GRC › Module 1 › Lesson 2
Lab Org Only
Lab org only means YOUR fictional organization templates under $GRC_LAB — labeled courseware org profiles, self-authored risk scenarios — document org scope in notes before any GRC exercise.
Visual · t37_lab_org_only
Org scope. $GRC_LAB only. Original Cyberlium.
Opening
The org label is part of scope — Cyberlium refuses GRC exercises that paste real employer audit packs or customer data into lab templates without fictional labeling.
Your GRC lab org is a fictional company YOU define — Cyberlium Fictional Corp, LabRetail Co, example.local service catalog — with made-up systems, risks, and control gaps for learning. Templates live on $GRC_LAB only — never copied from live breach reports, real customer contracts, or employer confidential audit files. Cyberlium maps allowed org inventory on YOUR $GRC_LAB — org name, industry label, system list, fictional data classification — never 'borrowed' employer production audit evidence or scraped real company compliance packs. Next: Not Legal Advice.
1. Allowed org surfaces (named)
Self-authored fictional org profiles with explicit training labels. Courseware GRC packs with example.local assets. Risk scenarios using placeholder system names and synthetic data classes. Control gap exercises on templates you created — not employer confidential files.
On $GRC_LAB, list org inventory row — org name, industry, system count, fictional data label — never paste real customer PII or employer audit PDFs into lab notes.
Command guide
Try these commands — Allowed org surfaces (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST CSF — https://www.nist.gov/cyberframework ISO 27001 — https://www.iso.org/isoiec-27001-information-security.html ISACA — https://www.isaca.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t37-grc/notes" "$HOME/cyberlium-lab/t37-grc/LAB-ORG-001" "$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/risk" "$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/controls" "$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/privacy" "$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/audit" "$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/gap" "$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/evidence" "$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/reporting" cat > "$HOME/cyberlium-lab/t37-grc/lab.env" <<'EOF' export GRC_LAB=$HOME/cyberlium-lab/t37-grc export GRC_ORG=$HOME/cyberlium-lab/t37-grc/LAB-ORG-001 export GRC_RISK=$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/risk export GRC_CONTROLS=$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/controls export GRC_PRIVACY=$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/privacy export GRC_AUDIT=$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/audit export GRC_GAP=$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/gap export GRC_EVIDENCE=$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/evidence export GRC_REPORTING=$HOME/cyberlium-lab/t37-grc/LAB-ORG-001/reporting EOF
Command — copy this
chmod 600 "$HOME/cyberlium-lab/t37-grc/lab.env" grep -E 'GRC_' "$HOME/cyberlium-lab/t37-grc/lab.env" curl -sS https://www.cisecurity.org/controls | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: NIST CSF (https://www.nist.gov/cyberframework); ISO 27001 (https://www.iso.org/isoiec-27001-information-security.html); ISACA (https://www.isaca.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why org scope matters before GRC work
Risk registers and evidence packs reference systems and data classes. Scope is what keeps practice ethical and legally safe. Employer production audit files, real customer contracts, and live regulatory filings copied into lab work are out of scope.
If you cannot answer 'is this org fictional and labeled lab-only?', pause and fix scope notes before building risk or evidence artifacts.
3. Org inventory habit
Forbidden: importing employer audit packs because lab orgs 'look too simple.' Allowed: org inventory row — name, industry, systems, source = $GRC_LAB self-authored fictional template.
Ship: org inventory row for one fictional lab org. Next: Not Legal Advice.
4. What you ship: org inventory row for $GRC_LAB
One fictional org with system list and data labels. $GRC_LAB named. NEVER real employer audit imports. chmod 600.
5. What you record before the next lesson
Date. Org inventory row. $GRC_LAB named. File t37-m01-l02-lab-org-only.txt chmod 600.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Paste employer SOC 2 report into lab because 'realism helps.' Skip fictional label because 'it's just notes.'
Right
Write org inventory row for YOUR $GRC_LAB fictional org. Next: Not Legal Advice.
Mission: document YOUR fictional org inventory
1) Write one fictional org name and industry. 2) List three lab systems with data classification labels. 3) Confirm zero real employer audit imports. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Org inventory exists for scope — use fictional templates instead of employer confidential files.
Knowledge Check
APPLY: Lab org only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: GRC lab orgs on $GRC_LAB use explicit fictional labels.
True or False
Knowledge Check
APPLY: Before building a risk register you should:
Multiple choice