A practical cybersecurity-governance repository for incident response, risk management, repeatable security operations, and business-facing security communication.
This project complements my engineering repositories by focusing on the organizational side of trustworthy systems: policies, roles, escalation paths, risk decisions, and the procedures people need when technology fails or behaves unexpectedly.
Core documentation for preparing for, responding to, recovering from, and learning from security incidents.
Action-oriented playbooks for common events, including:
- Ransomware
- Phishing
- Account compromise
- Lost devices
- Suspicious login activity
Structured material for:
- Incident reporting
- Post-incident reviews
- Risk assessments
- Vendor security reviews
- Business impact assessments
A CSV-based risk register suitable for small organizations, student environments, prototypes, and early-stage security programs.
Python-based checks help verify that the risk register maintains the expected structure and scoring values.
Secure systems depend on more than secure code. Organizations also need clear ownership, defined response authority, usable procedures, documented assumptions, and a way to reason about tradeoffs.
This repository demonstrates my interest in connecting technical controls with operational reality. The same questions appear in both governance and engineering:
- Who is authorized to act?
- What evidence supports the decision?
- What happens when a control fails?
- How is the event recorded and reviewed?
- What risk remains after mitigation?
Those questions also inform my work on cyber-physical systems and trustworthy automation.
Review these files first:
docs/security-program-overview.mddocs/incident-response-policy.mdrunbooks/ransomware.mdrisk_register/risk_register.csv
Validate the risk register locally with:
python -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -e ".[dev]"
python tools/validate_risk_register.py risk_register/risk_register.csv
pytestSecurity Program Starter shows the governance and response side of the same broader engineering philosophy behind my other projects: make trust explicit, preserve evidence, define authority, anticipate failure, and design systems and procedures that remain understandable under pressure.
Related work: