At Bracken Research, all 240 employees completed annual security training, yet a suspicious invoice sat unreported for two days. A researcher moved into finance but kept laboratory administrator access. Meanwhile, a small document-processing supplier holds participant records through a subcontractor that procurement has never assessed.
The operations director calls these three problems a training gap. You must separate knowledge and behavior from access authorization and supplier governance. Build evidence that controls work at the moment risk changes, not merely that someone attended a course or signed a contract.
Trust is scoped, time-bound, and supported by evidence; it is not inherited from a job title or supplier logo.
Measure behavior, not just attendance
Awareness helps people recognize risks and know where to ask for help; training develops a specific skill through instruction and practice. A short reminder about suspicious invoices builds awareness. A finance exercise in verifying changed bank details teaches a task. Completion measures delivery coverage, not whether either intervention changes behavior. Tailor content to roles: finance needs payment verification, researchers need safe handling of participant data, and administrators need secure use of elevated access.
Bracken records 240 completions out of 240 assigned people: 100% coverage. In comparable simulations delivered to all 240, reports rise from 36 to 84, so the reporting rate rises from 15% to 35%. Unsafe interactions fall from 48 to 24, or 20% to 10%; median reporting time falls from 90 to 20 minutes. These indicate improvement, not proof that real attacks will fail. Keep message difficulty, population, delivery, and measurement windows comparable; track repeat patterns and actual incident reporting alongside simulation results.
An auditor asks for role assignments, overdue follow-up, exercise definitions, denominator rules, and evidence that weak results led to targeted coaching and a retest. Do not celebrate fewer incident reports without checking whether people stopped reporting. Avoid punitive leaderboards that discourage disclosure, limit access to individual results, and distinguish a test score from observed workplace practice. Give staff a fast reporting route and feedback so measurement itself supports safer behavior.
Screen appropriately and explain acceptable use
Background checks assess relevant pre-engagement information, such as identity, qualifications, or employment history, where lawful and proportionate to the role. They are not continuous authorization or a prediction of future honesty. Define role-based screening, appropriate legal basis and notices, restricted handling of results, retention, and a fair process for discrepancies. Local law may constrain criminal-record checks or timing; a universal demand for every available personal record is not a sound control.
Acceptable use defines permitted and prohibited use of organizational information and equipment: approved storage, personal use boundaries, credential sharing, reporting lost devices, and lawful monitoring notices. Acknowledgment records receipt and commitment, not comprehension or technical enforcement. For example, 30 new starters can all acknowledge a prohibition on personal file-sharing while a practical exercise reveals that six cannot identify approved storage. Pair the policy with guidance and preventive controls rather than treating the signature as a completed risk reduction.
Before sensitive access, Bracken verifies required screening and acceptable-use acknowledgment, or records an approved, time-limited exception with compensating restrictions where lawful. An auditor samples the screening decision, exception expiry, and access activation timestamps, without needing unrestricted copies of sensitive screening records. Common errors are collecting excessive personal information, retaining it indefinitely, and confusing a confidentiality agreement with permission to use every system.
Joiners, movers, and leavers need clocks
Joiners need an accountable manager, verified identity, role approval, required onboarding, and an activation time no earlier than the authorized start. Movers require reassessment of both new and old permissions: adding finance access while keeping research privileges creates accumulation. Leavers require revocation aligned to the effective departure time, with immediate coordinated action for high-risk departures. These are policy choices informed by risk and law, not one universal grace period for every organization.
Bracken's local baseline activates joiners at their approved start, removes incompatible mover rights by the role-change time, and disables leavers at the effective departure time. A departure effective at 16:00 with disablement at 16:45 creates 45 minutes of unauthorized exposure, even if a ticket closes the next morning. Compare effective event time, request time, and actual system execution time. Track the proportion meeting deadlines and the longest delay; a monthly average can hide a dangerous outlier.
Human resources supplies authoritative events, managers approve role needs, and system owners execute and verify changes. Revoke sessions, tokens, remote access, and local application accounts as well as the central login; transfer business records and recover devices without leaving a former worker's credentials active. An auditor reconciles workforce events against account inventories and samples actual revocation logs. A closed ticket is insufficient when an application still accepts a cached session.
Access lifecycle controls bind authorization to effective event times and verify execution.
Privileged access is a separate responsibility
Privileged users can change security settings, create accounts, or read data beyond ordinary role boundaries. Least privilege limits what a role can do; separation of duties prevents one person from completing incompatible steps without oversight. A finance clerk may prepare a payment but should not also approve it. A technically restricted role can still violate separation of duties if it includes both business actions.
Give administrators separate named daily-use and elevated identities, strong authentication, explicit approval, time-limited elevation where feasible, and logged privileged activity. If eight administrators each retain standing access for 168 hours a week, that represents 1,344 privileged account-hours. Limiting approved elevation to two hours each reduces that window to 16 account-hours, but does not establish that those 16 hours were used safely. Review session activity, unauthorized grants, and emergency access as well as duration.
Emergency access needs controlled storage, an accountable user, alerting, prompt post-use review, and credential rotation where appropriate. Never disguise a shared, unlogged emergency password as individual accountability. Auditors ask who approved elevation, which identity performed the action, whether approval expired, and whether movers lost old administrative rights. Training privileged users complements access restrictions; it cannot substitute for them.
Tier suppliers by exposure and manage the whole lifecycle
A third party is an external organization providing a service or handling access on your behalf. Inherent risk is exposure before considering safeguards; residual risk remains after assessed controls. Tiering determines how much review is warranted, not whether a vendor is good or bad. Consider data sensitivity and volume, read or write permissions, privileged connectivity, service criticality, and recovery alternatives. A low-cost processor holding 40,000 sensitive records can warrant a higher tier than an expensive supplier with no data or network access.
Before onboarding, inventory the service, name a business owner, assign a tier, and perform proportionate due diligence. A high-tier review might examine access design, incident history, recovery evidence, and assurance exceptions; a public-materials supplier may need a narrower review. Record findings, remediation, and authorized risk acceptance before allowing access. Contractual controls then define permitted processing, security requirements, incident notification times, subprocessors, audit or evidence rights, return or deletion, and exit assistance. A signed contract is an obligation, not proof of performance.
During service, monitor agreed evidence at a risk-based cadence and reassess when access, ownership, service scope, or incidents change. At exit, revoke integrations and tokens, reconcile retained data, obtain appropriate deletion or return evidence, and address backup retention and legal holds. Bracken sets quarterly reviews for its sensitive-data processor and a 24-hour incident notification requirement by contract; these are local requirements, not universal legal deadlines. Auditors trace a supplier from tier decision through approval, monitoring, exceptions, and verified exit rather than inspecting only the procurement signature.
Supplier governance continues through service changes, downstream dependencies, and exit.
Use assurance reports without outsourcing judgment
An assurance report is evidence about a defined scope, period, and criteria, not a universal safety certificate. A SOC 2 Type I report addresses control design at a specified date; Type II also addresses operating effectiveness over a period. Check the covered service and locations, report dates, opinion, exceptions, and complementary user entity controls your organization must operate. An ISO 27001 certificate also has a scope and validity period; neither document automatically covers every service a supplier sells.
If Bracken's processor supplies a Type II report ending six months ago, determine whether the relevant service was included and evaluate subsequent changes and incidents. A bridge letter can describe the intervening period but does not provide the same independent testing as a new report. If access-review testing found three late reviews in a sample of 25, examine impact, affected access, remediation, and whether compensating controls address the actual exposure. Do not convert a favorable overall opinion into permission to ignore exceptions or your own required controls.
A fourth party is a supplier's supplier involved in delivering your service, such as the processor's hosting or support provider. Maintain visibility into material downstream providers, their data access and locations, notification or approval arrangements, and concentration dependencies. Reports may include subservice controls or carve them out, leaving those controls outside the examination. Ask who obtains the missing evidence and manages findings. Your direct supplier remains accountable under the contract, but that does not eliminate downstream exposure or your responsibility to decide whether remaining risk is acceptable.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The perfect dashboard
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
The training lead labels 100% course completion 'proven effectiveness'. In a comparable simulation, 84 of 240 recipients notify the security team, while the median delay from delivery to notification is 20 minutes. A manager calls that delay the completion rate and wants to remove it from the dashboard.
1.1What metric is 84 divided by 240 measuring? (two words)
1.2What timing metric captures the delay before notification? (two words)
Task 2: A promotion with baggage
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
Mira transfers from research to finance at noon. Her old administrator permissions remain active, but her manager calls this a joiner event because the finance account is new. The proposed fix restricts her to necessary finance functions; a colleague incorrectly calls that fix background screening.
Term bank, not all of these are right
moverleast privilegejoinerbackground screeningseparation of duties
2.1Which workforce lifecycle category applies to Mira? (one word)
2.2Which principle limits access to what the current role needs? (two words)
Task 3: The cheap processor
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
A low-fee processor receives sensitive participant records. Procurement calls checking its controls before approval 'offboarding' and assigns low risk solely because the fee is small. The processor delegates storage to an external hosting provider; its manager insists this organization is a Bracken employee, not a downstream dependency.
Term bank, not all of these are right
due diligencefourth partyoffboardingfirst partyrisk acceptance
3.1What is the pre-approval assessment of supplier controls called? (two words)
3.2What relationship term describes the processor's hosting provider from Bracken's perspective? (two words)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
Bracken's manager proposes waiting for monthly account reviews to remove old rights and treating every inexpensive vendor as low tier. Translate the mandatory baseline below into a policy artifact instead.
Fill the YAML using the exact fixture values. This evaluates a declared specification, not live identity systems or supplier enforcement.
Mandatory local baseline
awareness: measure reporting_rate and median_reporting_minutes, not completion alone
joiner activation: approved_start
mover old-right removal: role_change
leaver revocation: departure_time
privileged access: separate_identity and time_limited must both be true
supplier: participant-record processor has high tier; review every 90 days
supplier exit: revoke_access and verify_data_disposition must both be true
Review six independent assertions against Bracken's baseline. Reject only the stated failures; do not invent missing facts for evidence that satisfies its narrow claim.
The baseline requires behavioral evidence beyond completion, leaver revocation at departure, tiering by data and access, and assurance scoped to the actual service including material downstream dependencies. Use one closest reason for each rejection.
Verdicts are accept or reject. Every rejection needs one reason code from: coverage-not-effectiveness | late-revocation | fee-based-tiering | assurance-scope-gap.
Independent evidence assertions
PPT-1 | The effectiveness claim cites only 100% annual course completion; no behavior or skill evidence exists.
PPT-2 | A leaver's access and sessions remained usable for 45 minutes after effective departure. The ticket was eventually closed and called timely.
PPT-3 | A supplier reading sensitive participant records is classified low tier solely because its annual fee is small.
PPT-4 | A report covers a different service and carves out a material hosting provider. Procurement claims it fully assures the purchased processing service and host without further evidence.
PPT-5 | The improvement claim compares the same exercise difficulty and recipient population: reporting rises from 15% to 35% and median reporting time falls from 90 to 20 minutes. The team records limitations and targeted follow-up.
PPT-6 | The exit claim links the termination date to disabled integrations, revoked tokens, verified return and deletion records, and documented backup expiry and legal-hold restrictions.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · GRC Fundamentals
Foundations Capstone
Pull the whole fundamentals track together on one startup: risks, obligations and recovery targets drive a SOC 2 scope, a control set two people can run, and an evidence plan.
