Plan criteria and evidence

Objectives

Write the agreed plan as YAML Ain’t Markup Language (YAML), a structured text format. These exact fixture values encode one engagement, not a universal audit template.

Passing validates the plan fields only. It does not establish that data was collected or that the control passed.

April production departures: 12 records. Criterion: AC-4 version 3, access removed within 24 elapsed hours of HR effective departure. Use HR export and identity provider event export, reconcile population completeness, compare in UTC. Inspect all 12 as a census. Retain source IDs in restricted storage.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Bound the April population

   Use April and production departures, not all access activity.

   Bound the April population

2. Step 2

   Record the applicable requirement

   Use AC-4 version 3 and the 24-hour deadline.

   Record the applicable requirement

3. Step 3

   Pair and reconcile the source records

   Compare HR departure times to identity provider disable events in UTC and reconcile the population.

   Pair and reconcile the source records

4. Step 4

   Test the complete small population

   Inspect all 12 records as a census.

   Test the complete small population

5. Step 5

   Preserve traceability and restrict access

   Retain source identifiers and store personal records with restricted access.

   Preserve traceability and restrict access

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.