I can produce an evidence bundle, demonstrate the integrity of the audit trail rather than asserting it, and tell an auditor precisely what we do not know.
Before you start
The Operator credential. Experience of an audit, a customer security questionnaire or a regulator — from either side of the table. No configuration experience is assumed; where a lesson needs a setting changed it tells you who to ask instead.
What the exercises assume
A Qorionix tenant with at least thirty days of history. An evidence bundle from a tenant connected yesterday is technically valid and pedagogically useless.
Read access to the audit trail and to the compliance module. You do not need permission to change anything.
A copy of your own organisation's relevant obligation — your member state's NIS2 transposition, your DORA scope determination, or your ISO 27001 statement of applicability. The exercises compare the platform's output against your real obligation rather than a generic one.
Curriculum
Durations include the exercise and are meant honestly rather than optimistically — a lesson estimated at thirty minutes takes about thirty minutes. A lesson that would run past twenty-five minutes has been split into two.
Module 1 · 90 min · 4 lessons
What the regulations actually ask for
Four hours of reading compressed into ninety minutes, aimed at one question: which of these obligations produces a document, and which produces a behaviour? The platform can help with the first category and can only evidence the second.
Concept30 min
NIS2: the measures, the reporting clock, and management liability
Article 21 lists the measures. Article 23 sets the clock — an early warning inside twenty-four hours. Article 20 makes the management body personally liable, which is why this is a board conversation rather than an IT one, and why the artefact matters more than the control.
After this lesson you can
Map each Article 21 measure category onto either a platform capability, a policy document, or an organisational behaviour.
State the reporting sequence and its deadlines from memory.
Explain why management liability changes who the evidence is for.
Identify the Article 21 measures the platform cannot evidence at all, and say what does.
Concept25 min
DORA and ISO 27001: the crosswalk, and its limits
The platform maps findings to control references in both frameworks. A crosswalk is a starting point for an argument with an auditor, not a substitute for one, and this lesson is mostly about the seams.
After this lesson you can
Trace one posture finding through to its DORA and ISO 27001 references and judge whether the mapping is defensible.
Identify a mapping you would argue with, and construct the argument.
State what a control reference on a finding does not tell you.
Concept20 min
GDPR: what the platform holds about your people
A security platform is a large collection of personal data about your own staff: where they signed in from, what they ran, which files they touched. This lesson is about being able to describe that holding accurately, because the first question in any data-protection review is what you have.
After this lesson you can
Describe the categories of personal data the platform holds about an employee.
Identify which of those are needed for the security purpose and which are retention side effects.
State the retention period applying to your tier and what happens at the end of it.
Judgement15 min
Why compliance is the buying reason, and why that is a trap
Seventy percent of EU organisations name compliance as their primary security investment driver, ahead of any threat. That is the market reality this credential serves, and it is also how organisations end up with evidence and no security. This lesson is about noticing the difference in your own organisation.
After this lesson you can
Identify two controls in your organisation that exist for the audit and not for the risk.
Construct the argument for keeping one of them anyway.
Recognise when a compliance-first programme has produced a real gap, and name one in your own estate.
Module 2 · 100 min · 4 lessons
The evidence bundle
What is in it, what generated each part, what is stamped, and what you still have to write yourself. The last of those is the part most people discover the week before an audit.
Walkthrough25 min
What is in the bundle, and what generated each part
Go through a real bundle item by item, tracing each artefact back to the thing that produced it. An auditor's next question after 'show me' is always 'where did that come from', and an answer of 'the platform generated it' is not an answer.
After this lesson you can
For each section of a bundle, name the subsystem that produced it.
Distinguish an artefact derived from measured data from one derived from configuration.
Identify the sections that are hash-stamped and say what the stamp covers.
Hands-on lab30 min
Producing a bundle, and reviewing it before anybody else does
Generate one from your own tenant and then read it as an adversarial auditor would. You are looking for the three things that will be questioned: gaps in coverage, artefacts dated outside the review period, and anything phrased as a conclusion rather than an observation.
After this lesson you can
Produce a bundle for a defined period.
Review it and list every item an auditor would question.
Prepare a written answer for the three weakest items before the audit rather than during it.
Exercise
Produce a bundle, then attack it
You need
A tenant with at least thirty days of history
Ninety minutes
Steps
Produce a bundle covering the last thirty days.
Read it once as yourself, and note what you are pleased with.
Read it again as an auditor whose job is to find the gap. Write down every question you would ask.
Rank your questions by how badly they would go. Take the top three.
For each, write the answer you would give, including where the supporting detail comes from.
Identify anything in the bundle that reads as a conclusion about your compliance rather than an observation about your estate. Those are the sentences to be careful with.
How you know it worked
A bundle, a written list of auditor questions, and three prepared answers. If your list has fewer than five questions on it, you have not read it adversarially.
Concept20 min
The parts you still have to write
The platform produces artefacts about the estate. It does not produce your policies, your risk assessment methodology, your supplier register, your business continuity plan or your training records. This lesson is a checklist of what is yours.
After this lesson you can
List the Article 21 measures for which the platform produces nothing.
Determine which of those your organisation already has, and which it believes it has.
Produce a gap list with an owner against each item.
Hands-on lab25 min
Drafting the twenty-four-hour early warning
The clock starts when you become aware, not when you finish investigating, and the early warning is deliberately allowed to be incomplete. Drafting it from the incident record rather than from memory is what makes it fast enough and accurate enough at the same time.
After this lesson you can
Draft an early warning from an incident record inside twenty minutes.
Distinguish what must be in the early warning from what belongs in the later notification.
State who in your organisation sends it, and confirm that person knows.
Exercise
Draft an early warning against the clock
You need
One real or exercise incident record
A timer
Steps
Pick the most significant incident in your tenant's history. If there is none, use the highest-severity alert.
Set a timer for twenty minutes.
Draft the early warning using only the incident record — no asking colleagues, no memory.
Stop at twenty minutes regardless of state.
Note every field you could not fill, and where that information would have to come from.
Find out whether the named sender in your organisation knows they are the named sender.
How you know it worked
A draft, a list of unfillable fields with sources, and a confirmed answer about who sends it. The third one is the finding most organisations get wrong.
Module 3 · 90 min · 4 lessons
Proving the audit trail
The most technical module in this course, and the one that distinguishes this credential. An audit trail everybody asserts is intact is worth nothing; the skill is demonstrating it, and interpreting the result correctly when it fails.
Concept25 min
How a hash-chained trail works, in enough detail to explain it
Each entry commits to the previous one, and each entry's own content is committed to under a keyed digest, so somebody with database access cannot edit a row and re-chain around it. You need this mechanically, because an auditor will ask and 'it is hash-chained' is not an explanation.
After this lesson you can
Explain the mechanism to a non-cryptographer in under two minutes.
State what a keyed digest adds over a plain hash, in terms of the attacker it defeats.
Name the nine stored fields the digest covers, or state how you would find out for your version.
Hands-on lab30 min
Linkage or content: the two failure modes and what each means
Verification returns a reason. linkage means an entry was inserted or removed. content means an existing entry was edited. These imply different incidents, different notifications and different next steps, and confusing them will send an investigation in the wrong direction on day one.
After this lesson you can
Run a verification and read its result.
Given a linkage result, state what happened and what you check next.
Given a content result, state what happened, what it implies about database access, and who you notify.
Explain why a verifier that only checked linkage would report an edited attribution field as intact — and why that was a real defect rather than a hypothetical.
Exercise
Verify, and reason about both failure shapes
You need
Read access to the audit trail and its verification surface
Steps
Run a verification over the whole trail and record the result and the elapsed time.
Write down what you would do, step by step, if it returned linkage. Include who you would tell within the first hour.
Write down what you would do if it returned content. Note where the two procedures diverge.
Identify which of the two is worse for your organisation and justify it.
Add the verification to a scheduled routine, with a named owner. An integrity check nobody runs is a control that does not exist.
How you know it worked
A recorded verification result, two divergent written procedures, and a scheduled owner.
Concept20 min
What chain verification does not prove
It proves that entries were not inserted, removed or edited after the fact. It does not prove that the right things were written in the first place. The gap between those two statements is where a competent adversary lives, and being able to articulate it is what makes the rest credible.
After this lesson you can
State three things an intact chain does not tell you.
Explain the difference between integrity of the record and completeness of the record.
Identify one action in your own estate that would not appear in the trail at all, and decide whether that matters.
Walkthrough15 min
Machine actors and human actors
The trail records a machine actor distinctly from a human one, which is what lets you answer 'did a person decide this?' — a question that is becoming the first one an auditor asks about any AI-assisted control.
After this lesson you can
Find an entry with a machine actor and an entry with a human actor and state how they differ.
Produce, for a defined period, the list of changes made without a human in the loop.
Explain why that list is the single most useful artefact for an AI governance review.
Module 4 · 75 min · 3 lessons
Answering people
Subject access requests, security questionnaires, and the conversation where you have to say what you do not know. The last lesson is the one that decides whether an auditor believes the rest.
Hands-on lab25 min
Answering a subject access request
An employee asks what you hold about them. Much of it is security telemetry, some of it is another person's data too, and the statutory clock is running. This lesson produces a repeatable procedure rather than a one-off answer.
After this lesson you can
Produce an export for one identity and review it before release.
Identify data in the export that relates to a third party and decide how to handle it.
Write the procedure, with a measured elapsed time, so the next request does not start from scratch.
Exercise
Run a request against yourself
You need
A tenant where you have thirty days of your own activity
Steps
Produce the export for your own identity.
Read it. Note anything you did not expect the platform to hold.
Find at least one record that also identifies somebody else, and decide what you would redact.
Time the whole procedure and write it down as a runbook.
Note anything a requester would ask for that the export does not contain.
How you know it worked
An export, a redaction decision with a reason, a timed runbook, and a list of gaps.
Judgement25 min
Security questionnaires, answered without overstating
Twelve questions taken from real customer questionnaires, including four where the honest answer is worse than the answer you would like to give. The skill being taught is the wording that is accurate and still gets you through procurement.
After this lesson you can
Answer a data-residency question accurately, including the part about AI inference geography being unverified.
Answer a 'do you detect zero-days' question without either lying or losing the deal.
Recognise the three questions where the correct action is to escalate to whoever can commit contractually.
Explain why an answer you cannot evidence is a liability rather than a sale.
Judgement25 min
Saying what you do not know
Skipped checks, shadow rules, uncovered ATT&CK tactics, unverified inference geography, and the fortnight before behavioural baselines exist. Every one of these is a gap you should raise before an auditor finds it, and this lesson is about the order and the framing.
After this lesson you can
Produce, for your own tenant, the complete list of known coverage gaps with the reason for each.
Explain a skipped check to an auditor in a way that does not read as an excuse.
Decide which gaps belong on the risk register and which are the platform's published limits.
Rehearse the answer to 'so what would you miss?' in under ninety seconds.
Exercise
The gap register
You need
Your own tenant
Your organisation's risk register, if one exists
Steps
List every skipped posture check and the reason it is skipped.
List every shadow detection rule and whether you shadowed it or it arrived that way.
Note the two ATT&CK tactics not covered, and satisfy yourself that the stated reason holds.
Note the AI inference geography position and whether your organisation has accepted it in writing.
Combine these into one page. Take it to whoever owns the risk register.
How you know it worked
A one-page gap register with a reason against every line, accepted or challenged by a named person.