Lion Cipher Lab
Find key-person dependencies in critical security processes
- GRC / Compliance
- Intermediate
- ~35 min
- Free · no account required
Why it matters
Plenty of security teams have a process only one person really knows how to run: the firewall change approval, the HSM key ceremony, the certificate renewal that happens once a year. On paper there is a backup, because the roster lists one. In practice the backup has never done it. When the one person who can is on holiday, ill or has left, the process stops or is done badly. NIST SP 800-34 builds contingency planning around making sure people can carry out recovery and continuity tasks, and NIST SP 800-53 control CP-3 requires contingency training for the people assigned those roles. A…
What you'll learn
- the difference between listed cover and trained cover
- computing each process's real bus factor
- asking what would be left uncovered if one person left
- spotting processes nobody is trained for
- turning results into a cross-training plan
- what a roster cannot tell you
Steps in this lab
- Cover means trained, not listed
- The process roster
- Write the dependency check
- Run it: one gap on paper, six in practice
- Turn it into a cross-training plan