Choosing a framework, testing design and operation, gathering evidence that holds up, and reporting a gap plan.
Sooner or later somebody asks whether your controls work — a customer, an auditor, a regulator, or your own board. Answering well means assessing design and operation against a standard, with evidence rather than assertions.
This course covers choosing between CIS, ISO 27001 and the NIST framework, the difference between a control that exists and one that operates, how to sample and evidence, and how to turn the result into a plan instead of a score.
4 lessons · 54 min
CIS to decide what to do, ISO 27001 to prove a programme exists, NIST CSF to have the conversation.
Two different tests: would it work if it ran, and did it run?
How to gather proof that survives challenge, and what a single failure in a sample means.
Turning findings into a sequenced plan rather than a maturity score nobody acts on.
Sign in and enrol to leave a review.
No reviews yet — be the first once you have worked through it.
2 min read
2 min read
2 min read
2 min read
What a test can and cannot tell you, how work is scoped and authorised, and how findings turn into fixes.
A methodical way through an application: mapping, authentication flows, access control and business logic.
Discovery, service enumeration, configuration weaknesses and proving that segmentation exists outside the diagram.