For six modules you have followed Marta, Lucía and the rest of the Nimbus Reservas team as they discovered their assets, suffered an incident, prioritised risks with 18,000 € and decided what to leave undone. You have read their decisions. Now you are going to make your own. The Final Project consists of producing the complete security dossier of a small organisation: the set of documents that allows someone — management, a customer, an auditor, you a year from now — to understand what is protected, from what, with what means and with what evidence. It is not an academic exercise invented to round off a course: it is, literally, the work handed to whoever takes a security post in an SME or in a small public authority, and the work a consultant invoices when they are hired "to see how we are doing".

This lesson is the brief. Here you decide which organisation you will work on, you understand what is asked of you from each module, you know what is out of scope and you take away a realistic plan. The templates for each deliverable are in 07-02, the criteria you will assess yourself against in 07-03, and an annotated reference solution in 07-04. Do not look at 07-04 before you have done the work: it is the only part of the course that is spoilt if you read it at the wrong time.

1. What you are going to produce: the security dossier
2. The learning objective: decide, prioritise and justify
3. Choosing the case: option A and option B
4. Option A: your real organisation, with authorisation and anonymised
5. Case 1 — Clínica Dental Sonrisa Norte
6. Case 2 — Valdellano Town Council
7. Case 3 — Alzabra Outdoor
8. Comparison table and how to choose the case that suits you
9. Project scope, module by module
10. What the project does NOT include
11. Suggested plan: seven phases and 20-30 hours
12. The golden rule: everything traces back to a risk and to a resource
13. The course as a reference manual: what to read when you get stuck
14. Preview of the final deliverable

In 06-04 the idea of the security dossier appeared — the reusable security pack: the folder Nimbus prepares once and reuses every time a customer asks, an auditor visits or management wants to know where the security money went. Your project is exactly that, applied to another organisation.

A complete security dossier, in a small organisation, answers eight questions in this order:

Eight documents. Not one more. A thirty-document dossier in a 25-person organisation is a red flag, not a sign of maturity: it means a documentation set has been copied from a multinational and nobody is going to maintain it.

Why this and not an exam. A security exam measures whether you remember that CVSS scores technical severity and EPSS the likelihood of exploitation. You have already demonstrated that in every lesson. What an exam cannot measure — and the only thing you will genuinely be asked for in a real post — is whether, with 9,000 € and 180 hours, you are able to say this yes, this no, and for this reason. That is the real exam, and it has no multiple-choice answers.

Write it on a note and keep it in sight while you work:

The three competencies, broken down:

There is a fourth competency the project trains without naming it: honesty. A dossier that says "control implemented" about something nobody has tested is not an optimistic dossier, it is a false one, and in 06-04 we saw what happens to it when an auditor turns up. In your project, anything that has not been tested is written down as planned. It costs a second and it defines you professionally.

The first thing you decide is which organisation you work on. And there is one firm constraint: you do not work on Nimbus Reservas. Nimbus is already solved throughout the course; using it would lead you to copy the risk register from 04-01 and the catalogue from 04-03 in different words, and you would have decided nothing. Nimbus stays as a benchmark for the standard, not as a case.

You have two options:

Neither option is better than the other in learning terms. Option A has the advantage that the result is genuinely useful and the disadvantage that you will have to dig out data that is not always available. Option B hands you all the data on a plate, which lets you concentrate 100 % on deciding rather than on finding out, and it is the one I recommend if this is your first dossier.

If you choose to work on a real organisation — yours, a relative's, a client's — there are three rules that are not advice.

⚠️ Validation note — authorisation and legality

You need prior written authorisation from someone with the standing to give it before you inventory assets, review configurations or talk to employees about security. Go back over 06-06 section 2: the authorisation must come from whoever has the power to bind the organisation, with an explicit scope, a time window and in writing. Working there does not authorise you; nor does a colleague saying "sure, look at whatever you like". And most important of all: this project is documentary analysis, not technical testing. Scanning your company's network "for the project" without express authorisation for that specific activity may amount to unlawful access regardless of your intention (06-06, section 1). If you have any doubt about the extent of your permission, work on a fictitious case.

Rule 1 — Authorisation in writing. An e-mail from the manager, the partner or the person in charge saying what you may review, for how long and for what purpose. Keep it in the project folder. It is the dossier's first piece of evidence.

Rule 2 — Anonymise from minute one. Do not anonymise at the end: anonymise as you write. Replace the real name with a made-up one, the domain with <something>.example, public IPs with documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24), supplier names with their category ("the ERP supplier"), and round the financial figures. An anonymised dossier serves the analysis just as well and can be shown to people; one with real data never leaves the organisation.

Rule 3 — No personal data in the dossier. An asset inventory does not need the list of employees with their e-mail addresses. It needs "12 Windows laptops assigned to clinical staff". If your project contains personal data, you have turned yourself into one of the project's risks.

Minimum fit. If your real organisation is too big for 25 hours of work, narrow it down: pick one site, one department or one service and state the scope in writing, exactly as Nimbus did in 04-01 section 4. An excellent dossier over a small scope is worth far more than a superficial one over the whole company.

Sector and size. Private dental care — Clínica Dental Sonrisa Norte is a dental practice with 25 employees across 3 sites in Asturias: Gijón (main site, 5 treatment rooms), Oviedo (3 treatment rooms) and Avilés (2 treatment rooms). Turnover of approximately 2.1 M€/year. Around 4,800 active patients on file.

Staff and roles.

Systems and data.

• DentaGest: practice management software on a physical Windows server in Gijón with a SQL Server database. Clinical records, odontograms, treatment quotes, consents and the appointment book. It is a legacy system: the installed version is 6 years old and upgrading means paying for a new licence.
• Digital radiology: a panoramic X-ray unit and intraoral sensors that write DICOM images into a shared folder on the same server, which the vendor requires to be writable from every treatment room.
• Connected sites: Oviedo and Avilés reach Gijón over a VPN between consumer-grade ISP routers. If the Gijón line goes down, the other two sites cannot see the clinical records.
• Backup NAS in the same room as the server. Nightly copy of the SQL Server database and of the DICOM folder. Nobody has ever restored it. Microsoft 365 Business with 25 mailboxes and no mandatory MFA. A WordPress website with an appointment form, managed by the agency.
• WhatsApp on two reception phones: appointment reminders and photos patients send of their own mouths. A bank card terminal at each site and an external finance provider for treatment paid in instalments.

Third parties.

Applicable regulatory framework. GDPR and the LOPDGDD (the Spanish Data Protection Act), with article 9 at the centre because the entire business turns on health data; Law 41/2002 (the Spanish Patient Autonomy Act), which requires clinical records to be retained and regulates access to them; regional healthcare rules; the LSSI-CE (Spain's e-commerce and information society services act, Law 34/2002) because of the website with a form; and contractual obligations from the bank for the card terminals. If the practice were to contract services with a public health insurer or with the regional health service, the ENS (Spain's National Security Framework, Royal Decree 311/2022) would also apply through the contract.

Resources. Security budget: 9,000 €/year. There are no internal systems staff: the contract with Datacer Norte includes a pot of 120 h/year and Nuria can devote around 4 h/week ≈ 180 h/year. Any additional Datacer hour is billed at 55 €/h against the budget.

Tensions specific to the case (the ones that will force you to decide):

1. Centralisation versus availability: the clinical records live on a server at one site and two sites depend on a consumer-grade VPN. Splitting them up improves availability and worsens control; centralising does the opposite.
2. The supplier that will not accept MFA: the DentaGest vendor insists on a shared administrator account with no second factor, and without its support the practice cannot operate. This is the exact equivalent of A-19 at Nimbus.
3. WhatsApp: banning it is right on paper and is what nobody is going to comply with; it has to be solved, not declared forbidden.
4. Shared sessions in the treatment rooms: the dentists are not going to log in between one patient and the next. Without individual identity there is no traceability of access to the clinical record, which is precisely what Law 41/2002 requires.
5. Backups in the same room as the server: a fire, a burglary or a ransomware attack takes both.

Sector and size. Local government. A municipality of 7,800 inhabitants, 62 council employees spread across four buildings: the town hall, the social services building, the sports centre and the library and cultural centre.

Staff and roles.

Systems and data. An electronic office and case management system from a single supplier, hosted in that supplier's cloud. The municipal residents' register (all 7,800 residents). Accounting and treasury from the same supplier. The incoming and outgoing correspondence register. Social services case files with health data, socio-economic circumstances, minors and gender-based violence. Penalty case files held by the local police, which are article 10 data. CCTV at the sports centre and the library, and a number-plate reader in the police vehicle. A transparency portal. 55 PCs across four buildings linked by municipal fibre and a radio link to the sports centre. Public Wi-Fi at the library and in the square. And irrigation and street-lighting controllers connected to the same flat network.

Third parties.

Applicable regulatory framework. The ENS (Royal Decree 311/2022) is mandatory, with a category to be determined in the project itself and foreseeably MEDIUM because of social services and the residents' register; GDPR and the LOPDGDD; Laws 39/2015 and 40/2015 on administrative procedure and the legal regime of the public sector; Law 19/2013 on transparency; Law 9/2017 on public sector contracts, which forces security requirements to go into the tender documents; and the open question of whether NIS2 reaches it — that depends on the scope and on the transposition, and it is exactly the kind of doubt you resolve by asking, not by assuming.

Resources. A security budget line of 12,000 €/year, subject to public procurement procedures, which means you cannot buy quickly. Jorge can devote around 300 h/year to security. There is the option of taking up services from the Provincial Council at no direct cost.

Tensions specific to the case.

1. The single supplier: the electronic office, the residents' register and the accounts are all in its hands. There is no realistic way out, so the work consists of managing the risk of a third party you depend on completely (04-04).
2. The ENS is not optional: it requires a formal risk analysis, categorisation, a Statement of Applicability and conformity. Nobody has ever done it and there is no budget for a full consultancy engagement.
3. Public procurement as a security constraint: you cannot "put a card in" to a SaaS product. Everything that costs money takes months and has to fit inside a contract.
4. A flat network with OT: the irrigation and street-lighting controllers live alongside the residents' register. Segmenting is cheap in equipment and expensive in Jorge's hours.
5. Councillors with personal devices and e-mail: elected officials who are not employees and to whom the council staff's disciplinary regime cannot be applied.

Sector and size. E-commerce selling mountaineering and climbing gear. 8 people, 100 % remote, no office. Turnover 2.4 M€/year across some 35,000 orders, with 30 % concentrated in the six weeks of Black Friday and Christmas.

Staff and roles.

On top of that, two freelance developers come in to help during the peak season, with access to the repository and to production.

Systems and data. The shop runs on Shopify. An in-house integration app (Python) on a VPS synchronises orders with the ERP and with the logistics operator. Cloud ERP. Warehousing and logistics outsourced to a 3PL connected by API. A hosted payment gateway: the shop does not store cards, but the payment page is served from the shop's own domain. A SaaS helpdesk with the customer conversation history. An e-mail marketing platform with 180,000 subscribers. Advertising accounts with delegated access for an agency. A shared spreadsheet with margins and supplier terms. Data processed: customers' identifying and contact details, purchase history, delivery addresses, employee data and trade secrets in the margins spreadsheet.

Third parties. Shopify, the payment gateway, the 3PL, the e-mail marketing platform, the media agency, the helpdesk, the two peak-season freelancers and the payroll bureau. Seven of the business's eight critical assets belong to someone else.

Applicable regulatory framework. GDPR and the LOPDGDD; the LSSI-CE because of the e-commerce activity and the cookies; consumer and distance-selling rules; PCI DSS at the lightest level (SAQ A) because it uses a hosted gateway, with the obligation to protect the integrity of the payment page — card skimming through JavaScript injection is the sector's characteristic risk; and the contractual terms of Shopify and of the gateway.

Resources. Budget: 6,000 €/year. Nacho has around 150 h/year for security, with one particularity that changes everything: during the two months of peak season his security hours are zero and there is a change freeze.

Tensions specific to the case.

1. The peak-season window: 6 weeks in which nothing can be touched and in which four hours of downtime cost more than the entire annual security budget. Everything that gets implemented has to be finished and tested before November.
2. Fully remote with no domain and no MDM: eight people, mixed devices, no corporate network at all. Every control is an identity control, not a network one.
3. The accounts are the crown jewels: the shop, the e-mail marketing platform and the advertising platforms. Several are shared with passwords in a spreadsheet, and a takeover of the advertising account can burn 20,000 € over a weekend.
4. The 3PL as a black box: it holds, by API, the orders with the addresses of 35,000 customers, and nobody at Alzabra controls its security.
5. Seasonal freelancers: they arrive in November with access to production and by January they are gone. The joiner and leaver cycle is the control, and today it does not exist.

How to choose. Do not choose the one that looks easiest: choose the one that resembles the work you want to do.

• If healthcare, classic SMEs or local consultancy appeal to you, choose the dental practice. It is the richest case in data protection terms and the one that most resembles what you will find in the majority of Spanish companies with fewer than 50 employees.
• If the public sector, the ENS or formal compliance appeal to you, choose the town council. It is the case where the rule governs over technical judgement, and learning to work that way is a competency with a market of its own.
• If cloud, digital product or application security appeal to you, choose Alzabra. It is the case where almost all the risk is identity and third-party risk, which is where the sector is heading.

One useful warning: the smallest case is not the easiest. Alzabra has 8 people and the lowest budget, but resolving dependence on seven suppliers with 6,000 € demands finer decisions than the dental practice.

This is the project's reference table: what is asked of you from each module, which deliverable it ends up in and which lesson resolves your doubts.

Notice that no module is asked of you as a summary. There is no deliverable saying "explain cryptography": there is a deliverable where you have to say "the patient portal passwords are stored with Argon2id using these parameters, and the X-rays are encrypted at rest with the key managed by X because risk R-03 requires it". Application, not repetition.

Just as important as the scope:

If you want to practise technically — and you should — do it separately and on a lab of your own: your own virtual machines, deliberately vulnerable applications, legal practice platforms. 06-06 section 2 has the diagram that decides whether you may touch something or not, and 07-04 closes with a list of places to practise without crossing any line.

The project is designed for 20-30 hours of real work, spread however you like. Working in the order of the course is not a whim: each phase consumes the output of the previous one, and skipping the inventory to go straight to the controls produces the commonest error of all, which is protecting what you know how to protect instead of what needs protecting.

Three planning tips that save hours. First, do not chase perfection in F2: an 80 % inventory lets you move on, and you will come back to it when F3 shows you that an asset was missing. Second, write the identifiers from the very beginning (A-01, R-01, C-01): if you start without them, the traceability matrix in F7 will cost you twice as much. Third, F5 is the phase that hurts — it is where the budget does not stretch — and it is also where you really learn; if you finish it in twenty minutes, you have done it wrong.

If you take a single sentence away from this lesson, make it this one:

This rule settles most of the doubts you are going to have all by itself. Do I put in a SIEM? Answer the two questions: which risk it treats (probably detective blindness) and where the hours to operate it come from. If the answer to the second is "from nowhere", the answer to the question is "no, and instead two specific alerts I really can attend to". That decision, written down and justified, is worth more than a SIEM on paper.

Do not read the whole course again. Go to the lesson that resolves your specific blocker.

This is what you are heading for. When you finish, your project folder will contain something very close to this index — the detail of each piece is in 07-02:

The executive summary deserves a comment: it is written last and it is the only page many people will read. If, after 25 hours of work, you are not able to say in one page what the five main risks are, how much it costs to treat them and which three decisions you have taken, the work is not finished.

• Choosing the case for convenience rather than interest. You are going to spend between 20 and 30 hours with that organisation. Choose the one that resembles the work you want to do, not the one with the shortest table; boredom is the main reason final projects get abandoned.
• Starting with the controls. It is temptation number one: you know what MFA is and you fancy writing it down. A control catalogue written before the risk register always ends up protecting what its author knows how to protect, and none of its lines is defensible because it points at nothing.
• Changing the brief so that what you want to do fits. If Alzabra's budget is 6,000 €, do not raise it to 20,000 because your plan does not fit. The constraint is the exercise. A dossier that raises the budget so its controls fit has removed precisely what was being assessed.
• Working on a real organisation without authorisation. It is not an administrative formality: it is the difference between a project and a legal problem. At the slightest doubt, use a fictitious case.
• Tip: open the folder today and create the eight empty files. With their names and their titles. The project starts to exist when its structure exists, and the cost of getting going drops to zero.
• Tip: keep an assumptions log. Every time you assume something the brief does not state — "I assume the NAS has no immutability" — note it in the annex. That is what a real consultant does and it turns an invention into a stated hypothesis.
• Tip: do not read 07-04 yet. Not even "just a quick look". Once you have seen the reference solution, you can no longer know what you would have decided, and that information is the project's real output.

The exercises in this module are real steps of the project. Do them on the case you have chosen; the solutions are worked out on the dental practice so that you can see the expected standard.

Exercise 1 — Choose the case and state the scope

Choose your case and write the project's scope statement, with the five context elements from 04-01 section 4: scope (what is in and what is out), impact criteria, scales, who decides and time horizon. Add one line with the resource constraints. One page maximum.

Exercise 2 — The three risks you already sense

Without doing the inventory yet, write the three risks you already sense in your case, phrased with the formula from 04-01 ("If [threat] exploits [vulnerability] on [asset], then [technical impact] with [business consequence]"). Keep them. When you finish E2, compare them with your full register: you will see what you sensed correctly and what you had missed.

Exercise 3 — The project's personal calendar

Turn the seven phases from section 11 into a calendar of your own, with real dates, sessions of specific length and the weekly slot in which you are going to work. Identify the phase where you are most at risk of giving up and write down what you are going to do to stop that happening.

Solution 1 — Scope statement for Clínica Sonrisa Norte

Notice two things. The "out of scope" is as important as the "in scope": without it, three months from now you will be arguing about whether the autoclave was part of the scope. And the extra weight given to the personal data dimension is not decorative: it is what will make a risk to clinical records score above a financial one of similar size when the 5x5 matrix arrives. That bias, declared a priori, is what turns a score into a defensible decision.

Solution 2 — Three sensed risks at the dental practice

All three follow the formula, all three end in a business consequence — not in "the data gets encrypted" — and all three already name, implicitly, the missing control: individual identity and on-demand access for the supplier, an alternative channel for patient photographs, and a degraded operating capability at the remote sites. A well-written risk almost proposes its own treatment, as 04-01 put it.

Solution 3 — Personal calendar (example)

29 hours over 8 weeks. The phase with the highest risk of abandonment is F5, the control catalogue, for two reasons: it is the first time the budget does not stretch and things have to be given up, and it is the one that demands the most going back and forth over the earlier deliverables. The specific countermeasure: split it into two separate sessions — one to list candidates with their cost, another to decide what goes in — and forbid yourself from going back to tweak the risk register during that phase; if a new risk appears, it goes into the open-items annex and gets folded in at the final review. A second, general countermeasure: settle for version 1. A finished, improvable dossier always beats a perfect, unfinished one.

You now have the complete brief. You know what you are going to produce: the security dossier of a small organisation, eight deliverables answering the eight questions put to anyone who sits down in a security post — what we have, what can happen, what rules we set ourselves, what we do, what we do when it happens, how we know it works, what the law requires and how we sustain it. And you know what for: not to prove you have understood the course, but to train the three competencies that get paid for — decide, prioritise and justify — plus the one that underpins them, which is the honesty of writing "planned" where nothing has been tested.

You have chosen a case. Either your real organisation, with prior written authorisation from someone who can give it, everything anonymised from the first line and no personal data inside the dossier; or one of the three fictitious cases: Clínica Sonrisa Norte, 25 people, three sites, clinical records on a legacy server, a vendor that insists on a shared account and 9,000 € a year; Valdellano Town Council, 62 employees, the ENS mandatory, a single supplier owning the electronic office and public procurement as a security constraint; or Alzabra Outdoor, eight remote people, seven of its eight critical assets in third-party hands, 6,000 € and a peak-season window in which nothing can be touched. Three organisations different from Nimbus in sector, size and model, and useful for exactly that reason: what you learned with Nimbus is not copied, it is transferred.

You know the scope module by module — M1 inventory and modelling, M2 threats and measures, M3 cryptographic decisions, M4 risks, policies, controls, third parties, response and recovery, M5 technical verification, M6 regulation, evidence and people — and you know that no module is asked for as a summary: it is asked for applied to a specific case. And you know what is not asked for: nothing implemented in production, no scanning or testing of real systems, no complete documentation set and no presentation to anyone, because there is no tutor here. If you want to practise technically, use your own lab and the rules from 06-06.

You take away a plan of seven phases and 20-30 hours in the order of the course, with the warning that F5 — making the controls add up against the budget — is the phase that hurts and the one that teaches most. And above all you take away the golden rule: every decision must be traceable upwards, to a risk or a legal obligation, and downwards, to a euro and an hour that actually exist. A control that fails the first is a technical whim; one that fails the second is a wish list; and a dossier full of both is paper.

In 07-02 you have the eight deliverables broken down: purpose, minimum and quality requirements, indicative length, the complete template ready to fill in for each one and a worked fragment already filled in so that you can see the expected standard. It is the lesson you will keep open in a tab for the whole project. Before moving on to it, do exercise 1: choose your case and write the scope statement. With that page written, the project has already begun.