C-ACYFSW study plan

Map each element of the cyber resilience strategy lifecycle (govern, identify, protect, detect, respond, recover) to at least one real policy artifact you can name from memory.

Draft a one-page governance RACI that assigns accountability for risk acceptance, control operation, and incident escalation to named roles.

Explain in writing how risk appetite and tolerance statements translate into measurable control thresholds.

Build a qualitative risk register with five sample risks scored on likelihood and impact, including one risk above tolerance.

Perform a threat-modeling pass on a simple three-tier web application using STRIDE, producing one mitigation per identified threat.

Compare quantitative and qualitative risk analysis and justify when each is appropriate in a short written decision memo.

Describe how security architecture principles (defense in depth, least privilege, segmentation, fail-safe defaults) reduce residual risk in the modeled system.

Identify the control families that map to each STRIDE category and note gaps where no control currently exists.

Design a reference architecture for a hybrid environment that enforces zero-trust principles at the identity, device, and network layers.

Specify cryptographic protections for data at rest and in transit, including key management ownership and rotation intervals.

Define an identity lifecycle (joiner, mover, leaver) with authentication strength requirements and privileged access controls.

Classify sample data assets and assign handling requirements for each classification tier.

Configure or describe least-privilege role definitions for three job functions and document the access review cadence for each.

Outline network segmentation zones with allowed traffic flows and the monitoring points that detect lateral movement.

List endpoint hardening baselines and the detection telemetry each control produces for the SOC.

Write detection use cases for two identity-based attacks and map each to the log sources that would surface it.

Build an incident response playbook for a ransomware scenario covering detection, containment, eradication, recovery, and lessons learned.

Define severity tiers and escalation paths with decision authority and communication triggers for each tier.

Specify recovery objectives (RTO and RPO) for three critical systems and identify the backup and restoration method that meets each.

Draft the evidence-handling and chain-of-custody steps required during containment and forensic triage.

Conduct a tabletop exercise walkthrough of the week-5 playbook and record at least five gaps or decision delays.

Create a third-party risk tiering model and apply it to five hypothetical vendors with differing data access.

Draft contract security clauses covering breach notification timelines, audit rights, and subcontractor obligations.

Define continuous monitoring requirements for critical suppliers, including the evidence collected and review frequency.

Assemble an audit evidence package that maps at least ten controls to the artifacts that would prove they operate.

Design a security awareness campaign with measurable behavior outcomes and a phishing simulation feedback loop.

Assess risks introduced by generative AI use in the workforce, including data leakage and acceptable-use controls.

Evaluate emerging technology adoption (cloud, OT, AI) against existing policy and list required policy updates.

Synthesize the prior seven weeks into a single resilience narrative that connects governance, risk, architecture, operations, and response.

Complete a timed 60-question mixed-domain practice set and log every missed item by domain and root cause.

Re-teach the three weakest domains from memory in written summaries without notes.

Build a final one-page exam-day reference of decision rules, frameworks, and metric definitions.