CYBRARY Program
Governance & audit
Controls, evidence and the paperwork an auditor will actually accept — assessed the way a real assessment runs, on artifacts rather than assertions.
Who it is for: Security control assessors, GRC analysts, compliance and audit teams.
The path through it
Assessment the way it actually runs — test a control against its stated design, produce artifacts a third party can re-run, and turn findings into rated, owned, dated risk decisions.
- 1 · Controls and evidence
What a control claims, how you test it, and what counts as evidence.
- sec-101The management port that came back40 min
- sec-102Privileged accounts nobody owns40 min
- cmp-101The evidence that proves nothing40 min
- 2 · Monitoring assurance
A logging or detection control is only assured when you can show it collects, matches and notifies.
- dr-101Truth, reach and align30 min
- dr-102Logic that never matched30 min
- dr-103Notification that never sent30 min
- 3 · Risk and incident governance
Findings become risk decisions; incidents become regulatory clocks.
- cmp-201Continuous control monitoring, honestly45 min
- ir-201The 72-hour clock45 min
- 4 · Assessment capstones
Run an assessment end to end, including the recovery control that only a control test can settle.
- cmp-301Capstone — fieldwork week60 min
- ir-301Capstone — the review that changes something60 min
- ran-101Backup control testing under assessment45 min
NICE capabilities this program evidences
- Audit and control evidencefirst proven in sec-101Test a control against its stated design and produce artifacts an external assessor accepts.
- Control assurancefirst proven in sec-101Prove a control collects, matches and notifies — and find the stage where it does not.
- Risk and policy governancefirst proven in cmp-101Turn a finding into a rated, owned, dated risk decision that survives the next review.
- Incident triagefirst proven in ir-201Qualify, scope and prioritize an alert into a case with evidence attached.
- Evidence handlingfirst proven in ir-201Preserve artifacts and keep an auditable chain from observation to conclusion.
- Recovery operationsfirst proven in ran-101Plan and execute a recovery with recovery points, waves and an after-action record.
- Continuity planningfirst proven in ran-101Set and defend RTO and RPO, map service dependencies, and sequence a restore the business can live with.
Roles this program trains toward
- Security control assessor
The seat that decides whether a control actually works — by testing it against its stated design and keeping the evidence someone else can re-run.
- GRC analyst
The seat that turns scattered findings into rated, owned, dated risk decisions the business can actually act on.
Other programs
- SOC operations — The detection and response core: query telemetry, triage a queue, hunt a hypothesis, automate the response and prove the control fired.
- Ransomware resilience — Everything after impact: trustworthy recovery points, isolated proof, forest recovery, staged reconnection and an after-action record that survives review.
- AI security — Securing the agents now sitting inside the SOC: prompt injection, poisoned tool catalogs, approval ceilings and the oversight boundary around autonomy.
- Adversary craft & systems — Host-level ground truth: patch state, exploitation preconditions and the machine behavior every detection above it depends on.