Capstone: ship a complete control package

Objectives

Change management is the weakest control in the programme. The engineering manager wants it "documented properly": a Word page saying that changes are reviewed.

Assemble the whole package instead: identity and ownership, a testable assertion with a re-runnable evidence query, framework mappings, a test plan, and an exception rule. This capstone folds together everything the Foundations track has covered.

Control under construction: every change merged to main is
approved by someone other than its author before it deploys.

Systems: github-api (pull requests, reviews), argo-api (deploys)
Teams: platform-security, internal-audit, control-owners

Framework identifier options seen in this programme:
  soc2:      CC6.6, CC7.2, CC8.1
  iso27001:  A.5.17, A.8.32, A.8.9
  nist80053: IA-2, CM-3, AC-6

Change volume last quarter: 8142 merges (the API returns all of them).
Test methods: population | random_sample | judgemental
Rating/frequency vocabulary: daily, weekly, monthly, quarterly, annually

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Re-read the brief and name the trap

   "Documented properly" is the failure mode this track exists to fix. A documented control with no assertion, no query and no test plan is a claim, and claims are what auditors go looking behind.

   Work the package top to bottom; each section is one habit from an earlier room.

2. Step 2

   Identity, ownership, cadence

   Give the control an uppercase hyphenated id that will survive rewording, an owner that is a durable team handle from the fixture, and a cadence drawn from the fixed vocabulary at the bottom of the fixture.

   Given the change volume, ask how often this control can meaningfully run.

   Stable id, team owner, enum frequency

3. Step 3

   Assertion and evidence

   The assertion must be a condition over something countable, and it must encode the property that makes the control worth having: that the approver and the author are not the same person.

   The evidence field must let someone regenerate the answer next quarter from the systems named in the fixture, not prove that someone once looked at a screen.

   Assertion is testable and mentions independenceEvidence is a re-runnable query

4. Step 4

   Map to the right requirements

   Three frameworks, one identifier each, chosen from the options. Ask what this control enforces, change authorisation, and reject the options that concern authentication strength or privilege minimisation.

   Mapped to the change-management identifiers

5. Step 5

   Plan the test

   When the population is retrievable in full, the method is not a sampling method and the sample size is not a round number. State a pass criterion with a threshold rather than an adverb.

   Test plan covers the full population with a hard criterion

6. Step 6

   Bound the exception

   An unbounded standing exception is an exemption, and it removes the control. Rewrite the rule so any bypass is time-limited, recorded, and reviewed by someone other than the person who used it.

   Exceptions are bounded and recorded

Rules summary

• XP on pass

  60 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 15 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.