ACIA Capstone case studies
ACIA Capstone · Put your knowledge to work in context.
The ACIA Capstone is an advanced, integrative certification exam for security practitioners who already hold foundational knowledge and want to demonstrate that they can reason across domains rather than recite isolated facts. It is aimed at analysts, engineers, architects, and consultants preparing for senior or cross-functional roles, and at candidates who want a single credential that reflects end-to-end judgment. The ACIA Capstone case studies are 5 cases and about 2,905 words.
1Third-Party Risk and Contractual Gaps in a Payment Processor Acquisition
A mid-sized payment processor, PayFlow, has just acquired a smaller competitor, QuickPay. During integration, the security team discovers that QuickPay's cardholder data environment (CDE) relies on a third-party tokenization service, TokenSafe, which is not PCI DSS certified.
612 words, about 3 min2Identity Federation and Least Privilege in a Multicloud Environment
A financial services company, FinCorp, uses a multicloud strategy with AWS and Azure. They have 5,000 employees and 2,000 external partners who need access to specific applications.
581 words, about 3 min3Segmentation and Lateral Movement in a Hybrid Network
A healthcare provider, HealthNet, has a hybrid network with on-premises data centers and AWS cloud. The on-premises network uses a flat VLAN for all servers (500 servers) and workstations (2,000).
513 words, about 3 min4Data Encryption and Key Management in a SaaS Startup
A SaaS startup, CloudDocs, provides document collaboration services to 10,000 businesses, including healthcare and financial clients. CloudDocs stores customer data in AWS S3 and uses AWS KMS for encryption at rest.
571 words, about 3 min5Incident Response and Forensic Challenges in a Ransomware Attack
A manufacturing company, BuildCo, suffered a ransomware attack that encrypted 80% of its servers, including ERP and CAD systems. The attackers gained initial access via a phishing email, then moved laterally using stolen credentials.
628 words, about 3 min