Lion Cipher Lab
Find which controls fail most across a year of incidents
- GRC / Compliance
- Intermediate
- ~35 min
- Free · no account required
Why it matters
Each incident gets an after-action review, and each review produces fixes for that incident. What rarely happens is the next step: adding up a year of reviews to see which controls keep failing. NIST SP 800-61 Rev. 3 frames incident response as part of continuous improvement, with lessons learned feeding back into risk management. Mapping each incident to the NIST SP 800-53 controls that failed gives a common vocabulary for that. Counted across a year, failures usually concentrate in a few controls, the 'vital few' of a Pareto analysis, and those are where control investment pays off. There…
What you'll learn
- tagging incidents with the NIST SP 800-53 controls that failed
- building a Pareto table of control failures
- finding the 'vital few' controls behind most incidents
- comparing ranking by frequency with ranking by cost
- seeing how one large incident can dominate a cost ranking
- turning the result into control investment priorities
Steps in this lab
- From single reviews to a year of evidence
- A year of incidents
- Write the Pareto analysis
- Run it: frequent and cheap, rare and expensive
- Report both rankings, and check the tagging