Mostafa Mosabbir

← Back to portfolio · Follow the MFA reassessment

SECURITY PROPOSAL WORKSPACE / WORKING PROTOTYPE

From Requirements to Safeguards

A security review for a fictional marketing company: client campaign files, advertising accounts, freelance access, and the evidence behind each recorded safeguard.

The bundled dataset is entirely fictional, including its evidence and review records.

Assessment date: 2026-10-28. Evidence freshness rule: 180 days.

Selected project-defined requirements only; mappings indicate relevance, not complete framework outcome coverage. This report does not certify compliance. Evidence review labels are supplied by the operator; evidence files are not inspected.

15Selected requirements

4Supported drafts

11Need work

Open a requirement to inspect its controls and review items. Items needing work appear first, ordered by the supplied priority. Counts are not a compliance percentage.

Follow the assessment

Explore the fictional sample from requirement to planned action. Evidence references and review labels are recorded metadata; the tool does not inspect evidence files.

MFA Coverage Verification

REQ-007 · needs work

Requirement

  • Require MFA for the in-scope human advertising-account logins.

Control

  • CTL-007: implemented; owner: Demo IT owner

Evidence references

  • CTL-007: no evidence linked

Finding

  • CTL-007: evidence reference is missing.

Next action

  • Collect and map evidence of MFA coverage. (planned)

Freelancer Access Review

REQ-008 · needs work

Requirement

  • Review freelancer permissions to client campaign folders.

Control

  • CTL-008: implemented; owner: not recorded

Evidence references

  • CTL-008: EV-008

Finding

  • CTL-008: owner is missing.

Next action

  • Assign accountability for freelancer access reviews. (planned)

Backup Restoration Testing

REQ-010 · needs work

Requirement

  • Record protected campaign-file backups and a restore test.

Control

  • CTL-010: partial; owner: Demo IT owner

Evidence references

  • CTL-010: EV-010

Finding

  • CTL-010: status is partial; do not claim implementation.

Next action

  • Complete protected backup coverage and perform a restore test. (planned)

Alert Correlation Mapping

REQ-012 · needs work

Requirement

  • Correlate campaign account alerts with identity activity.

Control

  • No control mapped to this requirement.

Evidence references

  • No evidence can be traced through a mapped control.

Finding

  • No control mapped; document an approach and assign a control owner.

Next action

  • Define and map an alert-correlation control. (planned)

Investigation Evidence Review

REQ-014 · needs work

Requirement

  • Keep a tamper-evident record of investigation actions.

Control

  • CTL-014: implemented; owner: Demo IT owner

Evidence references

  • CTL-014: EV-014

Finding

  • EV-014: evidence has not passed recorded human review.

Next action

  • Address the rejected investigation-record evidence. (planned)

Requirement matrix

Each tile is one selected requirement, grouped by its recorded domain. Open a tile to inspect the findings. These are counts, not framework coverage scores.

15 requirements shown

Govern

REQ-001supported draft0 review items · 0 actionsREQ-002needs work1 review items · 1 actionsREQ-003needs work1 review items · 1 actions

Identify

REQ-004supported draft0 review items · 0 actionsREQ-005needs work1 review items · 1 actionsREQ-006needs work2 review items · 1 actions

Protect

MFA Coverage VerificationREQ-007needs work1 review items · 1 actionsFreelancer Access ReviewREQ-008needs work1 review items · 1 actionsREQ-009needs work1 review items · 1 actionsBackup Restoration TestingREQ-010needs work1 review items · 1 actions

Detect

REQ-011supported draft0 review items · 0 actionsAlert Correlation MappingREQ-012needs work1 review items · 1 actions

Respond

REQ-013supported draft0 review items · 0 actionsInvestigation Evidence ReviewREQ-014needs work1 review items · 1 actions

Recover

REQ-015needs work1 review items · 1 actions

Remediation register

Fictional actions and accountable roles. Ready for review is not verified completion. Edit actions.csv to update the plan; reassess the source records to change findings.

Every requirement needing work has a planned action. That does not mean its findings are resolved.

11 recorded actions as of 2026-10-28
Action / requirementNext actionOwnerDueStatusVerification criteria
ACT-001
REQ-002		Review the client-file policy against the selected requirement.
medium priority		Demo security reviewer2026-11-15plannedRecord a dated coverage decision and its rationale.
ACT-002
REQ-003		Complete and prioritize the supplier inventory.
medium priority		Demo operations lead2026-11-15plannedReview an inventory covering all in-scope campaign platforms and freelancers.
ACT-003
REQ-005		Reconcile the software inventory and review current evidence.
medium priority		Demo IT owner2026-11-15plannedReview a current inventory export against managed software; record the actual review date.
ACT-004
REQ-006		Implement the selected shared-account risk response and revise the overdue plan.
high priority		Demo IT owner2026-11-15plannedDocument the chosen treatment, demonstrate its operation, and record reviewer acceptance.
ACT-005
REQ-007		Collect and map evidence of MFA coverage.
high priority		Demo identity administrator2026-11-15plannedReview in-scope login coverage and exceptions before linking the evidence record to CTL-007.
ACT-006
REQ-008		Assign accountability for freelancer access reviews.
high priority		Demo operations lead2026-11-15plannedConfirm the owner accepts responsibility and review the latest permissions review record.
ACT-007
REQ-009		Complete human review of staff training evidence.
medium priority		Demo training lead2026-11-15plannedCheck attendance and exercise results for the in-scope staff; record review outcome.
ACT-008
REQ-010		Complete protected backup coverage and perform a restore test.
high priority		Demo IT owner2026-11-15plannedReview backup scope, protection settings and a documented successful restore test.
ACT-009
REQ-012		Define and map an alert-correlation control.
high priority		Demo security lead2026-11-15plannedTest a fictional alert scenario; record ownership, implementation and reviewed evidence before mapping the control.
ACT-010
REQ-014		Address the rejected investigation-record evidence.
medium priority		Demo incident lead2026-11-15plannedResolve reviewer objections and submit a replacement record for a new human review.
ACT-011
REQ-015		Investigate the future-dated backup-integrity review.
high priority		Demo recovery lead2026-11-15plannedVerify the actual review date and supporting record, or perform a new review; do not merely backdate the entry.

Requirement findings

REQ-006 · Identify Track the chosen response to shared advertising-account risk. high priority · needs work · 2 review items

Related source: NIST CSF 2.0 / ID.RA-06

Read the source publication ↗

Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

Recorded controls and evidence references
ControlStatusOwnerTarget dateEvidence
CTL-006plannedDemo IT owner2026-10-01EV-006

Recorded statements

  • CTL-006: Fictional scenario: shared-account remediation plan has been proposed but is not operating.

Review findings

  • CTL-006: status is planned; do not claim implementation.
  • CTL-006: target date is overdue.
REQ-007 · Protect MFA Coverage Verification Require MFA for the in-scope human advertising-account logins. high priority · needs work · 1 review item

Related source: NIST CSF 2.0 / PR.AA-03

Read the source publication ↗

Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

Recorded controls and evidence references
ControlStatusOwnerTarget dateEvidence
CTL-007implementedDemo IT ownerNot setMissing

Recorded statements

  • CTL-007: Fictional scenario: advertising-account mfa is recorded as operating for the defined demo scope.

Review findings

  • CTL-007: evidence reference is missing.
REQ-008 · Protect Freelancer Access Review Review freelancer permissions to client campaign folders. high priority · needs work · 1 review item

Related source: NIST CSF 2.0 / PR.AA-05

Read the source publication ↗

Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

Recorded controls and evidence references
ControlStatusOwnerTarget dateEvidence
CTL-008implementedUnassignedNot setEV-008

Recorded statements

  • CTL-008: Fictional scenario: freelancer access review is recorded as operating for the defined demo scope.

Review findings

  • CTL-008: owner is missing.
REQ-010 · Protect Backup Restoration Testing Record protected campaign-file backups and a restore test. high priority · needs work · 1 review item

Related source: NIST CSF 2.0 / PR.DS-11

Read the source publication ↗

Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

Recorded controls and evidence references
ControlStatusOwnerTarget dateEvidence
CTL-010partialDemo IT owner2026-11-10EV-010

Recorded statements

  • CTL-010: Fictional scenario: campaign backup and restore exercise is incomplete; coverage and verification work remain.

Review findings

  • CTL-010: status is partial; do not claim implementation.
REQ-012 · Detect Alert Correlation Mapping Correlate campaign account alerts with identity activity. high priority · needs work · 1 review item

Related source: NIST CSF 2.0 / DE.AE-03

Read the source publication ↗

Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

Recorded controls and evidence references
ControlStatusOwnerTarget dateEvidence

Recorded statements

    No control has been mapped to this requirement.

    Review findings

    • No control mapped; document an approach and assign a control owner.
    REQ-015 · Recover Check campaign backup integrity before restoration. high priority · needs work · 1 review item

    Related source: NIST CSF 2.0 / RC.RP-03

    Read the source publication ↗

    Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

    Recorded controls and evidence references
    ControlStatusOwnerTarget dateEvidence
    CTL-015implementedDemo IT ownerNot setEV-015

    Recorded statements

    • CTL-015: Fictional scenario: pre-restoration integrity check is recorded as operating for the defined demo scope.

    Review findings

    • EV-015: evidence review date is in the future.
    REQ-002 · Govern Communicate the agency's approved client-file handling policy. medium priority · needs work · 1 review item

    Related source: NIST CSF 2.0 / GV.PO-01

    Read the source publication ↗

    Mapping indicates relevance, not full outcome coverage. Coverage review: pending; reviewer: Demo reviewer; date: 2026-10-20.

    Recorded controls and evidence references
    ControlStatusOwnerTarget dateEvidence
    CTL-002implementedDemo IT ownerNot setEV-002

    Recorded statements

    • CTL-002: Fictional scenario: client-file handling policy is recorded as operating for the defined demo scope.

    Review findings

    • Requirement coverage has not been approved by a human reviewer.
    REQ-003 · Govern List and prioritize campaign platforms and freelance suppliers. medium priority · needs work · 1 review item

    Related source: NIST CSF 2.0 / GV.SC-04

    Read the source publication ↗

    Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

    Recorded controls and evidence references
    ControlStatusOwnerTarget dateEvidence
    CTL-003partialDemo IT owner2026-11-15EV-003

    Recorded statements

    • CTL-003: Fictional scenario: supplier inventory is incomplete; coverage and verification work remain.

    Review findings

    • CTL-003: status is partial; do not claim implementation.
    REQ-005 · Identify Record the agency's managed design and marketing software. medium priority · needs work · 1 review item

    Related source: NIST CSF 2.0 / ID.AM-02

    Read the source publication ↗

    Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

    Recorded controls and evidence references
    ControlStatusOwnerTarget dateEvidence
    CTL-005implementedDemo IT ownerNot setEV-005

    Recorded statements

    • CTL-005: Fictional scenario: software inventory is recorded as operating for the defined demo scope.

    Review findings

    • EV-005: evidence review is stale under the selected freshness window.
    REQ-009 · Protect Train staff to recognize fraudulent campaign payment requests. medium priority · needs work · 1 review item

    Related source: NIST CSF 2.0 / PR.AT-01

    Read the source publication ↗

    Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

    Recorded controls and evidence references
    ControlStatusOwnerTarget dateEvidence
    CTL-009implementedDemo IT ownerNot setEV-009

    Recorded statements

    • CTL-009: Fictional scenario: payment-fraud awareness exercise is recorded as operating for the defined demo scope.

    Review findings

    • EV-009: evidence has not passed recorded human review.
    REQ-014 · Respond Investigation Evidence Review Keep a tamper-evident record of investigation actions. medium priority · needs work · 1 review item

    Related source: NIST CSF 2.0 / RS.AN-06

    Read the source publication ↗

    Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

    Recorded controls and evidence references
    ControlStatusOwnerTarget dateEvidence
    CTL-014implementedDemo IT ownerNot setEV-014

    Recorded statements

    • CTL-014: Fictional scenario: investigation activity journal is recorded as operating for the defined demo scope.

    Review findings

    • EV-014: evidence has not passed recorded human review.
    REQ-013 · Respond Triage and validate reported advertising-account incidents. high priority · supported draft · 0 review items

    Related source: NIST CSF 2.0 / RS.MA-02

    Read the source publication ↗

    Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

    Recorded controls and evidence references
    ControlStatusOwnerTarget dateEvidence
    CTL-013implementedDemo IT ownerNot setEV-013

    Recorded statements

    • CTL-013: Fictional scenario: incident triage checklist is recorded as operating for the defined demo scope.

    Review findings

      No gaps detected by these metadata checks. Final human review is still required.

      REQ-001 · Govern Assign owners for client-data and advertising-account security. medium priority · supported draft · 0 review items

      Related source: NIST CSF 2.0 / GV.RR-02

      Read the source publication ↗

      Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

      Recorded controls and evidence references
      ControlStatusOwnerTarget dateEvidence
      CTL-001implementedDemo IT ownerNot setEV-001

      Recorded statements

      • CTL-001: Fictional scenario: security responsibility register is recorded as operating for the defined demo scope.

      Review findings

        No gaps detected by these metadata checks. Final human review is still required.

        REQ-004 · Identify Maintain an inventory of agency-managed laptops. medium priority · supported draft · 0 review items

        Related source: NIST CSF 2.0 / ID.AM-01

        Read the source publication ↗

        Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

        Recorded controls and evidence references
        ControlStatusOwnerTarget dateEvidence
        CTL-004implementedDemo IT ownerNot setEV-004

        Recorded statements

        • CTL-004: Fictional scenario: laptop inventory reconciliation is recorded as operating for the defined demo scope.

        Review findings

          No gaps detected by these metadata checks. Final human review is still required.

          REQ-011 · Detect Monitor agency laptops for suspicious activity. medium priority · supported draft · 0 review items

          Related source: NIST CSF 2.0 / DE.CM-09

          Read the source publication ↗

          Mapping indicates relevance, not full outcome coverage. Coverage review: approved; reviewer: Demo reviewer; date: 2026-10-20.

          Recorded controls and evidence references
          ControlStatusOwnerTarget dateEvidence
          CTL-011implementedDemo IT ownerNot setEV-011

          Recorded statements

          • CTL-011: Fictional scenario: endpoint alert monitoring is recorded as operating for the defined demo scope.

          Review findings

            No gaps detected by these metadata checks. Final human review is still required.