Complete a governance/risk review with owners

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R31 — NIST AI RMF Govern

   R32 — EU AI Act

   R44 — OWASP SCVS assurance limits

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Complete the executive Governance, Risk & Assurance Package: risk owners, control evidence links, documented exceptions, review cadence, residual-risk sign-off, and a clear distinction between product security controls and organizational audits (like SOC 2 Type II).

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 102 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Signed-off Governance & Residual-Risk Assurance Package across all 3 flagship projects.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R31NIST AI RMF 1.0↗ nist.gov

  Govern, Map, Measure, and Manage functions; risk ownership, measurement, and lifecycle documentation.

• R32EU AI Act Official Portal↗ artificial-intelligence-act.ec.europa.eu

  Risk-based regulatory tiers, high-risk system obligations, and GPAI transparency/cybersecurity rules.

• R44OWASP SCVS↗ owasp.org

  Software Component Verification Standard: component inventory, provenance, and supplier assurance practices.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsNIST · 140+ page playbook
  NIST AI RMF Playbook

  Supplies suggested actions per Govern/Map/Measure/Manage subcategory, which is what turns a risk register row into a named owner plus an evidence link for the assurance package.

  R31checked 2026-11-11
• videoProfessorBlackOps - CyberSecurity for the people · 61 min
  NIST AI RMF Playbook Explained | Enterprise AI Risk Management Guide

  Walks the playbook function by function into enterprise risk-management reporting, including how Govern/Map/Measure/Manage outputs feed executive reporting and exceptions review.

  R31checked 2026-11-11
• videoScytale · 1 min
  What is a SOC 2 Type II Report?

  A compressed definition of the Type II period-of-time attestation and its trust services criteria, which is the cleanest way to draw the line between product security controls and an organizational audit.

  R31checked 2026-11-11
• articleTrusted Institute · 8 min read
  Policy Exceptions and Risk Acceptance for AI Use

  Draws the distinction between a policy exception and a risk acceptance, and explains why residual risk still needs a sign-off even when every control passes — the exception semantics your package must encode.

  R31checked 2026-11-11
• courseAI Governance Institute · CSV template + column guidance
  Risk Treatment and Exception Register template

  A ready-made register schema with per-column guidance for treatment, owner, expiry, and closure, which you can adapt directly into the documented-exceptions section of the review.

  R31R44checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.