Projects
My governance, risk, and compliance lab
Control gaps.
Actionable plans.
Security Risk Assessment & Remediation
I assessed security gaps against NIST SP 800-53 Rev. 5, considered their impact on confidentiality, integrity, and availability, and developed remediation recommendations and a POA&M process.
Do this lab yourselfFollow my step-by-step walkthrough →NIST SP 800-53 Rev. 5 · FIPS 199 · PCI DSS · RBAC · POA&M
Explore the control focus
Least privilege
Access recommendations and periodic reviews to reduce excessive access.
Plan of Action and Milestones
A remediation process that tracks risk, ownership, deadlines, status, and evidence.
Continuous monitoring
Control analysis connecting ongoing monitoring to security oversight.
Risk assessment
Assessing control gaps and their impact on confidentiality, integrity, and availability.
Risk response
Developing remediation strategies based on assessed risk.
Selected NIST controls documented in my assessment summary.
Behind the project
What I built.
Why it matters.
Explore the setup, decisions, and work documented in this project.
What I assessed
Control deficiencies and their potential impact on confidentiality, integrity, and availability. My write up focuses on AC-6, CA-5, CA-7, RA-3, and RA-7.
What I recommended
Access governance, periodic access reviews, risk response, and a remediation process with severity, ownership, deadlines, status, and completion evidence.
What I documented
A PCI DSS aligned policy for a point of sale environment, covering network security, secure configurations, default credentials, malware protection, and technical ownership. The public repository contains the project summary.