset in the CMDB absent from the surface count, a control in the matrix with no standard requiring it, a risk with no owner in the RACI, a classification tier no asset uses, an exception for a standard that no longer says that.
  3. Resolve at least four contradictions by amending the artefacts, and record which document won in each case and why.
  4. Write lab/board-report.md in one page: risk against appetite, trend against target, obligations and their status, and the two or three decisions you need from the board. No activity counts.
  5. Write lab/review-cycle.csv giving every artefact a review period, an owner and a next-review date, plus the EVENTS that force an out-of-cycle review.

Verify

grep -Ec 'lab/' lab/governance-pack.md
awk -F, 'NR>1 {n++} END {print n" contradiction(s)"}' lab/contradictions.csv
awk -F, 'NR>1 && $4!="" {n++} END {print n+0" resolved"}' lab/contradictions.csv
grep -Eci 'appetite|target|obligation|decision' lab/board-report.md
grep -Eic 'blocked|remediated|patches applied|alerts' lab/board-report.md
awk -F, 'NR>1 && NF>=4 {n++} END {print n" artefact(s) with a review cycle"}' lab/review-cycle.csv

Twelve or more artefacts indexed, four or more contradictions found AND resolved, a board report containing appetite, target, obligation and decision but ZERO activity counts, and every artefact given a review cycle. If you found no contradictions, compare the CMDB against the surface count line by line -- they are almost never consistent on a first pass.

Notes

Keep the contradictions file. It is the most useful single artefact in this domain: it is the evidence that the governance set is maintained rather than merely written, and a future reviewer can see what was reconciled and when.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.