You have done the project and assessed yourself. Now comes the comparison. This lesson develops one reference solution — on Clínica Dental Sonrisa Norte, the richest case because of its health data and the furthest from Nimbus — with enough extracts from the eight deliverables and, above all, with the explicit reasoning behind every decision: why this risk comes first, why this control and not the expensive one, what is left out and with what argument. It is not the whole dossier: it is the part that sets the standard.

After that come the hard calls commented on, which is where professional judgement really shows; the typical mistakes that recur in the dossiers of people starting out; and the honest comparison with yours. And then the closing: where to go next. The map of specialisations within the profession, certifications commented on without embellishment, how to keep learning in practice, the habits of the first months, one last look at Nimbus and the end of the course.

1. How to read this solution
2. E1 — Context, inventory, DFD and STRIDE
3. E2 — The main risks, with ALE and ROSI
4. E3 and E4 — Policies and the catalogue that fits in 9,000 €
5. E5 — Runbook for the most likely scenario, RTO and RPO
6. E6 — The minimum detections
7. E7 — GDPR with health data, DPIA and the ENS question
8. E8 — Traceability and quarterly roadmap
9. The hard calls, commented on
10. Typical mistakes and how to fix them
11. The honest comparison with your dossier
12. Map of specialisations within the profession
13. Certifications, commented on honestly
14. How to keep learning in practice
15. Nimbus: before and after

Three warnings before we start, because whether this lesson is useful to you depends on them.

It is not the correct answer, it is a defensible answer. Another professional with the same data could arrive at a different risk order and a different catalogue, and both would be valid if they are justified. What does not admit variation is the method: that every control points to a risk, that every risk has an owner, that the sums reconcile and that every decision has its reason written down.

Do not copy it over your own work. If your solution differs, your job is to understand why it differs and to decide which argument is better: that comparison exercise is worth more than the dossier itself. And bear in mind that it is deliberately incomplete — you will see 5 risks out of 11, 7 controls out of 16 and part of the matrix: what is shown is what sets the standard, and the rest is more of the same with a lower density of decision.

The scope you already saw in 07-01: the clinical and administrative information systems of the three sites, the connectivity, the e-mail, the website, the patient channels and the third parties with access; out of scope, physical security beyond the server room and equipment that does not process data. Constraints: 9,000 €/year, 180 h of Nuria's time, 120 h contracted from Datacer Norte and no internal technical staff.

Inventory (extract from 22 assets). The classification uses four levels and the criticality is justified by clinical impact, not by the cost of the equipment.

Why A-11 and A-18 are in the inventory. Because the point of inventorying is not to list boxes. A-11, the vendor's shared account, is the asset the number one risk hangs from; if it is not inventoried, nobody owns it and nobody decides anything about it. A-18, reputation, is the asset that revenue depends on in a local, recommendation-driven business, and without it no reputational impact can be scored. And A-21, the processing contracts, is an intangible asset whose absence is directly an infringement of article 28.

The DFD and the trust boundaries. The flow modelled is a clinical record being consulted from a treatment room at the Oviedo site.

The three boundaries and what they mean. FC-1 separates one site from another across a VPN over consumer equipment: clinical traffic crosses a boundary nobody audits. FC-2 is the worst of the three: a third party comes in with an identity that belongs to nobody. FC-3 is a permanent access that requires no justification. Note what is not a boundary: the copy to the NAS happens inside the same zone, and that is exactly the problem — there is no boundary at all between what gets encrypted and its backup.

STRIDE of the flow (extract).

Notice that the R (repudiation) is the one that hurts most here and it is the one almost everybody brushes aside. In a healthcare setting, traceability of access to the clinical record is not good practice: it is a requirement of Law 41/2002. The shared session turns a legal requirement into something impossible by design.

Eleven risks in the register. These are the first five, in the order decided.

Why R-01 comes first, and not R-02 which is more likely. Because it is the only risk in the register whose worst case is irreversible. R-02 happens daily and its impact is penalties and reputation: serious, expensive and repairable. R-01 happens less often, but its worst case — the server and the NAS encrypted, with no off-site backup — is the disappearance of the clinical records of 4,800 patients and the closure of the practice. When a risk is irreversible, irreversibility weighs more than frequency. That principle, written into the dossier, is what makes the order defensible.

Quantification of R-01.

What this calculation actually does. It is not for knowing how much will be lost: it is for putting "19,080 € a year of expected risk" and "780 € for an off-site backup" in the same sentence, and that sentence is what gets Elena to sign in thirty seconds. The ALE is not a prediction, it is an argument. And that is why it carries its assumptions in writing: the moment anyone argues about the ARO, the conversation is already the right one.

The accepted risk. R-10 (no processing contracts with two minor third parties: the confidential waste company and the dental laboratory) is formally accepted until the fourth quarter, with dated approval from Elena Vázquez, because C-07 is planned for Q3 and regularising them sooner requires legal advice that has not been engaged. Accepting with a date, an approver and a plan is a decision; not mentioning it is an oversight.

The two policies written in full are POL-02 (Access Control and Clinical Identity) and POL-03 (Patient Communication and Channels), and the choice is justified in one line: POL-02 attacks R-01 and R-04 — the two identity problems — and is a precondition of the traceability Law 41/2002 requires; POL-03 is the only realistic route for R-02, because no technical measure resolves a habit on its own. The other six policies are mapped with an owner and a priority, to be published over the following twelve months.

The complete catalogue: 16 controls, 7,190 € and 168 h of Nuria's time.

Three readings of the catalogue, worth more than the table. First: seven of the sixteen controls cost zero euros and they are the ones attacking the number one risk. In this practice, as at Nimbus, the problem was not the budget: it was that nobody had the hours assigned. Second: there are four detective controls and three recovery ones, not only preventive, because detective blindness is what turns an incident into a catastrophe. Third: the margin on Nuria's hours is zero, and that is stated explicitly in the dossier together with the decision about what falls first if something unexpected comes up — C-08 is postponed by a quarter, because R-02 has a provisional administrative mitigation in the meantime and no other control has one.

What is left out.

RB-01 — File encryption on the Gijón server (extract of phases 0 to 2, which are the ones executed in a hurry and therefore the ones that must be written best):

What makes this runbook good: it says which port on the rack, it gives a phone number, it orders the NAS to be disconnected before anything else — the step that decides whether the incident is recoverable — and it places the start of the 72-hour clock at a specific decision with a criterion, not at a hunch.

BIA and backup strategy.

"Last successful restore: NEVER" goes into the executive summary, word for word. It is a single line and it is the one that approves the 780 €.

Eight detections, all operable with the hours available and all with their test.

The most profitable detection in the catalogue is D-03, and it watches no attacker at all: it watches that the backup ran. It costs zero euros, and it is what stops anyone discovering on the day of the incident that the backup has been failing for five weeks. The second is D-01, which covers the R-01 vector and additionally proves compliance with C-01: the same alert serves as a detective control and as audit evidence.

Verification plan. An external scan of the exposed surface and a configuration review with Datacer, twice a year, 8 h/year. Pentest: not this year (an argued discard). And every detection is tested when it is implemented and once a year, with the test written on the detection's own card: it is what avoids the classic finding that the alert existed and did not fire.

Roles. The practice is the controller of its patients' and its employees' data. It is at the same time the one that engages processors: Datacer Norte, the DentaGest vendor, the dental laboratory, the payroll bureau, the marketing agency and the confidential waste company. All six need an article 28 contract (C-07), and two do not have one (R-10, accepted with a date).

RoPA: four processing activities. T-01 clinical records; T-02 HR management; T-03 radiological images; T-04 acquisition and marketing. The one that matters:

Two details that always slip through. The first: the lawful basis for clinical records is not consent. Asking for consent to process the record would in fact be wrong, because it could not be withdrawn without leaving the practice in breach of Law 41/2002. The second: article 9.2.h additionally requires the duty of secrecy under 9.3, which is what turns access traceability — and therefore C-05 — into an obligation rather than an improvement.

DPIA: yes, for T-01 and T-03. Two criteria are met: large-scale processing of article 9 data (4,800 active patients, three sites, continuous activity) and data on vulnerable people (minors). One alone already recommends it; two make it required in practice. For T-04, marketing, the decision is NO, and the reason is documented: no article 9 data, no profiling and no automated decision-making. Documenting the negative is as important as documenting the positive.

And the ENS. Today it does not apply: the practice is private and does not provide services to the public administration. It would apply through the contract if it were to enter into an arrangement with a public health insurer collaborating with the Social Security system or with the public health service, because the tender documents would pass on the requirements of Royal Decree 311/2022 — foreseeably the basic category — along with the obligation to declare conformity. It is recorded in the dossier as a business risk with a deadline: if Elena signs such an arrangement, there are between six and twelve months of work ahead and it has to be negotiated in the contract, not discovered afterwards.

Professional validation note. The "large scale" qualification, the specific requirement for a DPIA, the retention periods for clinical records — which have regional development — and the real scope of the ENS in a public arrangement all depend on the rules in force and on the supervisory authority's criteria. Check the BOE (Spain's official gazette), the lists published by the AEPD and the healthcare rules of your region, and consult a Data Protection Officer or a legal adviser before closing these decisions in a real organisation.

Traceability matrix (extract from 14 rows).

12-month roadmap. Ordered by risk, not by ease, and with the whole first quarter at zero cost so that the plan starts without waiting for an invoice to be approved.

How it is defended to Elena. Not as sixteen technical tasks, but like this: "the worst-scored risk has an expected cost of 19,000 € a year and we bring it down to a manageable residual with 1,170 € in the second quarter; the first quarter costs nothing; and the most expensive item — identity in the treatment rooms — goes last because it is what annoys the dentists most and I need the previous three quarters of credibility before asking for it". That last sentence is not technical and it is the most important one in the plan.

This is where professional judgement lives. Five real trade-offs, with what was chosen, why, and what would have changed the answer.

1. WhatsApp: ban it or replace it? Options: ban it in POL-03 with immediate effect, or replace it with an integrated channel and withdraw it over nine months. Chosen: replace. Banning it on day one is free, it is correct on paper and it is not going to be complied with: reception would carry on using it from their personal phones, so the data would leave anyway and would also stop being visible. Indicator 6 measures a curve from 120 photos a month to zero, not a switch. What would have changed the answer: if there were already an open inspection or a patient complaint, an immediate ban would be mandatory despite the foreseeable non-compliance, because then the legal risk dominates the operational one.

2. Identity in the treatment rooms: 1,450 € cards or free usernames and passwords? Chosen: cards. The free option is technically equivalent and practically useless: the dentists are not going to type a password between one patient and the next, and what would happen is that they would write the password on the monitor — back to the starting point with a layer of false documentation on top. The card makes the correct path the easy path, which is the secure design principle 01-03 called "psychologically acceptable". What would have changed it: if each treatment room had one fixed practitioner rather than rotation, usernames and passwords would be enough.

3. Decentralise the data or keep it in Gijón? Chosen: keep it centralised and add a degraded mode (C-15). A server per site would solve R-09 but would triple the attack surface, the number of backups to protect and the maintenance hours, which are the scarce resource. C-15 — exporting the next day's appointment book and records each afternoon to a local encrypted file — costs zero euros and four hours and turns a line outage into an inconvenience. What would have changed it: if there were five sites instead of three, or if the link went down weekly, the arithmetic would flip.

4. Managed EDR or identity plus backups? Chosen: identity plus backups. It is the decision that is hardest to defend because an EDR "sounds like real security". But the vector for R-01 is a legitimate credential used by a compromised third party, and an EDR sees anomalous processes, not an authorised administrative session. With 3,600 € you buy visibility over a scenario that is not the main one; with 780 € and twelve hours you remove the condition that makes it possible. What would have changed it: if the 25 workstations browsed the internet freely and downloaded attachments — a much higher workstation risk profile — the EDR would move up several places.

5. And if the vendor refuses named accounts? This is the decision hardly any learner's dossier considers, and it is the one that could bring down the whole plan, because C-01 is the centrepiece of R-01 and it depends on a third party. Documented plan B: keep the shared account but disabled by default, enabled by Nuria only for the duration of the incident, with session recording and with alert C-11 on any use outside the window. It is a compensating control, it is worse, and it is documented as such with an exception EXC-2027-002 expiring in six months and with the explicit instruction that the vendor's ability to support named accounts is to be included as a requirement in the next contract renewal. Turning an unsolvable technical problem into a clause in the next renewal is, very often, the only move available — and it is a move.

The most serious one is not in the table because it deserves its own sentence: copying Nimbus's risk register. A dossier that transfers its risks to a dental practice produces sentences like "risk of exposure of the multi-tenant API" in an organisation that has no API. It is spotted on the first reading and it destroys the credibility of everything else. The antidote is to start from your own case's DFD: the threats come out of the flow, not out of memory.

Take your dossier and compare. You are going to find three kinds of difference, and only one matters.

Differences of form — your tables have different columns, your identifiers a different prefix, your inventory 18 assets instead of 22: irrelevant. None of them affects the quality of the work.

Differences of judgement — you put the phishing risk first, or chose the EDR, or decentralised the data: these are the valuable ones. None of them is wrong in itself. The question is not "does it match the solution?", but "is my decision argued just as well?". If your reason for putting phishing first is "because it is the most frequent", you have half an answer; if it is "because in this organisation 80 % of the surface is human and the irreversibility of R-01 is already mitigated by an off-site backup that here did exist", you have a better answer than mine for your case. And differences of method — your catalogue does not add up, your risks have no owner, your matrix cites controls that do not exist: these really are errors, and the reference solution exists precisely to detect them.

Because that is the thesis of the whole project: there is no single correct answer, but there are indefensible answers. A plan that does not fit the budget is indefensible. A risk with no owner is indefensible. Declaring a recovery capability with a backup that has never been restored is indefensible. A control that cannot be demonstrated is indefensible. Everything else is judgement, and judgement is discussed, argued and revised — which is exactly what a professional does in a management meeting.

This course has given you the cross-cutting foundation. The profession branches out, and it is worth knowing how.

Two warnings about this map. First: this project is, literally, the work of a GRC profile, so if you have enjoyed doing it, you already know something important about yourself. And if you suffered through it but enjoyed module 5, your path is probably a technical one. Second: in an SME you do not choose. In a 40-person company you will be all eight things at once, and that — far from being a defect — is the best school there is for discovering which one you like.

Let us start with the uncomfortable part: a certification does not replace experience, it accompanies it. It is useful for three specific things — getting past automatic CV filters, structuring your study and meeting the requirements of tenders or customers — and for nothing else. Nobody with judgement hires someone for an acronym, but plenty of filters discard whoever lacks one.

How to choose, in one sentence: the right certification is the one that accredits what you are already doing or what you will be doing next month, not the one that sounds best. And one tip with practical value: before paying for any of them, finish and publish this course's project. A complete, reasoned, available dossier demonstrates more judgement than most acronyms, and it costs zero euros.

And the rule that orders all of this: choose little and sustain it. Half an hour three times a week for a year teaches more than a month of twelve-hour days followed by six months of nothing. It is the same thesis as 06-01 applied to you: security — and training — are not achieved, they are sustained.

Before closing, look at what has changed in the company that has kept you company for 36 lessons. This table is the course's whole journey.

Nimbus is not a secure company today. It is a company that knows what it has, what can happen to it, what it is doing about it, what it has decided not to do and how it will find out that something is wrong. That difference — not the absence of risk, but the presence of method — is everything this course has tried to convey to you.

• Reading this solution before having done the project. If you have arrived here without a dossier of your own, stop and go back to 07-01. Once you have seen an answer, you can no longer know which one you would have given, and that information was the exercise's real output.
• Rewriting your dossier so that it looks like this one. If your decisions differ and are argued, defend them. Changing your mind because the course material says otherwise — with no better argument — is exactly the opposite of the habit the project trains.
• Keeping only the table and skipping the reasons. The tables are the easy part to copy and the useless part to copy: what you learn is in the paragraphs explaining why the pentest is discarded as premature, why proximity cards beat the free password and why C-01 needs a plan B.
• Collecting certifications to cover a lack of experience. It always shows, and at the first practical question. A certification accompanies what you can do; on its own, it is an acronym.
• Tip: publish the project, anonymised or on the fictitious case, in a repository with its history. It is the portfolio piece that is hardest to improvise and the one that best demonstrates judgement.
• Tip: put a date on the next review. Of the dossier and of your own learning plan. What has no date does not happen again.

Exercise 1 — The structured comparison

Compare your dossier with this solution on three specific dimensions: the order of the first three risks, the most expensive control you have included and what you have left out. For each one, write down whether it is a difference of form, of judgement or of method, and for the ones of judgement decide with an argument which of the two positions is better for your case.

Exercise 2 — Your own hard call

Choose a real trade-off from your project that does not appear in section 9 and write it up with the same structure: options, what was chosen, why, and what would have changed the answer. That last part is the one that shows you have understood the judgement and not just the conclusion.

Exercise 3 — Your 90-day plan

Design your learning plan for the next three months: the profile you are heading towards, two practice routes from section 14 with their specific weekly slot, one recurring reading and one thing you are going to produce and publish. Put a review date on it.

Solution 1 — Structured comparison (a real learner's example)

What is instructive is the split: two differences of judgement, which are discussed with arguments and taught from, and one of method, which is simply corrected. And notice that one of the differences of judgement is resolved partly in the learner's favour: the EDR was not a bad idea, it was an idea for a risk that sat in eighth place. That precision — "it is not wrong, it is premature" — is the same reasoning as the pentest discard.

Solution 2 — A hard call of your own (example)

Solution 3 — 90-day plan (example)

Three details make it a plan and not a wish list: it has specific slots in the calendar, it produces something publishable instead of only consuming content, and it has a review date with an observable success criterion. It is, in miniature, exactly the structure of the E8 roadmap: owner, deadline and measurable outcome. The method you have learned for an organisation works just the same for a career.

You have reached the end. You started with the CIA triad and the vocabulary of risk, you understood the threat landscape and how an organisation defends itself, you learned to protect information with cryptography that is actually used, to decide with a risk register, policies, controls and a response plan, to execute with tools, detection, penetration testing, networks, applications, endpoints and cloud, and to sustain and prove what you did with habits, regulations, the GDPR, evidence, people and ethics. And then you stopped reading about Nimbus and did it yourself: you chose an organisation, inventoried it, identified and prioritised its risks, drafted its policies, fitted a control catalogue to a budget that did not stretch to everything, prepared its response and its recovery, planned its verification, framed its regulatory obligations, built its traceability and its roadmap, and assessed yourself honestly.

In this last lesson you have seen a complete reference solution on the dental practice — with the inventory where a shared account and reputation are assets, the DFD whose boundaries explain where the danger lies, the number one risk justified for being irreversible and not for being frequent, the ALE that predicts nothing but persuades, the catalogue of sixteen controls where seven cost zero euros, the runbook that says which port on the rack, the DPIA that reasons its negative as well, the ENS that does not apply today but may apply tomorrow, and the roadmap that leaves the most irritating item for the quarter when there is already credibility. You have seen the hard calls: replace rather than ban, pay so that the correct path is the easy one, do not decentralise, choose identity before EDR, and have a plan B when the control depends on a third party saying yes. And you have seen the line that separates the debatable from the unacceptable: there is no single correct answer, but there are indefensible answers — a plan that does not fit, a risk with no owner, a recovery never tested, a control that cannot be demonstrated.

You also take away the map of what comes next: eight specialisations with what each one does and who they suit; certifications placed at their proper stage and with their limits, because they accompany experience rather than replacing it; legal practice routes — your own lab, guided platforms, CTFs, contributing, reading INCIBE-CERT and CCN-CERT advisories and the KEV catalogue, and other people's post-mortems; and one rule worth more than any list: choose little and sustain it. Because that is, in the end, this course's only conclusion. Security is not a state you reach: there is no day on which an organisation is secure and can stop looking. It is a practice that is sustained, with inventories that get updated, risks that get reassessed, backups that get restored to check that they work, alerts that get tested, people who get trained and decisions that get revised when what justified them changes. Nimbus did not finish the course as a secure company; it finished as a company that knows what it has, what can happen to it, what it is doing about it, what it has decided not to do and how it will find out that something is wrong.

You now have that method. You know how to inventory, model threats, write and score a risk, draft a policy that can be complied with, choose controls that fit in the money and in the hours, prepare a response someone else can execute, verify that what is implemented works, meet what the law requires and prove it with evidence, train people and defend every decision in front of whoever has to approve it. You do not know everything there is to know — nobody does, and anyone who tells you otherwise is selling you something — but you know how to decide with incomplete information and insufficient resources, which is exactly the job.

Now open your dossier, put a date on the next review and get started.