GRC › Module 1 › Lesson 4
Lab — Setup
Pack GRC scope, fictional org inventory, and ethics disclaimer — lab setup file only, dest $GRC_LAB.
Visual · t37_lab_setup
Lab: write GRC setup pack. $GRC_LAB only. Original Cyberlium.
Opening
Lab setup before GRC exercises — scope paperwork mentors expect before risk and framework modules.
Lessons 1–3 defined why GRC matters, lab org only, and not legal advice. This lab ships the combined artifact: topic scope paragraph, fictional org inventory row, and ethics card for $GRC_LAB under $HOME/cyberlium-lab/t37-grc/. No forged evidence or real employer audit imports required — scope and org paperwork first. Next: Quiz — GRC Mindset and Lab.
1. Lab contract: write the setup pack
Create $HOME/cyberlium-lab/t37-m01-l04-lab-setup.txt with date, operator, $GRC_LAB placeholder, literacy vs forged evidence paragraph, fictional org inventory row, and ethics card with educational disclaimer.
Optional: one-line proof your t37-grc folder exists — still no forged certs or employer audit imports required in this lab.
Command guide
Try these commands — Lab contract: write the setup pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST CSF — https://www.nist.gov/cyberframework ISO 27001 — https://www.iso.org/isoiec-27001-information-security.html ISACA — https://www.isaca.org/resources/glossary
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export GRC_LAB=${GRC_LAB:-$HOME/cyberlium-lab/t37-grc}
cat > "$GRC_LAB/roe.txt" <<'EOF'
GRC_LAB=$HOME/cyberlium-lab/t37-grc
org: fictional LAB-ORG-001 — SaaS fintech literacy stub (not a real company)
targets: YOUR risk/, controls/, privacy/, audit/, gap/, evidence/, reporting/ folders
never: forge certificates; fabricate SOC2 for customers; illegal data processing how-tos
never: present LAB SAMPLE artifacts as production audit evidence
allowed: risk register CSV; treatment plans; NIST/ISO mapping markdown; GDPR/PCI checklists
allowed: gap analysis stub; evidence inventory (LAB SAMPLE); audit template; board one-pager
allowed: curl nist.gov CSF, iso.org, gdpr.eu, pcisecuritystandards.org literacy pages
output: markdown/CSV stubs in lab folder — educational only
EOFCommand — copy this
chmod 600 "$GRC_LAB/roe.txt" grep -E 'GRC_LAB|never|allowed|LAB-ORG-001|LAB SAMPLE' "$GRC_LAB/roe.txt" cat > "$GRC_ORG/org-profile.md" <<'EOF' # LAB-ORG-001 — Fictional Org Profile (literacy only) - **Type:** SaaS fintech literacy stub - **Scope:** web app + API + cloud hosting (fictional) - **Data:** fictional customer PII + payment card flow (educational scope exercise) - **Frameworks:** NIST CSF + ISO 27001 literacy + GDPR/PCI scope checklist - **Disclaimer:** NOT a real organization — templates for YOUR lab only EOF
Command — copy this
grep -E 'Fictional|Disclaimer|LAB-ORG-001' "$GRC_ORG/org-profile.md" ls -la "$GRC_ORG/"
═══ WINDOWS ═══
Run on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t37-grc/roe.txt | Select-String never Get-ChildItem $HOME/cyberlium-lab/t37-grc/LAB-ORG-001
Primary tools to practice this lesson: grep, curl. Reference sites: NIST CSF (https://www.nist.gov/cyberframework); ISO 27001 (https://www.iso.org/isoiec-27001-information-security.html); ISACA (https://www.isaca.org/resources/glossary). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for 'fake ISO cert,' forged audit screenshot steps, real customer PII — redact or delete. Rewrite forum habits to $GRC_LAB fictional placeholders before you copy templates.
Classmates build their own setup packs for their $GRC_LAB — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then Risk Assessment.
GRC mentors archive lab setup before first risk register exercise; you are practicing that habit early.
4. What you ship: GRC lab setup pack for $GRC_LAB
Setup pack: scope, org row, ethics card. $GRC_LAB named. NEVER forged evidence. chmod 600.
5. What you record before the next lesson
Date. Setup pack path. $GRC_LAB scope note. File t37-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and import employer audit PDF. Add fake cert template to approved list.
Right
Write YOUR lab setup pack for $GRC_LAB. chmod 600. Next: Quiz — GRC Mindset and Lab.
Mission: freeze YOUR GRC lab setup pack on disk
1) Merge scope, org inventory, ethics sections. 2) Name $GRC_LAB. 3) chmod 600. Never list forged evidence as approved practice.
Stuck? Ask Cyberlium AI Mentor
Setup packs are boring on purpose — boring keeps GRC work defensible.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on GRC lab notes.
True or False
Knowledge Check
APPLY: A tutorial forges SOC 2 screenshots. You:
Multiple choice