# Chapter 5 Labs: Cybersecurity Compliance and Management

This chapter is about governance, risk, and compliance (GRC) rather than technical exploitation.
Its two labs are analytical exercises: a facilitated group roleplay and a spreadsheet crosswalk.
Neither requires a vulnerable target. One offers optional container tooling to assist with data
analysis; the other is a pure host-side exercise.

## Labs in this chapter

| Lab | Title | Type |
|-----|-------|------|
| Lab 5.1 | Run a tabletop risk assessment | Host setup (group exercise, no containers) |
| Lab 5.2 | Build a control-matrix crosswalk | Host setup + optional crosswalk-tools container |

## Prerequisites

- Docker Engine 24+ and Docker Compose v2 (for Lab 5.2 tooling only)
- Disk: under 200 MB (python:3.12-slim base)
- For Lab 5.2: a spreadsheet application (Excel, LibreOffice Calc, or Google Sheets)
- Optional for Lab 5.2: the full NIST CSF 2.0 Reference Tool export (free CSV download from NIST)

## Quick start (Lab 5.2 tooling only)

```bash
# Build and start the crosswalk tools container
docker compose up -d --build crosswalk-tools

# Open a shell inside the container
docker compose exec crosswalk-tools bash

# Inside the container - run the analysis script against the seed CSV
python crosswalk_analysis.py
```

The seed CSV (`crosswalk-tools/workdir/csf2_crosswalk_seed.csv`) is a representative 25-row
excerpt of the NIST CSF 2.0 Informative References mapping. To use the full NIST export:
1. Download the CSV from: https://csrc.nist.gov/Projects/cybersecurity-framework/Filters
2. Copy the file into `crosswalk-tools/workdir/` (the mounted volume)
3. Update the `CROSSWALK_FILE` variable at the top of `crosswalk_analysis.py`

---

## Lab 5.1 - Run a tabletop risk assessment

### Host setup (not containerised)

This lab is a group discussion exercise. It does not require Docker or any software installation.
It requires: 3-6 participants, role cards (print or display `tabletop/role_cards.md`),
a whiteboard or shared doc for the gap list, and approximately 90 minutes.

### Objective

Run the provided ransomware tabletop with role cards (CISO, legal, communications, IT operations,
executive, and DPO). Surface the decision gaps and untested assumptions that a real incident would
expose, and convert them into a one-page actionable gap list.

### Setup

1. Assign roles. One person facilitates; everyone else plays their assigned role strictly.
   Roles: CISO, Legal Counsel, Head of Communications, Head of IT Operations, Executive, DPO.
   With fewer than six participants, combine roles (e.g. one person plays Legal + DPO).

2. Print or open `tabletop/role_cards.md`. Each participant reads only their own card before
   the exercise starts.

3. The facilitator keeps the inject sequence from the Facilitator Guide section of the role cards
   document. Do not share injects with participants in advance.

4. Open a shared whiteboard or document for logging gaps in real time. Do not attempt to fix
   gaps during the exercise; only log them.

### Walkthrough

The facilitator reads the opening scenario aloud, then introduces injects in order as the group
works through each stage. At each inject, force the question: "who decides, and on what evidence?"

**Opening inject:** Monday 07:40 - customer database unreachable, ransom note on three servers.
  - Who has authority to declare an incident?
  - Who is the first call, and is the contact list current?

**Inject 1 - Scope expansion:** File-share and backup server also encrypted; EDR shows a domain
controller was also hit.
  - Are the backups themselves compromised?
  - Who can confirm the last clean restore point? Has anyone ever actually done a full restore?

**Inject 2 - Ransom demand:** EUR 1.5 million cryptocurrency demand, 48-hour deadline. Attackers
claim to have exfiltrated 200,000 customer records.
  - Will the organisation pay? Who decides - CISO, CEO, or board?
  - Is paying lawful given sanctions exposure? How would you find out in under an hour?

**Inject 3 - Personal data confirmed:** DPO confirms personal data in the exfiltrated set.
  - The GDPR Article 33 72-hour notification clock has started (see Section 5.6).
  - Who drafts the supervisory authority notification? Does anyone know the notification route?

**Inject 4 - Press enquiry:** A journalist emails; an employee has posted on social media.
  - Who speaks for the organisation?
  - Do Legal and Communications agree on a holding statement? Who approves it?

**Inject 5 - Recovery decision:** Full restore estimated at five days; last verified restore test
was 14 months ago. Business asks whether paying would be faster.
  - Recover or pay? On what evidence, and who owns that call?

### Expected output

Gaps surfaced during the exercise logged in real time. Common findings include:
- No agreed authority for the ransom payment decision
- Backup restore has never been tested end-to-end
- DPO notification route to the supervisory authority is stale or unknown
- Legal and Communications disagree on what the holding statement can say
- Network-isolation authority sits with a single named person (single point of failure)

### Verify completion

The lab is complete when the group has worked all five injects and produced the gap list.
A valid gap list has at minimum one row per inject with: gap description, named owner, concrete action
with a due date. Resist writing a narrative; the gap list is the deliverable.

Example gap list format:

| Gap surfaced | Owner | Action | Due |
|---|---|---|---|
| No one agreed who can authorise ransom payment | CEO / Board | Add ransom-decision authority to IR plan; ratify at board level | End of quarter |
| Backup restore has never been tested end-to-end | Head of IT Ops | Run full restore test; record actual restore time | Within 30 days |
| DPO notification route to supervisory authority was stale | DPO | Verify notification channel; pre-draft Art.33 template | Within 14 days |
| Legal and Comms disagreed on holding statement | General Counsel | Agree pre-approved holding statement and approval chain | Within 14 days |
| Network-isolation authority sat with one person | CISO | Name delegate with standing authority to disconnect | Immediately |

### Cleanup

No cleanup required. Delete any shared notes or whiteboards per your data-handling policy.

### Safety and authorisation note

This is a discussion exercise on a fictional scenario. It touches no live systems and requires
no special permission. All figures (EUR 1.5 million demand, 200,000 records) are illustrative.
The only authorisation required is consent from all participants.

---

## Lab 5.2 - Build a control-matrix crosswalk

### Objective

Build a multi-framework control crosswalk mapping NIST CSF 2.0 subcategories to ISO/IEC
27001:2022 Annex A controls, NIS2 Article 21 measures, and GDPR Article 32 elements.
Demonstrate that a single well-implemented control can satisfy obligations across multiple
frameworks simultaneously.

### Setup

**Option A - Spreadsheet only (host, no container needed):**
1. Download the NIST CSF 2.0 Reference Tool export (free, CSV or JSON) from:
   https://csrc.nist.gov/Projects/cybersecurity-framework/Filters
2. Open it in a spreadsheet application (Excel, LibreOffice Calc, Google Sheets).
3. Create a working tab with four columns:
   - A: CSF 2.0 Subcategory code and title
   - B: ISO/IEC 27001:2022 Annex A control reference(s)
   - C: NIS2 Article 21 measure(s) it satisfies (the ten-point list from Section 5.5.2)
   - D: GDPR Article 32 element(s) it satisfies (confidentiality / integrity / availability /
       resilience / restore / test)

**Option B - Container-assisted (recommended for verifying your mappings):**
```bash
docker compose up -d --build crosswalk-tools
docker compose exec crosswalk-tools bash
# Inside the container:
python crosswalk_analysis.py
```
The script loads the seed CSV (or a full NIST export you supply) and runs all four lab steps,
printing tables and summary prompts to stdout.

### Walkthrough

**Step 1: Map five priority controls**
Choose five controls a medium-sized organisation would implement first. Start with MFA on remote
access (CSF subcategory PR.AA-03). For each control, fill in all four columns (CSF, ISO, NIS2,
GDPR). If any column is empty, that is a finding: either the control is not supported by a
framework (rare) or you have missed a mapping.

**Step 2: Verify the MFA multi-framework mapping**
For PR.AA-03 (authentication / MFA), confirm it maps simultaneously into at least three framework
columns. The NIST Reference Tool will also show mappings to NIST SP 800-53 and CIS Controls v8.
A single well-scoped MFA programme should produce a non-empty entry in every column.

**Step 3: Reverse lookup - NIS2 Article 21 Measure 10**
NIS2 Article 21(2)(j): "the use of multi-factor authentication or continuous-authentication
solutions, secured voice, video and text communications and emergency communications systems."
Find every CSF 2.0 subcategory and ISO Annex A control that this measure touches. Count how
many distinct controls from how many frameworks a single MFA programme would satisfy.

**Step 4: One-page summary**
Answer these three questions in one page:
  a. Which framework provides the most specific implementation guidance for each control?
  b. Which obligation would remain unsatisfied if you implemented only the ISO 27001 controls
     without also mapping to NIS2? (Hint: look for NIS2 measures with no direct ISO mapping.)
  c. What does the crosswalk reveal about the relationship between compliance and security?

The analysis script (`crosswalk_analysis.py`) prints structured answers to Steps 1-4 as prompts.
Write your own answers; do not submit the script output as your deliverable.

### Expected output

- A crosswalk spreadsheet tab with at least five control rows fully populated.
- A count of frameworks satisfied by the MFA implementation.
- A reverse-lookup result for NIS2 Measure 10 (typically 3-5 CSF subcategories in the seed
  extract; more in the full NIST export).
- A one-page summary answering (a), (b), and (c) above.

### Verify completion

The crosswalk is complete when:
- All five chosen controls have all four columns populated (or a documented finding for any
  empty cell).
- The MFA reverse lookup shows at least three framework touchpoints.
- The one-page summary addresses all three questions with specific framework references.

### Cleanup

```bash
docker compose down
# No persistent volumes are created; the workdir mount is local to your machine.
```

---

## Teardown

```bash
docker compose down -v
docker rmi ch05-crosswalk-tools:local 2>/dev/null || true
```

This removes all containers and the built image. The workdir files (your crosswalk CSV and any
output) remain in `crosswalk-tools/workdir/` on the host until you delete them manually.

---

## Safety and authorisation note

Neither lab involves offensive techniques, vulnerable targets, or live systems. The tabletop
scenario (Lab 5.1) is a fictional roleplay exercise. The crosswalk lab (Lab 5.2) uses only
public reference data published by NIST, ISO (as publicly documented), the EU legislator
(NIS2, GDPR), and the seed CSV included in this pack.

No special authorisation is required for either lab.
