SECURITY PROPOSAL WORKSPACE / WORKING PROTOTYPE
From Requirements to Safeguards
A security review for a fictional marketing company: client campaign files, advertising accounts, freelance access, and the evidence behind each recorded safeguard.
The bundled dataset is entirely fictional, including its evidence and review records.
Assessment date: 2026-10-28. Evidence freshness rule: 180 days.
Selected project-defined requirements only; mappings indicate relevance, not complete framework outcome coverage. This report does not certify compliance. Evidence review labels are supplied by the operator; evidence files are not inspected.
15Selected requirements
4Supported drafts
11Need work
Open a requirement to inspect its controls and review items. Items needing work appear first, ordered by the supplied priority. Counts are not a compliance percentage.
Requirement matrix
Each tile is one selected requirement, grouped by its recorded domain. Open a tile to inspect the findings. These are counts, not framework coverage scores.
15 requirements shown
Govern
Identify
Protect
Respond
Remediation register
Fictional actions and accountable roles. Ready for review is not verified completion. Edit actions.csv to update the plan; reassess the source records to change findings.
Every requirement needing work has a planned action. That does not mean its findings are resolved.
| Action / requirement | Next action | Owner | Due | Status | Verification criteria |
|---|---|---|---|---|---|
| ACT-001 REQ-002 | Review the client-file policy against the selected requirement. medium priority | Demo security reviewer | 2026-11-15 | planned | Record a dated coverage decision and its rationale. |
| ACT-002 REQ-003 | Complete and prioritize the supplier inventory. medium priority | Demo operations lead | 2026-11-15 | planned | Review an inventory covering all in-scope campaign platforms and freelancers. |
| ACT-003 REQ-005 | Reconcile the software inventory and review current evidence. medium priority | Demo IT owner | 2026-11-15 | planned | Review a current inventory export against managed software; record the actual review date. |
| ACT-004 REQ-006 | Implement the selected shared-account risk response and revise the overdue plan. high priority | Demo IT owner | 2026-11-15 | planned | Document the chosen treatment, demonstrate its operation, and record reviewer acceptance. |
| ACT-005 REQ-007 | Collect and map evidence of MFA coverage. high priority | Demo identity administrator | 2026-11-15 | planned | Review in-scope login coverage and exceptions before linking the evidence record to CTL-007. |
| ACT-006 REQ-008 | Assign accountability for freelancer access reviews. high priority | Demo operations lead | 2026-11-15 | planned | Confirm the owner accepts responsibility and review the latest permissions review record. |
| ACT-007 REQ-009 | Complete human review of staff training evidence. medium priority | Demo training lead | 2026-11-15 | planned | Check attendance and exercise results for the in-scope staff; record review outcome. |
| ACT-008 REQ-010 | Complete protected backup coverage and perform a restore test. high priority | Demo IT owner | 2026-11-15 | planned | Review backup scope, protection settings and a documented successful restore test. |
| ACT-009 REQ-012 | Define and map an alert-correlation control. high priority | Demo security lead | 2026-11-15 | planned | Test a fictional alert scenario; record ownership, implementation and reviewed evidence before mapping the control. |
| ACT-010 REQ-014 | Address the rejected investigation-record evidence. medium priority | Demo incident lead | 2026-11-15 | planned | Resolve reviewer objections and submit a replacement record for a new human review. |
| ACT-011 REQ-015 | Investigate the future-dated backup-integrity review. high priority | Demo recovery lead | 2026-11-15 | planned | Verify the actual review date and supporting record, or perform a new review; do not merely backdate the entry. |
Requirement findings
REQ-006 · Identify Track the chosen response to shared advertising-account risk. high priority · needs work · 2 review items
Related source: NIST CSF 2.0 / ID.RA-06
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-006 | planned | Demo IT owner | 2026-10-01 | EV-006 |
Recorded statements
- CTL-006: Fictional scenario: shared-account remediation plan has been proposed but is not operating.
Review findings
- CTL-006: status is planned; do not claim implementation.
- CTL-006: target date is overdue.
REQ-007 · Protect Require MFA for the in-scope human advertising-account logins. high priority · needs work · 1 review item
Related source: NIST CSF 2.0 / PR.AA-03
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-007 | implemented | Demo IT owner | Not set | Missing |
Recorded statements
- CTL-007: Fictional scenario: advertising-account mfa is recorded as operating for the defined demo scope.
Review findings
- CTL-007: evidence reference is missing.
REQ-008 · Protect Review freelancer permissions to client campaign folders. high priority · needs work · 1 review item
Related source: NIST CSF 2.0 / PR.AA-05
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-008 | implemented | Unassigned | Not set | EV-008 |
Recorded statements
- CTL-008: Fictional scenario: freelancer access review is recorded as operating for the defined demo scope.
Review findings
- CTL-008: owner is missing.
REQ-010 · Protect Record protected campaign-file backups and a restore test. high priority · needs work · 1 review item
Related source: NIST CSF 2.0 / PR.DS-11
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-010 | partial | Demo IT owner | 2026-11-10 | EV-010 |
Recorded statements
- CTL-010: Fictional scenario: campaign backup and restore exercise is incomplete; coverage and verification work remain.
Review findings
- CTL-010: status is partial; do not claim implementation.
REQ-012 · Detect Correlate campaign account alerts with identity activity. high priority · needs work · 1 review item
Related source: NIST CSF 2.0 / DE.AE-03
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|
Recorded statements
No control has been mapped to this requirement.
Review findings
- No control mapped; document an approach and assign a control owner.
REQ-015 · Recover Check campaign backup integrity before restoration. high priority · needs work · 1 review item
Related source: NIST CSF 2.0 / RC.RP-03
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-015 | implemented | Demo IT owner | Not set | EV-015 |
Recorded statements
- CTL-015: Fictional scenario: pre-restoration integrity check is recorded as operating for the defined demo scope.
Review findings
- EV-015: evidence review date is in the future.
REQ-002 · Govern Communicate the agency's approved client-file handling policy. medium priority · needs work · 1 review item
Related source: NIST CSF 2.0 / GV.PO-01
Mapping indicates relevance, not full outcome coverage. Coverage review: pending; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-002 | implemented | Demo IT owner | Not set | EV-002 |
Recorded statements
- CTL-002: Fictional scenario: client-file handling policy is recorded as operating for the defined demo scope.
Review findings
- Requirement coverage has not been approved by a human reviewer.
REQ-003 · Govern List and prioritize campaign platforms and freelance suppliers. medium priority · needs work · 1 review item
Related source: NIST CSF 2.0 / GV.SC-04
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-003 | partial | Demo IT owner | 2026-11-15 | EV-003 |
Recorded statements
- CTL-003: Fictional scenario: supplier inventory is incomplete; coverage and verification work remain.
Review findings
- CTL-003: status is partial; do not claim implementation.
REQ-005 · Identify Record the agency's managed design and marketing software. medium priority · needs work · 1 review item
Related source: NIST CSF 2.0 / ID.AM-02
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-005 | implemented | Demo IT owner | Not set | EV-005 |
Recorded statements
- CTL-005: Fictional scenario: software inventory is recorded as operating for the defined demo scope.
Review findings
- EV-005: evidence review is stale under the selected freshness window.
REQ-009 · Protect Train staff to recognize fraudulent campaign payment requests. medium priority · needs work · 1 review item
Related source: NIST CSF 2.0 / PR.AT-01
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-009 | implemented | Demo IT owner | Not set | EV-009 |
Recorded statements
- CTL-009: Fictional scenario: payment-fraud awareness exercise is recorded as operating for the defined demo scope.
Review findings
- EV-009: evidence has not passed recorded human review.
REQ-014 · Respond Keep a tamper-evident record of investigation actions. medium priority · needs work · 1 review item
Related source: NIST CSF 2.0 / RS.AN-06
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-014 | implemented | Demo IT owner | Not set | EV-014 |
Recorded statements
- CTL-014: Fictional scenario: investigation activity journal is recorded as operating for the defined demo scope.
Review findings
- EV-014: evidence has not passed recorded human review.
REQ-013 · Respond Triage and validate reported advertising-account incidents. high priority · supported draft · 0 review items
Related source: NIST CSF 2.0 / RS.MA-02
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-013 | implemented | Demo IT owner | Not set | EV-013 |
Recorded statements
- CTL-013: Fictional scenario: incident triage checklist is recorded as operating for the defined demo scope.
Review findings
No gaps detected by these metadata checks. Final human review is still required.
REQ-001 · Govern Assign owners for client-data and advertising-account security. medium priority · supported draft · 0 review items
Related source: NIST CSF 2.0 / GV.RR-02
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-001 | implemented | Demo IT owner | Not set | EV-001 |
Recorded statements
- CTL-001: Fictional scenario: security responsibility register is recorded as operating for the defined demo scope.
Review findings
No gaps detected by these metadata checks. Final human review is still required.
REQ-004 · Identify Maintain an inventory of agency-managed laptops. medium priority · supported draft · 0 review items
Related source: NIST CSF 2.0 / ID.AM-01
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-004 | implemented | Demo IT owner | Not set | EV-004 |
Recorded statements
- CTL-004: Fictional scenario: laptop inventory reconciliation is recorded as operating for the defined demo scope.
Review findings
No gaps detected by these metadata checks. Final human review is still required.
REQ-011 · Detect Monitor agency laptops for suspicious activity. medium priority · supported draft · 0 review items
Related source: NIST CSF 2.0 / DE.CM-09
Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.
| Control | Status | Owner | Target date | Evidence |
|---|---|---|---|---|
| CTL-011 | implemented | Demo IT owner | Not set | EV-011 |
Recorded statements
- CTL-011: Fictional scenario: endpoint alert monitoring is recorded as operating for the defined demo scope.
Review findings
No gaps detected by these metadata checks. Final human review is still required.