Lion Cipher Lab

Map your controls to the NIST Cybersecurity Framework

• GRC / Compliance
• Beginner
• ~45 min
• Free · no account required

Why it matters

Naming a framework is easy; using one is the job. GRC and audit work is largely this exact motion — take a real environment, map what it already does to each part of a framework, rate how mature each practice is, and write down the gaps so leaders can decide what to fund next. Doing it once on a small environment you fully understand teaches the skill without the noise of a giant enterprise. It also fixes the most common misconception a beginner brings in: that a framework is a test you pass or fail. It is not. It is a structured checklist that turns a vague worry ("are we secure?") into a…

What you'll learn

• control mapping
• NIST CSF 2.0 Functions
• maturity rating
• gap analysis
• building a CSF self-assessment
• GRC fundamentals

Steps in this lab

1. The five words this lab runs on
2. Pick a real environment and open your table
3. Agree on your maturity scale before you rate anything
4. Map Govern and Identify — decisions, then inventory
5. Map Protect and Detect — safeguards, then noticing
6. Map Respond and Recover — the plan, then getting back up
7. Run the gap analysis — turn six rows into a to-do list
8. What you just built — and the mindset that outlasts it

Open the full interactive lab →