Module 4 · Week 10 · Lab 2 · about 45–60 minutes
Prioritize Risks and Recommend Controls
Everything cannot be first. This lab is about deciding what the clinic should do next, and being able to explain why to someone who is not technical.
You are finished when every risk has a likelihood and an impact with reasons, two priorities are chosen and explained, each priority has a control with its remaining risk described, and the owner briefing is written.
Carried over
Your Lab 1 scenarios
These are the same rows, matched by their IDs. Editing Lab 1 keeps everything you write here; deleting a row would remove its rating and control so your report can never show work for something that no longer exists. If you change a scenario in Lab 1, reread its rating and recommendation here and update them if they no longer fit.
5 scenarios have no threat written yet in Lab 1. You can still rate here, but finish Lab 1 for a complete report.
- SC-01 — Risk 1: Appointment scheduling account · (no threat written yet)
- SC-02 — Risk 2: Patient records application · (no threat written yet)
- SC-03 — Risk 3: Staff laptops · (no threat written yet)
- SC-04 — Risk 4: Public information website · (no threat written yet)
- SC-05 — Risk 5: Backup archive · (no threat written yet)
How to choose a number
Likelihood
Based on exposure, the weaknesses you found, and protections already in place. These are judgements, not statistics — there is no percentage behind them.
- 1 — LowLittle exposure, few or no matching weaknesses in the evidence, and protections already in place that would usually stop it.
- 2 — MediumThere is real exposure and at least one weakness in the evidence, but something partial stands in the way.
- 3 — HighThe exposure is routine, the weakness is present in the evidence, and nothing found so far would reliably stop it.
Impact
Based on clinic operations, sensitive data, and how hard recovery would be.
- 1 — LowNoticeable nuisance. Clinic operations continue, sensitive data is not affected, recovery is quick.
- 2 — MediumPart of the clinic's day is disrupted, or limited sensitive data is involved, or recovery takes real effort.
- 3 — HighClinic operations stop or patient data is exposed or lost, and recovery is slow, uncertain, or untested.
Step 1
Rate each risk
Risk 1 SC-01 · Appointment scheduling account
(no threat written in Lab 1 yet)
Score: — × — = not rated · Not rated yet
Risk 2 SC-02 · Patient records application
(no threat written in Lab 1 yet)
Score: — × — = not rated · Not rated yet
Risk 3 SC-03 · Staff laptops
(no threat written in Lab 1 yet)
Score: — × — = not rated · Not rated yet
Risk 4 SC-04 · Public information website
(no threat written in Lab 1 yet)
Score: — × — = not rated · Not rated yet
Risk 5 SC-05 · Backup archive
(no threat written in Lab 1 yet)
Score: — × — = not rated · Not rated yet
Risk matrix
Each cell lists every risk with that combination, so overlapping scores are all visible. Bands are written out as words as well as position — colour is never the only signal. These bands (1–2 low, 3–4 medium, 6–9 high) are a classroom teaching aid, not a compliance standard.
| Likelihood ↓ / Impact → | Impact 1 | Impact 2 | Impact 3 |
|---|---|---|---|
| Likelihood 3 | Score 3 · Medium (3–4)— | Score 6 · High (6–9)— | Score 9 · High (6–9)— |
| Likelihood 2 | Score 2 · Low (1–2)— | Score 4 · Medium (3–4)— | Score 6 · High (6–9)— |
| Likelihood 1 | Score 1 · Low (1–2)— | Score 2 · Low (1–2)— | Score 3 · Medium (3–4)— |
Same information as a list
- Risk 1 (SC-01) — likelihood not rated, impact not rated, score not rated, Not rated yet
- Risk 2 (SC-02) — likelihood not rated, impact not rated, score not rated, Not rated yet
- Risk 3 (SC-03) — likelihood not rated, impact not rated, score not rated, Not rated yet
- Risk 4 (SC-04) — likelihood not rated, impact not rated, score not rated, Not rated yet
- Risk 5 (SC-05) — likelihood not rated, impact not rated, score not rated, Not rated yet
Step 2
Choose your two priority risks
Usually the highest scores, but not always. A different choice is fine when you can explain it — and ties are normal.
Step 3
Recommend a control for each priority risk
Choose your priority risks above and they will appear here.
Show a hint
Step 4
Briefing for the practice manager
About 100–150 words, in plain language, for someone who is not technical. The word count is a guide — nothing is blocked if you go over or under.
0 words.
Show a hint
Your Week 10 summary
This is a picture of your own work so far. Nothing here is graded, and no model answers are shown — it simply reflects what you have opened, chosen and written. Opening a room records that you looked at it; it does not say your answer is right.
Rooms you have visited
- Not opened yet:Reception
- Not opened yet:Records Office
- Not opened yet:Staff Workspace
- Not opened yet:Website Station
- Not opened yet:Backup Room
0 of 5 rooms opened.
Evidence in your findings
You have not added any evidence yet. Open a room and use “Add to my findings”.
Decisions you have recorded
Everything below is your own writing.
1. Appointment scheduling account SC-01
- Your threat / event
- Not written yet
- Evidence attached
- None chosen yet
- Likelihood × impact
- Not rated yet — Not rated yet. Not rated yet.
- Recommendation
- Not chosen as a priority
2. Patient records application SC-02
- Your threat / event
- Not written yet
- Evidence attached
- None chosen yet
- Likelihood × impact
- Not rated yet — Not rated yet. Not rated yet.
- Recommendation
- Not chosen as a priority
3. Staff laptops SC-03
- Your threat / event
- Not written yet
- Evidence attached
- None chosen yet
- Likelihood × impact
- Not rated yet — Not rated yet. Not rated yet.
- Recommendation
- Not chosen as a priority
4. Public information website SC-04
- Your threat / event
- Not written yet
- Evidence attached
- None chosen yet
- Likelihood × impact
- Not rated yet — Not rated yet. Not rated yet.
- Recommendation
- Not chosen as a priority
5. Backup archive SC-05
- Your threat / event
- Not written yet
- Evidence attached
- None chosen yet
- Likelihood × impact
- Not rated yet — Not rated yet. Not rated yet.
- Recommendation
- Not chosen as a priority
- Suspicious email: 0 of 3 warning signs written, reporting step still to write.
- Priority reasoning: 0 of 2 priorities chosen.
- Owner briefing: not started yet.
- Notebook (optional): nothing entered yet.
Still to do
Investigation steps left — this lab asks you to walk all 5 rooms:
- • Lab 1 — All 5 clinic rooms opened (the walkthrough this lab asks for)
- • Lab 1 — At least five pieces of evidence added to your findings
- • Lab 1 — Scenario 1 (SC-01): evidence, threat, vulnerability, consequence and at least one CIA concern
- • Lab 1 — Scenario 2 (SC-02): evidence, threat, vulnerability, consequence and at least one CIA concern
- • Lab 1 — Scenario 3 (SC-03): evidence, threat, vulnerability, consequence and at least one CIA concern
- • Lab 1 — Scenario 4 (SC-04): evidence, threat, vulnerability, consequence and at least one CIA concern
- • Lab 1 — Scenario 5 (SC-05): evidence, threat, vulnerability, consequence and at least one CIA concern
- • Lab 1 — Email analysis: three warning signs, a safe reporting step, and your "suspicious vs proven" reflection
- • Lab 2 — Risk 1 (SC-01): likelihood and impact rated, both with a reason
- • Lab 2 — Risk 2 (SC-02): likelihood and impact rated, both with a reason
- • Lab 2 — Risk 3 (SC-03): likelihood and impact rated, both with a reason
- • Lab 2 — Risk 4 (SC-04): likelihood and impact rated, both with a reason
- • Lab 2 — Risk 5 (SC-05): likelihood and impact rated, both with a reason
- • Lab 2 — Two priority risks chosen, with your reasoning
- • Lab 2 — Each priority risk has a control, how it helps, and remaining risk described
- • Lab 2 — Owner briefing written (about 100–150 words is the guide, not a limit)
Your Week 10 investigation is not finished yet. Finish the steps above before you upload your reports to GitHub.
Your progress
- Still to do:Lab 1 — All 5 clinic rooms opened (the walkthrough this lab asks for)
- Still to do:Lab 1 — At least five pieces of evidence added to your findings
- Still to do:Lab 1 — Scenario 1 (SC-01): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 2 (SC-02): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 3 (SC-03): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 4 (SC-04): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 5 (SC-05): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Email analysis: three warning signs, a safe reporting step, and your "suspicious vs proven" reflection
- Still to do:Lab 2 — Risk 1 (SC-01): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 2 (SC-02): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 3 (SC-03): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 4 (SC-04): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 5 (SC-05): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Two priority risks chosen, with your reasoning
- Still to do:Lab 2 — Each priority risk has a control, how it helps, and remaining risk described
- Still to do:Lab 2 — Owner briefing written (about 100–150 words is the guide, not a limit)
Completion means the required work is present. Nothing here grades your wording.
Study mode and saving
Ready · Saved on this browser/device only. This is not cross-device sync — use the JSON backup to move your work.
Saved with your Week 10 work on this browser/device and included in your JSON backup.
Downloads
Reminder: enter your name above before downloading, so your reports show who wrote them.
Reports contain your own writing only. Unfinished work is still downloadable and is clearly marked as a draft with a list of what is missing.
How to add your Week 10 reports to your GitHub portfolio
- 1. Finish the lab here, check the required-work list and your reasoning, and enter or check your name above.
- 2. Use Download Lab 1 report (Markdown) to get week10-lab-1.md, or Download Lab 2 report (Markdown) to get week10-lab-2.md.
- 3. Open your own existing CyberFoundations student portfolio repository on GitHub — not the institute's template repository. Week 10 reports belong in the week-10/labs/ folder, the same pattern as Week 8 (week-08/labs/) and Week 9 (week-09/labs/). The full destinations are week-10/labs/week10-lab-1.md and week-10/labs/week10-lab-2.md.
- 4. If the week-10/labs/ folder does not exist yet, create it once: from your repository's main page choose Add file → Create new file, type week-10/labs/README.md as the filename, add a short heading such as # Week 10 Lab Reports, and choose Commit changes. If the folder already exists, use it as it is — don't replace an existing README.
- 5. Open the week-10/labs/ folder, choose Add file → Upload files, select the matching downloaded .md report, check the filename and destination, type a meaningful commit message, and choose Commit changes (follow GitHub's confirmation if it asks).
- 6. Open the committed file on GitHub and confirm your name and latest completed answers show. Downloading a report alone does not upload it to GitHub or submit it for grading.
Revising a report
Edit your answers here, download a fresh report, and keep the original filename (remove any “(1)” or “(2)” your browser added). Upload it to the same week-10/labs/ folder under the same filename, check that you are updating the intended file, commit, then reopen it to verify. Do not delete your other work.
- • Grading submission instructions will be provided separately.
- • The combined portfolio report is optional and does not replace the two individual reports.
- • The JSON backup only restores editable work in this demo — it is not a lab report to upload.
- • Screenshots are optional.
Backup and restore (this browser only)
Your work is saved on this browser/device. To move it to another computer, download the backup file here and restore it there. This is a file you carry, not automatic sync.
Reset Week 10
This clears only your Week 10 work. Work from other weeks is untouched. Download a backup first if you might want it back.