Home labs & practical projects

Prepare a control-assurance package for a small system

A project to do with your own tools, with guidance on what to create and capture.

Design project Suggested time: 2–3 hoursNo hardware required for the design

What you could create

A fictional system owner needs a structured assurance decision before a new internal service handles sensitive information.

Example evidence format

Project evidence map (example)

System boundary and control evidence matrixScope and inputs

Assurance decision briefing and action planDecisions and reasoning

Evidence record (example)

Evidence	What to capture
System boundary and control evidence matrix	Show the inputs, scope and decisions behind this record. Inherited controls have identified evidence owners.
Assurance decision briefing and action plan	Include the evidence supporting your conclusion. The package distinguishes assessed controls from planned improvements.

What you'll need

Document, spreadsheet or diagram tool

Define the system boundary, information types, stakeholders and three selected controls. Use an applicable public framework as a reference, without claiming formal authorisation.

Project record

Keep the working files for system boundary and control evidence matrix and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.

The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.

Suggested milestones

1
Plan and investigate
Document the boundary and responsibility for inherited versus local controls.
2
Develop your approach
Specify the evidence and assessment method for each selected control.
3
Verify and explain
Record deficiencies, remediation owners and the monitoring needed after the decision.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
System boundary and control evidence matrix
Show the inputs, scope and decisions behind this record. Inherited controls have identified evidence owners.
2
Assurance decision briefing and action plan
Include the evidence supporting your conclusion. The package distinguishes assessed controls from planned improvements.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your system boundary and control evidence matrix needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Define the system boundary, information types, stakeholders and three selected controls. Use an applicable public framework as a reference, without claiming formal authorisation.

What a good result looks like

Inherited controls have identified evidence owners.
The package distinguishes assessed controls from planned improvements.

Finish the project

Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.