GRC › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 37 literacy evidence from `$GRC_LAB` — risk, frameworks, privacy/PCI, mapping, audit, gap/evidence, reporting; no forged refs.
Visual · t37_evidence_pack
Evidence pack = mentor handoff from $GRC_LAB literacy. Original Cyberlium.
Opening
One indexed pack beats scattered GRC notes — and never includes forged artifacts or stranger org audit data.
Assemble evidence pack: `$GRC_LAB` fictional org template inventory, lab setup proof, risk and framework labs if brief assigned, privacy/PCI lab, mapping lab, audit lab, gap lab, reporting lab, integrity statement (YOUR fictional org only, LAB labels mandatory, no forged artifacts, no stranger org audits, no fake certifications, educational not legal advice, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + gap stubs + diagrams, not forgery cookbooks. Gap paragraph for Topic 38 ICS/SCADA Security — separate authorized track. Scan folder for forged certs, backdated logs, stranger org audit notes — zero tolerance.
1. Pack contents
Minimum: org template inventory, risk, frameworks, privacy/PCI, mapping, audit, gap/evidence, reporting, integrity index.
Optional: module labs per brief — no refused forgery files.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST CSF — https://www.nist.gov/cyberframework ISO 27001 — https://www.iso.org/isoiec-27001-information-security.html ISACA — https://www.isaca.org/resources/glossary
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export GRC_LAB=${GRC_LAB:-$HOME/cyberlium-lab/t37-grc}
python3 - <<'PY'
import os
lab = os.environ.get('GRC_LAB', os.path.expanduser('~/cyberlium-lab/t37-grc'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
'CAPSTONE EVIDENCE INDEX — YOUR t37-grc lab fictional LAB-ORG-001 only',
'Ethics: roe.txt, not-legal-advice.txt, no-forged-artifacts.txt',
'Risk: risk-register.csv + treatment-plan.md + acceptance hygiene',
'Frameworks: nist-csf-mapping-stub.md + iso-annex-a-stub.md',
'Privacy: gdpr-scope-checklist.md + pci-scope-checklist.md',
'Controls: cis-nist-iso-crosswalk-stub.md + policy-vs-control.md',
'Audit: audit-report-template.md + sampling notes',
'Gap: gap-analysis-stub.csv + evidence-inventory.csv (LAB SAMPLE)',
'Reporting: findings-remediation-tracker.csv + board-one-pager.md',
'Label: LAB SAMPLE — NOT FOR PRODUCTION AUDIT CLAIMS on all artifacts',
'Refusals: no forged certs / no fabricated SOC2 / no illegal data processing how-tos',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'LAB SAMPLE|Refusals|risk-register' "$GRC_LAB/notes/capstone-evidence-index.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST CSF (https://www.nist.gov/cyberframework); ISO 27001 (https://www.iso.org/isoiec-27001-information-security.html); ISACA (https://www.isaca.org/resources/glossary). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, LAB label, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$GRC_LAB only, LAB label discipline, no forged refs, share-safe export.
Scan before seal — remove accidental stranger org data or forged artifacts.
4. What you ship: GRC evidence pack
Bundled deliverables + index + integrity — chmod 600, report not forgery guides default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes forged ISO certificate and stranger org audit data.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle risk through reporting index. 2) Integrity statements. 3) Confirm zero forged refs. 4) Gap note for Topic 38 ICS/SCADA.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Forged artifacts OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice