Practice with fictional evidence
Practical resources and glossary
Use these blank learning templates to explain your reasoning. They are educational worksheets, not audit certificates, regulator submissions or operational approval.
- Risk register — download template
- Access review — download template
- Incident timeline — download template
- Authorized assessment report — download template
- Study and framework evidence workbook — download template
Use synthetic facts only. Do not upload customer records, real credentials, personal identifiers or confidential incident evidence. Templates contain no macros or live data connections.
Use the templates by course
- CC: identify assets, distinguish access decisions and explain a reporting action.
- CISM: assign a risk owner, compare responses and record a reasoned management decision.
- CISSP: trace trust boundaries, assessment evidence and recovery dependencies.
- CEH: define authorization and scope, validate a finding and document retesting.
Suggested study plans · Frameworks and Indian regulatory context
Shared glossary
- Asset
- Information, a service or another resource whose loss or misuse can affect an objective.
- Risk owner
- The accountable person authorized to decide treatment of a business risk within delegated limits.
- Residual risk
- Risk remaining after the selected response and safeguards.
- Custodian
- A role implementing approved handling and operational safeguards for an asset.
- Authentication
- Checking proof of a claimed identity.
- Authorization
- Deciding whether an identity may perform an action on a resource.
- Least privilege
- Only the authority necessary for the task, for only as long as needed.
- Trust boundary
- A point where information or actions move between different trust assumptions and require appropriate checks.
- Control evidence
- Records or observations supporting a specific conclusion about a control within a defined scope.
- Triage
- Evaluating a signal using context and other evidence to decide priority and response.
- Recovery point objective
- The target point in time to which data must be restored, reflecting acceptable data loss.
- Recovery time objective
- The target time for restoring an agreed usable service or activity.
- Test scope
- The specifically authorized targets, methods, timing, data handling and limits of an assessment.
- False positive
- A reported issue or alert that does not represent the condition claimed after suitable validation.
- Framework mapping
- A reasoned relationship between concepts or controls, not proof of equivalence or legal compliance.