Lion Cipher Lab
Run a policy lifecycle and catch overdue reviews and expired exceptions
- GRC / Compliance
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Most organizations have security policies. Far fewer have policies that are current, owned, approved, acknowledged by the people they bind, and honest about their exceptions. The difference is invisible until an audit, a customer security questionnaire, or an incident review asks the simple questions: when was this policy last reviewed, who approved it, did staff acknowledge it, and why is this exception from 2023 still open? Every major framework asks them. NIST SP 800-53 opens almost every control family with a '-1' control that requires documented policy, a named official to manage it, and…
What you'll learn
- the policy lifecycle: draft, approve, publish, attest, review, retire
- building a policy register an auditor can test
- review cycles and how NIST SP 800-53 '-1' controls define them
- tying exceptions to a policy with an approver and an expiry
- measuring staff attestation coverage
- automating lifecycle checks with a stdlib Python script
- telling a paper-current register from a working policy program
Steps in this lab
- The lifecycle, and what an auditor actually tests
- Build the register: three small files
- Write the lifecycle checker
- Run it and read the rot
- The bug that hid three policies: check for what is missing
- Close the loop: fix the register, rerun, schedule it