Home labs & practical projects

Divide responsibility for a new SaaS service

A project to do with your own tools, with guidance on what to create and capture.

Design project Suggested time: 90–120 minutesNo hardware required for the design

What you could create

A department wants to upload customer records to a SaaS product. The procurement checklist wrongly assumes that the provider owns all security responsibilities.

Example evidence format

Project evidence map (example)

Shared-responsibility worksheetScope and inputs

Supplier due-diligence question setDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Shared-responsibility worksheet	Show the inputs, scope and decisions behind this record. Tenant configuration and user access have named customer owners.
Supplier due-diligence question set	Include the evidence supporting your conclusion. Data deletion and service exit are addressed.

What you'll need

Document, spreadsheet or diagram tool

Invent a SaaS service description, data categories and a simple contract summary. Use public cloud security guidance to frame questions, without assuming contractual guarantees.

Project record

Keep the working files for shared-responsibility worksheet and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.

The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.

Suggested milestones

1
Plan and investigate
Map the customer, provider and shared responsibilities.
2
Develop your approach
Identify questions about identity, data lifecycle, incident response and exit.
3
Verify and explain
Write a go/no-go recommendation with unresolved evidence clearly separated.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Shared-responsibility worksheet
Show the inputs, scope and decisions behind this record. Tenant configuration and user access have named customer owners.
2
Supplier due-diligence question set
Include the evidence supporting your conclusion. Data deletion and service exit are addressed.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your shared-responsibility worksheet needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Invent a SaaS service description, data categories and a simple contract summary. Use public cloud security guidance to frame questions, without assuming contractual guarantees.

What a good result looks like

Tenant configuration and user access have named customer owners.
Data deletion and service exit are addressed.
Unknown provider capabilities remain questions rather than asserted facts.

Finish the project

Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.