Home labs & practical projects
Prioritise a security improvement plan
A project to do with your own tools, with guidance on what to create and capture.
What you could create
A growing business can fund only two of four security initiatives this quarter. Management needs a defensible choice connected to business objectives.
| Improvement | Business reason | Measure to consider |
|---|---|---|
| Review privileged access | Reduce unnecessary access to critical services | Unnecessary privileges removed and exceptions reviewed |
What you'll need
Fictional organisation profile
Choose a business goal, important services, a small security team and a fixed planning budget. State your assumptions.
Risk and control inventory
Describe five plausible risks, existing controls, owners and evidence gaps. Include at least one operational dependency.
Programme planning worksheet
Record estimated cost, staff effort, dependencies, milestones and measures of success for each proposed improvement.
Access & cost
No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.
The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.
Suggested milestones
- 1
Set the business priorities
Identify the services and outcomes the organisation needs to protect. State the decision authority and risk appetite you have assumed.
- 2
Compare improvement options
Assess benefits, effort and dependencies across your five risks. Separate the seriousness of a risk from how easy a control is to buy.
- 3
Build a feasible programme
Select work that fits the budget and staff capacity. Assign owners, milestones, useful measures and a route for escalating untreated risks.
- 4
Defend and revise the plan
Reduce your assumed budget by a quarter. Explain what you defer, the resulting exposure and what you need leadership to decide.
One example to adapt
| Improvement | Business reason | Measure to consider |
|---|---|---|
| Review privileged access | Reduce unnecessary access to critical services | Unnecessary privileges removed and exceptions reviewed |
Useful resources
Use these resources to deepen your understanding and check key details.
A useful starting point
Invent four initiatives: identity cleanup, recovery testing, awareness training and monitoring improvement. Give each a cost, owner, risk reduction hypothesis and dependency.
What a good result looks like
- The choice accounts for dependencies and operating capacity.
- Measures distinguish delivered activity from demonstrated risk reduction.
Finish the project
Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.
Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.