Zero › Module 10 › Lesson 3
Evidence Pack
Assemble ZT evidence pack — index all pillar artifacts with LAB labels — capstone-evidence-index on YOUR $ZT_LAB.
Visual · t40_evidence_pack
Evidence pack. $ZT_LAB. Original Cyberlium.
Opening
Seal the evidence pack — index every diagram, checklist, and pack with integrity statement before capstone lab execution.
Bundle index: artifact name, module, path, UTC date, LAB SAMPLE label, description. Integrity paragraph: fictional org discipline, no attack tools, no employer imports, honest maturity gaps from M9. Python or markdown index generation OK on $ZT_LAB. Next: Capstone Lab.
1. Index fields
Artifact name, module lesson, path, UTC date, description, LAB label, diagram type if applicable.
Checklist row ↔ index row accountability.
Command guide
Try these commands — Index fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
python3 - <<'PY'
import os
lab = os.environ.get('ZT_LAB', os.path.expanduser('~/cyberlium-lab/t40-zt'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
'CAPSTONE EVIDENCE INDEX — YOUR t40-zt lab fictional LAB-ZT-001 only',
'Ethics: roe.txt, no-attack-tools.txt',
'Principles: nist-800-207-named.txt + verify flow + least privilege matrix',
'Identity: identity-pillar-pack.md',
'Devices: device-trust-pack.md',
'Network: network-pillar-pack.md + microseg-pack.md',
'Data: data-pillar-pack.md',
'Policy: policy-engine-pack.md (master pillar links)',
'Roadmap: roadmap-pack.md (Gantt + maturity + KPI)',
'Diagrams: microseg tiers, ZTNA path, PEP/PDP, data flow',
'Label: LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS',
'Refusals: no attack tools / no lateral movement / no forged maturity certs',
'Next: Topic 41 Security Architecture & Design',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'LAB SAMPLE|Refusals|Topic 41' "$ZT_LAB/notes/capstone-evidence-index.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity
$ZT_LAB only, LAB label discipline, no attack tool refs, no forged maturity certs, share-safe export.
Scan before seal — remove accidental employer data or attack keywords.
3. Gap note for Topic 41
Note one architecture design question to carry into Topic 41 Security Architecture & Design.
Ship: evidence pack index. Next: Capstone Lab.
4. What you ship: ZT evidence pack index
Bundled deliverables + index + integrity — chmod 600, attack tools refused by default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes lateral movement script index row. Missing LAB SAMPLE labels.
Right
Evidence pack indexed. Next: Capstone Lab.
Mission: assemble evidence pack
1) Index all pillar packs and diagrams. 2) Integrity paragraph. 3) Topic 41 handoff question. 4) Zero attack tool refs in grep scan.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Minimum index rows for capstone?'
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Attack tool refs OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice