LEARN. PRACTICE. GROW.Build a usable obligations register
Start with a stable requirement reference and an interpretation approved by someone competent to provide it. Add entity, service, dataset, purpose, version, dates and applicability status. One platform can serve two entities with different obligations; a hostname does not resolve that scope. Also record the person responsible for maintaining the interpretation and the event that triggers review. An unknown field should create work rather than become not applicable. All obligations in this exercise are fictional, and applicability is supplied as input. The program can check links and dates but cannot determine the law a real business must follow.
When two conditions cannot fit one configuration
Fictional requirement R1 demands at least 90 days for entity A’s orders dataset; R2 demands at most 30 days. If both are confirmed for the same dataset and period, no value satisfies both. Selecting 90 as seemingly more cautious violates the maximum; selecting 30 violates the minimum. Before changing data, confirm whether objects, copies, purposes and periods genuinely match. A valid separation between required records and working copies might exist, but that interpretation needs support and approval. The manager coordinates legal, privacy, business and implementation analysis while keeping the incompatibility visible until an applicable decision exists.
Trace from requirement to observation
The lab chain is requirement → policy → owner → evidence. A present link is not necessarily a correct link. The requirement may concern entity A while the policy concerns B; evidence may refer to an earlier requirement version. Check these keys before counting coverage. Record date, scope and result reference for each observation. If the team tested reports recovery, do not use that result as evidence about orders merely because both use the same storage. The register helps find the gap and assign the next action. Evidence still needs assessment of quality, relevance and integrity beyond this simple reconciliation.
Prepare and run the local lab
Use Python 3 and a fresh output directory: python3 content/labs/cism-governance-contracts/run.py --output /tmp/cism-governance-run-a. Execution creates clean and inconsistent inputs, reports and execution.json containing check results and hashes. The clean case has two applicable requirements and no flags; the inconsistent case has five distinct flags. Read the reasons instead of using only the count. To try another date or input, copy a fixture and run --input path.json --as-of 2026-10-07 --output /tmp/cism-analysis.json. In that mode the named output file is written directly: choose a disposable working path. No remote service is contacted.
Exercise: correct the link without hiding its origin
In inconsistent-input.json, r1 still links to p-orders, while p-orders-v2 supersedes it from the 8th. Compare reports for the 7th and 8th and explain the difference. Then link r1 to the current version and retain the change history in your decision note. The supersession flag should disappear while self-review and evidence-missing remain. Do not fill evidence with a generic sentence just to obtain zero flags: identify the needed test and who can assess its result. Submit before/after reports and three lines explaining the outstanding human decision. The hash identifies the reference bytes; it does not establish the truth of the observation they describe.
Exercise: distinguish conflict from scope difference
Create two effective requirements: a 90-day minimum and a 30-day maximum. First assign them to different datasets; then use the same dataset and entity. Predict the flag change before running. The routine identifies an impossible numeric intersection only when entity and dataset match. If one status is unknown, it does not treat that requirement as confirmed: it returns applicability-unresolved. In your response, separate configuration error, applicability uncertainty and potential conflict between requirements. Justify the additional information requested from each owner. Do not change dataset merely to remove a flag if the actual data would still be the same.
Practical case: integrate two policies in the Maré service
Entity A acquires B. Both use the Maré archive, but A retains orders and B retains reports. The team imports an old A policy for every row because it is the only version in the project repository. The register flags supersession and scope differences; the named reviewer also operated the configuration. Prepare a proposal with four deliverables: confirmed applicability map, correct policy links by entity/dataset, accepted owners and an assessment plan with the required independence. Phased integration can be proposed when scopes are separable and the decision is authorized. A generic sponsor approval does not repair links or prove operational effectiveness.
Interpret the result and consolidate learning
Two lab runs observed 30 checks each. That demonstrates behavior for these fixtures and executed code, not coverage of every possible obligation. Even without flags, inputs may omit a requirement, evidence may be false, a conflict may be nonnumeric or a reviewer may have dependencies not represented by a name. Complete the exercise by identifying one concrete limitation and a way to obtain additional evidence. Summarize the sequence: confirm scope, link versions, assign responsibility, obtain observations and reassess when assumptions change. Connect this lesson with enterprise governance, supplier management, change and assurance. A useful decision keeps known facts, missing information and accountable action visible.
Determine applicability before seeking a conflict
Turn an obligation into checkable conditions: entity, population, event, creation date, current state and deadline. A direct conflict exists only when incompatible requirements cover the same object and period. In an exercise, retaining A’s orders for at least 90 days and deleting B’s reports within 30 days can be compatible if populations are genuinely distinct and classification is maintained. A common platform does not make scopes identical. Transition rules can also differ. An additional signature may apply only to documents created from day 10, while an access catalogue applies to all documents active from that day. A document created on day 8 and active on day 12 needs the catalogue but does not meet the first rule’s creation condition. Do not infer retroactivity solely from a policy’s effective date. For contracts, branding, country and technology do not replace an explicit legal-entity condition. If a clause requires consent before that entity changes, a distinct subsidiary triggers the process even if branding stays within the group. Exercise: build a predicate table for these three situations and identify the required classification or interpretation evidence. These examples supply fictional rules; they do not interpret actual legislation.
Measure the exact commitment and preserve evidence scope
Before calculating an SLA, write down its denominator and authorized exclusions. With 1,000 scheduled minutes, 10 of preapproved maintenance and 7 of other outage, a definition excluding only maintenance has 990 eligible minutes and 983 service minutes. Availability is 983/990, about 99.293%, below 99.5%. Excluding every unavailable minute because its cause is known changes the commitment. Counting maintenance as service also changes the definition, even if the figure looks close. Review frequency and reviewed population are equally distinct. Two reviews following privilege changes may meet the requirement to examine each change before use. They do not establish that every permission was included in the monthly review. Use a record linking each piece of evidence to its population, period and corresponding requirement; do not discard valid evidence merely because it does not resolve another obligation. Exercise: reproduce the SLA fraction without rounding before comparison and build separate evidence rows for monthly and change-triggered review. The conclusion should distinguish demonstrated nonconformance from a requirement still lacking evidence. Arithmetic confirms only the exercise’s fictional definition.
Policy outcomes, Profiles and language equivalence
A policy may require access to stop working within ten minutes while a procedure permits administrative ticket closure within four hours. Check the required behavior before declaring a conflict: revocation at eight minutes and later closure documentation can satisfy both. A manager approving the procedure does not automatically gain authority to waive policy. In the CSF, a Current Profile describes the existing state and outcomes still being pursued; a Target Profile describes what is intended. Approved funding to cover service accounts does not establish that their reviews already happen. Link the gap to funded work and update achievement when evidence exists. Similarly, where a framework permits technical choice, a local implementation demonstrating outcomes and evidence export does not require an exception merely because it uses another product. Translation also implements policy: changing AND to OR changes requirements. If the document defines which version resolves discrepancies, apply that rule, correct the translation with its owner and retain mandatory conditions. Exercise: review a instruction and identify verbs, conjunctions, deadlines and participants whose meaning must be preserved. Do not assume a language is always superior; authority comes from the defined document process.
Transition governed by outcomes
A single-identity strategy can permit temporary coexistence to preserve daily close. Installing the new service is a delivery milestone; consumer migration and operational readiness are transition evidence. Define scope, retirement authority, readiness evidence and how unmet conditions are handled before the window ends. A local preference does not turn temporary coexistence into permanent architecture. When two outcomes are mandatory, seek a sequence preserving both. If disabling a shared account today leaves half the operators without access, but individual identities can be created and rehearsed today before retirement tomorrow within the authorized transition, rehearsed sequencing is a concrete proposal. Do not implicitly give security power to interrupt a service whose continuity remains required. Also measure the strategic outcome rather than activity alone. A larger percentage of automated approvals can coexist with more incorrect access corrected after activation. Connect the target to exposure duration and decision quality; retain automation as a supplementary indicator. Exercise: write a retirement gate and two measures, one for delivery and another for outcome. Explain what evidence would delay retirement without declaring the strategy abandoned.
python3 content/labs/cism-governance-contracts/run.py --output /tmp/cism-governance-run-aTwo requirements create a numeric conflict in the model only when effective and covering the same entity and dataset.
Common pitfalls
Automatically selecting the longer deadline; changing scope to clear flags; equating different names with independence; treating hashes as evidence of truth.
Related topics: Governance and authority · Change management · Evidence and assurance · Supplier management
A consistent register helps request the right decision; it does not determine compliance or replace competent analysis.
References
- The NIST Cybersecurity Framework 2.0 · CSWP 29, February 26, 2024
- CISM Exam Content Outline · Current outline before November 3, 2026
- SP 800-53 Revision 5 publication record · Publication includes December 2020 updates; release 5.2.0 notice dated August 27, 2025
- Security and Privacy Controls for Information Systems and Organizations · Revision 5, September 2020 with December 10, 2020 updates; later release 5.2.0 exists and is not claimed incorporated into this PDF