CYBRARY Program catalog
Governance & audit labs
Assessment the way it actually runs — test a control against its stated design, produce artifacts a third party can re-run, and turn findings into rated, owned, dated risk decisions.
11 labs across 4 stages. Prerequisites are advice, not a lock — you can open any lab, but the ones listed underneath it are what it assumes.
1 · Controls and evidence
What a control claims, how you test it, and what counts as evidence.
- sec-101The management port that came back40 min
Audit and control evidence · Control assurance
T1021.001 Remote Services: RDPT1078 Valid Accounts
- sec-102Privileged accounts nobody owns40 min
Audit and control evidence · Control assurance
T1078 Valid AccountsT1490 Inhibit System Recovery
- cmp-101The evidence that proves nothing40 min
Audit and control evidence · Risk and policy governance
T1562.002 Impair Defenses: Disable Windows Event Logging
2 · Monitoring assurance
A logging or detection control is only assured when you can show it collects, matches and notifies.
- dr-101Truth, reach and align30 min
Control assurance
- dr-102Logic that never matched30 min
Control assurance
- dr-103Notification that never sent30 min
Control assurance
3 · Risk and incident governance
Findings become risk decisions; incidents become regulatory clocks.
- cmp-201Continuous control monitoring, honestly45 min
Audit and control evidence · Risk and policy governance
T1562.002 Impair Defenses: Disable Windows Event Logging
Assumes first:
- ran-410 — Continuous monitoring is the after-action control uplift, kept honest between incidents.
- ag-l20-full-shift — Agent autonomy is a control that has to keep proving itself between shifts, not once at the capstone.
- ir-201The 72-hour clock45 min
Incident triage · Evidence handling · Risk and policy governance
T1070 Indicator Removal
Assumes first:
- ran-401 — The regulatory clock only makes sense once you have run the recovery room it runs alongside.
4 · Assessment capstones
Run an assessment end to end, including the recovery control that only a control test can settle.
- cmp-301Capstone — fieldwork week60 min
Audit and control evidence · Risk and policy governance
T1562.002 Impair Defenses: Disable Windows Event Logging
- ir-301Capstone — the review that changes something60 min
Incident triage · Evidence handling · Risk and policy governance
T1070 Indicator Removal
Assumes first:
- ag-l20-full-shift — The morning-after review only changes something when you have held the shift it reviews.
- ran-101Backup control testing under assessment45 min
Recovery operations · Continuity planning
T1490 Inhibit System RecoveryT1485 Data DestructionT1562 Impair Defenses