Cybersecurity GRC

A complete, audit-ready ISO/IEC 27001:2022 risk assessment and Statement of Applicability for Stark Industries Inc., a fictional SaaS marketing platform hosted on AWS. Covers Clauses 6.1.2 and 6.1.3 in full: five-asset inventory with CIA ratings, five risk scenarios scored on a 5×5 likelihood-impact scale, a risk treatment plan with selected Annex A controls, and a full 93-control SoA with applicability justifications and exclusion rationale. Residual risk is scored post-treatment and presented for management sign-off.

A complete AI governance blueprint for a composite energy-sector enterprise. Covers governance structure and RACI accountability, a standards crosswalk across NIST AI RMF, ISO/IEC 42001, and the EU AI Act, a ten-entry scored risk register, and a four-quarter phased implementation roadmap. Demonstrates how named frameworks translate into an operating committee, a control set, and a risk register a real organization could adopt.

A threat model for a specific, named LLM-based customer support copilot deployed by a composite utility enterprise. Applies a four-pillar taxonomy mapped to OWASP LLM Top 10 2025 and MITRE ATLAS. Includes a scored risk register, an adversarial test case plan for the four highest-scoring threats, and a detection and monitoring plan with five detection patterns — each mapped to an ATLAS technique and a named response owner.

A full 98-subcategory NIST Cybersecurity Framework maturity assessment for Oscorp, a fictional organization, based on structured stakeholder interviews across IT, cybersecurity, risk, and procurement. Oscorp passed 26 of 98 controls (27% overall). The Respond function scored 0% — the most urgent finding in the assessment. The report closes with a sequenced three-year remediation roadmap: foundational governance and access control in Year 1, detection and response capability plus TPRM in Year 2, and quantified risk management in Year 3.

A complete third-party risk management (TPRM) program design for Stark Industries Inc., applied to its most critical supplier, Amazon Web Services. The program follows a four-step process: supplier inventory, three-tier risk classification, tiered questionnaire assessment with evidence review, and signed management report. The worked AWS assessment is built from AWS's own publicly published compliance documentation — Shared Responsibility Model, ISO/IEC 27001 certificates, and SOC 2 Type II attestations — and identifies two residual actions that belong to Stark Industries rather than AWS.

A reusable AI-specific vendor due diligence toolkit that extends standard third-party risk management practice. Includes a six-domain questionnaire covering data handling, model provenance, security controls, certifications, incident history, and contractual terms. Features a weighted scoring rubric with a three-tier risk decision (Green / Yellow / Red), a complete worked example against a fictional vendor, and recommended contract clauses for procurement and legal.

A complete, end-to-end ISMS build for Rockops Protection Agency, a fictional 125-person physical security and executive protection firm. Part A establishes the governance layer — ISMS scope, information security policy, RACI accountability matrix, a ten-entry risk register scored on a 5×5 likelihood-impact scale, and a full 93-control Statement of Applicability — with a documented judgment call on Google Workspace edition selection. Part B translates every Technological control named in Part A's SoA into a specific, sequenced configuration of the Google Admin console: OU structure, BYOD endpoint management for field agents, Gmail hardening (SPF/DKIM/DMARC), Drive sharing controls, audit alerts, Vault retention, and a one-hour offboarding runbook. Together the two documents demonstrate the full governance-to-implementation chain ISO/IEC 27001 requires.

A practitioner-focused analysis of the ten most common human failure patterns in Terraform-managed AWS environments, written as a control-gap analysis for GRC professionals and an operational checklist for engineers. Each failure — state file deletion, drift from manual console changes, hardcoded secrets, variable mistakes, accidental destruction, permission failures, backend misconfiguration, circular dependencies, concurrent modification, and version drift — is examined through three lenses: cause, effect, and fix. The document bridges the gap between IaC tooling and governance, mapping each failure to a specific control category: data integrity, change management, access control, segregation of duties, business continuity, least privilege, configuration management, and release management.