ACIA Capstone study plan
ACIA Capstone · Give each week a clear focus.
8 weeks · About 6 hours per week
Governance, Risk, and Compliance Frameworks
Map each element of a chosen governance framework (e.g., NIST CSF, ISO 27001, or CIS Controls) to the ACIA GRC domain objectives
Draft a risk register with at least 10 realistic organizational risks, assigning likelihood, impact, and treatment options
Explain the difference between policies, standards, procedures, and guidelines using concrete examples
Identify three regulatory or contractual compliance drivers relevant to a mid-sized enterprise and summarize their key obligations
Your checkpoint
A one-page GRC summary that lists the framework mapping, a sample risk register excerpt, and the policy hierarchy with examples
Data Protection and Cryptography & Governance, Risk, and Compliance Frameworks
Compare symmetric and asymmetric encryption, hashing, and digital signatures, and select appropriate use cases for each
Describe key management lifecycle steps including generation, distribution, storage, rotation, and destruction
Classify data into at least three sensitivity tiers and propose controls for each tier
Relate data protection requirements back to the governance policies drafted in Week 1
Your checkpoint
A data classification and cryptography cheat sheet that maps each data tier to encryption, hashing, and key management controls
Identity and Access Management & Network and Infrastructure Security
Diagram an identity lifecycle from provisioning through deprovisioning, including joiner-mover-leaver scenarios
Compare authentication factors and select MFA approaches for privileged and non-privileged users
Outline network segmentation, firewall rule design, and secure remote access principles
Identify common IAM and network misconfigurations and propose preventive controls
Your checkpoint
An identity and network security reference diagram with annotations for at least five controls and three common misconfigurations
Cloud and Virtualization Security & Network and Infrastructure Security
Explain the shared responsibility model for IaaS, PaaS, and SaaS and assign security tasks to provider versus customer
Describe virtualization security risks such as hypervisor escape, VM sprawl, and snapshot exposure
Design a secure cloud landing zone concept including network, identity, and logging baselines
Evaluate at least three cloud configuration hardening checks against a public benchmark
Your checkpoint
A cloud and virtualization security checklist covering shared responsibility, hardening, and logging, with a completed sample assessment for one workload
Threat Detection and Incident Response & Vulnerability Management and Secure Development
Build an incident response playbook outline for a ransomware scenario covering detection, containment, eradication, recovery, and lessons learned
Map log sources to detection use cases and describe how to tune alerts to reduce false positives
Outline a vulnerability management lifecycle from discovery through remediation and verification
Integrate secure development practices such as threat modeling and code review into a release process
Your checkpoint
An incident response playbook for one scenario plus a vulnerability management workflow diagram with remediation SLAs
Security Architecture and Engineering & Vulnerability Management and Secure Development
Apply defense-in-depth and zero trust principles to a reference architecture for a web application
Describe secure design patterns including least privilege, separation of duties, and fail-safe defaults
Perform a lightweight threat model for a sample application using STRIDE or an equivalent method
Identify security requirements to embed in the software development lifecycle
Your checkpoint
A threat model document for a sample web application with at least eight identified threats and corresponding mitigations
Governance, Risk, and Compliance Frameworks & Identity and Access Management & Network and Infrastructure Security & Cloud and Virtualization Security & Data Protection and Cryptography & Threat Detection and Incident Response & Vulnerability Management and Secure Development & Security Architecture and Engineering
Review weak areas from Weeks 1 through 6 and create a prioritized remediation study list
Complete 40 mixed practice questions spanning all domains and record rationale for each answer
Reconcile conflicting controls across domains, such as encryption versus logging versus access needs
Summarize each domain in a single page of key concepts and decision points
Your checkpoint
A one-page-per-domain summary set plus a scored practice log showing at least 75% accuracy across the 40 questions
Capstone Integration and Case Analysis & Governance, Risk, and Compliance Frameworks & Threat Detection and Incident Response
Analyze two end-to-end case scenarios that integrate governance, technical controls, and incident response
Produce written recommendations that justify trade-offs among risk, cost, and compliance
Simulate a timed capstone assessment and review every incorrect item
Finalize a personal exam-day strategy covering question triage and time allocation
Your checkpoint
Two written case analyses with recommendations and a timed practice exam score report demonstrating at least 80% overall
Milestones
Week 2: Complete the GRC summary and cryptography cheat sheet, and score at least 70% on a 20-question quiz covering Domains 1 and 5
Week 4: Submit the identity and network diagram and the cloud security checklist, and explain the shared responsibility model in a five-minute recorded summary
Week 6: Deliver the incident response playbook, vulnerability workflow, and threat model, and pass a 30-question mixed quiz with at least 75%
Week 8: Complete both case analyses and achieve at least 80% on the timed capstone practice exam while finishing within the time limit