Governance lab catalog

An edge firewall change made during a Friday outage exposed RDP on the jump host to the internet, and the emergency rule was never reverted. Close the exposure without cutting off the administrators who are legitimately using it.

2 controls · 2 objectives · target 25 min · foundation

Four accounts in the domain admins group have no named owner, two of them have not authenticated in over a year, and one is a service account with a password older than the policy allows. Reduce the privileged population without breaking the job that depends on it.

2 controls · 2 objectives · target 30 min · foundation

The hardened workstation baseline is applied to 96% of the estate. The missing 4% is the finance team, exempted for a spreadsheet add-in two years ago. Bring them back to baseline without breaking month-end.

2 controls · 2 objectives · target 35 min · practitioner

A marketing analytics vendor was given access to an object store six months ago, through a long-lived key pasted into a shared document. The bucket policy that was supposed to scope it allows list on the whole account. Cut the access back to what the contract actually needs, without breaking the reporting.

2 controls · 2 objectives · target 35 min · practitioner

The building management controllers share a broadcast domain with the corporate print VLAN because of a cabling decision made during a fit-out. A commodity worm on a printer would reach the controllers directly. Segment it without a change window that finance will refuse.

2 controls · 2 objectives · target 45 min · advanced

A build pipeline prints its environment on failure, and three months of failed builds sit in a log store half of engineering can read. One printed value is a production database password that still works. Rotate what leaked, purge the logs, and stop the pipeline printing secrets.

2 controls · 2 objectives · target 40 min · advanced

A red team reached domain admin in nine hours from a standard laptop, using no exploit. Your job is not to argue with the report: it is to break the path in the fewest changes that survive contact with the business, and to prove the path is broken.

2 controls · 2 objectives · target 60 min · expert

An auditor rejected eleven of your fourteen evidence artifacts. Every one of them is a screenshot taken the week before the audit. Rebuild the evidence so it demonstrates the control operated across the whole period.

2 controls · 2 objectives · target 25 min · foundation

Access reviews are performed once and mapped to four frameworks. Three of the four mappings claim a scope the review does not actually cover. Fix the mapping before an auditor finds it for you.

2 controls · 2 objectives · target 30 min · foundation

A subject access request arrives. The data map says customer records live in two systems. The request turns up copies in a support tool, an analytics warehouse and a spreadsheet on a shared drive. Answer the request and fix the map.

2 controls · 2 objectives · target 35 min · practitioner

Leadership wants a live compliance dashboard. The first draft reports 98% green because every automated check queries the configuration intent rather than the running system. Rebuild the checks so green means something.

2 controls · 2 objectives · target 40 min · practitioner

A critical vendor returned a perfect questionnaire. Their public attestation covers a different product line, their breach notification clause allows 90 days, and your own logs show them accessing production outside the agreed window. Assess them properly.

2 controls · 2 objectives · target 45 min · advanced

A nightly job deletes records older than 90 days. Litigation was filed six weeks ago covering one customer's records, and nobody told the platform team. Establish what was lost, stop the loss, and report it correctly.

2 controls · 2 objectives · target 45 min · advanced

The auditors are on site for five days. Three control owners are on leave, one evidence source was migrated last month and the old system is decommissioned, and a control you know failed in March is in the sample. Run the week without lying and without collapsing.

3 controls · 2 objectives · target 60 min · expert

Three concurrent signals, a phishing report, an EDR quarantine and a helpdesk ticket about a slow laptop, all point at the same user. Nobody has declared anything and it has been four hours. Decide, declare, and get the machinery running.

2 controls · 2 objectives · target 25 min · foundation

One workstation is confirmed compromised. The obvious move is to reimage it. The credential that was used on it also authenticates to eleven other hosts, and you do not yet know which of them the attacker touched.

2 controls · 2 objectives · target 30 min · foundation

The incident is likely to end in litigation and possibly in a regulator's inbox. Everything you collect from here has to be attributable, verifiable and unaltered — and the analyst who has been working the case has been copying files to a personal USB drive.

2 controls · 2 objectives · target 35 min · practitioner

Twenty-nine hours in, you have reason to believe personal data for roughly 40,000 customers was accessed. You do not yet know exactly which records. Legal wants certainty and the clock does not care. Communicate correctly, internally and externally.

2 controls · 2 objectives · target 40 min · practitioner

You contained, you cleaned and you restored. Nine days later the same actor is back through a persistence mechanism nobody looked for, and the restored systems came from a backup taken after the initial compromise. Run the second response and fix the reasoning that made the first one fail.

2 controls · 2 objectives · target 45 min · advanced

Encryption is spreading across the file estate. The on-call engineer has one hour before the finance systems are hit. Backups exist but the backup server authenticates with a domain account. Command the response.

2 controls · 2 objectives · target 50 min · advanced

A major incident closed three weeks ago. The draft post-incident review blames an analyst by name, lists eleven actions with no owners, and does not mention that the same failure occurred in two earlier incidents. Rewrite it into something that prevents the next one.

3 controls · 2 objectives · target 55 min · expert

Vet three sources reporting indicators for an active phishing wave against your sector. One has a two-year track record, one is a new community feed, one is an anonymous paste. The watchlist update is due in an hour. Grade each source, corroborate what you can, and admit only what earns its place.

2 controls · 2 objectives · target 25 min · foundation

Decide whether the intrusions hitting three of your suppliers are one campaign or copycats. The draft on your desk mixes corroborated facts with one analyst's guesses and quietly drops a dissenting report. Rebuild it so every sentence is labeled for what it is, and task collection for the gap that decides the question.

3 controls · 2 objectives · target 35 min · practitioner

Write the one-page warning product your executives asked for. Reporting suggests a ransomware crew will move against organizations like yours over the holiday window. Resist the pressure to sound certain. State your confidence, name the alternatives, and tell the reader what would change the judgment.

3 controls · 2 objectives · target 45 min · advanced