Chapter 12 — Practice portfolio and final review
Lesson map
Lesson 12 published. Map, example, EX056.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Portfolio contents"]
N2["12.2 Presentation"]
N3["12.3 Likely questions"]
N4["12.4 Next steps"]
N5["12.5 Staying current"]
N6["12.7 Practice task"]
N7["12.8 Professional habits"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX056"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Portfolio contents"]
N2["12.2 Presentation"]
N3["12.3 Likely questions"]
N4["12.4 Next steps"]
N5["12.5 Staying current"]
N6["12.7 Practice task"]
N7["12.8 Professional habits"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]
[Learning outcomes]
|
v
[12.1 Portfolio contents]
|
v
[12.2 Presentation]
|
v
[12.3 Likely questions]
|
v
[12.4 Next steps]
|
v
[12.5 Staying current]
|
v
[12.7 Practice task]
|
v
[12.8 Professional habits]
|
v
[Worked example] --> [Exercise EX056]
Learning outcomes
You will (1) assemble a portfolio showing each course outcome; (2) present your workflow and results; (3) answer questions on method, evidence and status of guidance; (4) plan next steps in practice; and (5) keep your knowledge current.
12.1 Portfolio contents
Include: an accurate explainer (Chapter 1); a service and stakeholder map with priorities (2); authorization and evidence labels (3); a graded CBOM extract (4); findings from tool output (5); a tracker with states and dependencies (6); control, verification and residual-risk records (7); the case analysis (8); reports for two audiences (9); a quality checklist and lessons (10); the lab outputs and reflection (11).
Choose items that show outcomes as well as documents, such as tracker states backed by evidence. Each item should cite its source and date, and graded items should show their grade. Remove anything you cannot support, and note which outcomes are covered weakly so you can address them before the review.
12.2 Presentation
Ten minutes: the workflow, what you produced, one decision you supported, one lesson. Then questions.
For example, you might choose the archive case recommendation as the decision and the broker portal regression as the lesson. Keep the workflow overview to two minutes so most of the time goes to results. Rehearse with a timer, and prepare one slide that shows the tracker before and after your work. Leave time for questions, since the review tests how you reason as much as what you produced. Bring the portfolio so you can point to evidence when asked.
12.3 Likely questions
"How do you know an item is verified?" "Why is the archive first?" "Is IR 8547 final?" "What does hybrid key exchange not protect?" "What would you do if a supplier never answers?" Answer with evidence from your portfolio.
For example, "How do you know an item is verified?" is answered with negotiation logs from the portfolio, not with a change ticket. Prepare a one-line answer and a piece of evidence for each. Practise the answers with a peer. Keep the evidence ready to show.
12.4 Next steps
Agree with your manager which workflow responsibilities you will take on, which skills to deepen (for example, the technical course for hands-on configuration), and when you will review progress.
Write the agreement down with dates and a named reviewer. Choose responsibilities that use what the portfolio shows you can do, such as running the quarterly cycle for one division, and add one new skill at a time. Review the plan after three months and adjust it with your manager. Keep a copy in the portfolio.
12.5 Staying current
Track NIST and IETF publications, sector guidance and supplier announcements. Update your explainer and the workflow's standards section when status changes — for example when FN-DSA or the HQC standard is published, or IR 8547 is finalised.
Set a regular time each month to check these sources and record what changed, if anything. When a status changes, update the accurate explainer from Chapter 1 and tell stakeholders who rely on it. When guidance changes, check whether any MTI decision rested on the old status, and if so raise it at the next monthly meeting rather than waiting for the annual review.
12.6 Worked example
A participant presents MTI's Q2 position, the archive case recommendation and the broker-portal regression lesson. Asked "What does hybrid not protect?", they answer: "Authentication — the portal certificate is still classical — plus any hop or partner still on classical key exchange, and data recorded before the change." Asked about IR 8547, they state it is a draft with proposed dates and show how MTI's internal dates were set.
The answers work because each points to evidence and states limits. Neither overclaims, and both refer to MTI's own records.
12.7 Practice task
Assemble your portfolio and rehearse the presentation with a peer.
Check that each portfolio item maps to a course outcome and carries evidence, not just a document. Rehearse the ten-minute presentation at least twice with a peer who asks the likely questions, including whether IR 8547 is final and what hybrid does not protect. Time yourself, note the questions you found hard, and prepare evidence for each before the final review. Ask the peer for written notes. Revise once and keep both versions.
12.8 Professional habits
The habits this course builds — sourcing every claim, grading evidence, recording decisions, stating residual risk, communicating calmly — apply to any security programme. Practise them deliberately in your next role; they are what make a practitioner trusted to coordinate work across teams.
Choose one habit to practise each month and ask a colleague to tell you when you slip. At MTI these habits showed in small things: a supplier claim graded D rather than B, a regression reported openly and an exception given an expiry. Keep doing them when nobody checks.
12.9 Common errors and limits
- Portfolios of documents without evidence of outcomes.
- Overclaiming in answers.
- No plan for staying current.
Each error weakens the final review. A portfolio of documents without outcomes shows activity but not results, such as tracker states without evidence. Overclaiming, for example calling IR 8547 final or hybrid key exchange complete protection, undoes the credibility the portfolio builds. Without a plan for staying current, your explainer will be out of date as soon as FN-DSA or the HQC standard is published. Check for each before submitting.
Exercises
- EX056 — Portfolio map. Map five course outcomes to portfolio items. Rubric: 3 = specific artefacts.
- EX057 — Answer. Answer "How do you know an item is verified?" Rubric: 3 = operational evidence, date, source.
- EX058 — Supplier silence. What do you do if a supplier never answers? Rubric: 3 = escalate via procurement, grade U, exception/compensating controls, alternative supplier.
- EX059 — Currency plan. Write a three-item plan for staying current. Rubric: 3 = sources, cadence, update actions.
- EX060 — Next role. Name two workflow responsibilities you could take on next and why. Rubric: 3 = realistic, linked to evidence of skill.
Synthesis
The portfolio and final review demonstrate a repeatable, evidence-based workflow and the communication skills to run it, with a plan to stay current.
Continue studying — chapter 12 of 12
← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →