Chapter 29 — Capstone: integrated response and recovery service
Lesson map
Lesson 29 published. Map, example, EX085.
flowchart TD
N0["Learning outcomes and connection"]
N1["29.1 Capstone scope"]
N2["29.2 Acceptance criteria"]
N3["29.3 End-to-end demonstration"]
N4["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX085"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["29.1 Capstone scope"]
N2["29.2 Acceptance criteria"]
N3["29.3 End-to-end demonstration"]
N4["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX085"]
[Learning outcomes and connection]
|
v
[29.1 Capstone scope]
|
v
[29.2 Acceptance criteria]
|
v
[29.3 End-to-end demonstration]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX085]
Learning outcomes and connection
You will be able to (1) integrate the components built across this course into a running response and recovery service for Fernmoor; (2) demonstrate it end to end against acceptance criteria with operational evidence; and (3) document it so that another team can operate it. This capstone draws on every chapter; Chapter 30 evaluates it.
29.1 Capstone scope
The integrated service must include: charter and roles (Ch10); inventory with dependencies and tiers (Ch11); verified evidence flows with canaries (Ch12); severity scale and triage thresholds (Ch13); intake channels (Ch14); case tool and evidence store meeting acceptance criteria (Ch17); tested containment and recovery actions with timed restores (Ch18); detection register with outcome labels (Ch19); consistency checks (Ch20); ITSM integration and emergency change (Ch21); automations with run logs (Ch22); measures and monthly review (Ch9, Ch23); playbooks for at least three scenarios (Ch24–25); handoff and communication templates (Ch26); deployed workflow (Ch27); and an exercise programme (Ch28).
29.2 Acceptance criteria
Each component needs a criterion that can be demonstrated with evidence, not a statement. Examples: "Canary events for all four flows appear within their stated delay for 14 consecutive days (query output attached)"; "Each pre-built containment action has a test record within 90 days"; "Restore of tier-1 systems meets RTO and RPO in the latest test (test report)"; "Workflow tests T1–T6 pass against the production configuration (test log)". The CSF 2.0 Profile approach — comparing current with target outcomes — gives a structure for presenting coverage.
29.3 End-to-end demonstration
Run one realistic synthetic case through the whole service in the test environment, from detection to post-incident review, while an assessor observes. Collect the operational evidence the service produces: case record with history, evidence manifest with verification, change records, run logs, updates and the review. The demonstration should also include one deliberate failure (for example, a canary flow disabled) to show monitoring catches it. Fernmoor's capstone demonstration used an invoice fraud case and disabled an identity canary deliberately; the alert arrived within the limit.
29.4 Worked example (synthetic): Fernmoor capstone excerpt
Fictional. Demonstration case "invoice fraud via compromised supplier mailbox" in the test environment.
| Component | Criterion | Evidence | Result |
|---|---|---|---|
| Evidence flows | 4/4 canaries within delay for 14 days | scheduled query export | pass |
| Containment actions | 6/6 tested in 90 days | action test log | 5/6 — DNS sinkhole test 120 days old; retested during capstone, pass |
| Recovery | billing-db RTO 2 h / RPO 15 min | restore report | RTO 1 h 40, RPO 10 min — pass |
| Workflow | T1–T6 pass on production config | test log | pass |
| Automation | evidence manifest verified, run logged | run log, manifest | pass |
| Deliberate failure | disabled identity canary alerts in ≤ 30 min | alert record | alerted at 22 min — pass |
| Handoff | SBAR with acceptance | case history | pass |
| Communications | executive update template used | case record | pass; one speculative phrase flagged |
Operating documentation: a service handbook (one page per component, owner, how to operate, how to test), a runbook index and a calendar of recurring tests.
29.5 Common errors and limits
- Acceptance by assertion ("flows are configured") instead of evidence.
- Demonstrating only the happy path.
- Documentation that only the builder understands.
- Treating a test environment demonstration as proof of production behaviour without production tests.
Fernmoor's capstone avoided these by requiring evidence for every component, from scheduled query exports for flows to case history for the handoff. The deliberate canary failure tested more than the happy path, and the service handbook gave one page per component so others could operate it. Its dossier also states that test-environment results still need production checks before they count.
Exercises — chapter 29
Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.
EX085 — Criteria. Steps: write evidence-based acceptance criteria for four components not in the Fernmoor capstone table (inventory, triage thresholds, ITSM routing, exercise programme). Rubric: 3 = four measurable criteria with evidence artefacts; 2 = three; 1 = assertions; 0 = none.
EX086 — Handbook page. Steps: write the handbook page for the evidence store. Rubric: 3 = purpose, owner, how to use, controls, recurring tests, failure handling, links; 2 = missing tests; 1 = vague; 0 = none.
EX087 — Deliberate failures. Steps: propose three more deliberate failures for the demonstration and what should detect each. Rubric: 3 = three realistic failures with detecting control and expected time; 2 = two; 1 = vague; 0 = none.
Chapter synthesis
Integrate every built component into one service with evidence-based acceptance criteria, demonstrate it end to end including deliberate failures, and document it so another team can operate and test it.
Continue studying — chapter 29 of 30
← Chapter 28 · Course chapter index · Chapter 30 →
Continue to the next authored lesson.