Cyber CapstoneTM
Defense by design simulations for real-world cybersecurity practice.
You will think like the attacker, build like an engineer, and prove your work.
Join architects and engineers worldwide shaping the future of cybersecurity through technical concepts, models, and our Defensible 10 Standards.
THE EXAM
Cyber CapstonesTM
ISAUnited Cyber Capstones are scenario-based performance assessments used to evaluate professional readiness for a Certified Professional License (CPL). Candidates work through a defined mission, respond to an assigned simulation technical scenario, and submit a portfolio of required artifacts for evaluation.
THE CHALLENGE
Cyber Capstone Environment
Cybersecurity work rarely happens under perfect conditions. Each Cyber Capstone places the practitioner inside a realistic mission where threats, exposure, failures, constraints, or adversary activity create pressure on the outcome.
Your job is not simply to know the answer. Your job is to make a defensible decision.
THE PROJECT
Missions and Simulation Scenarios
Each Cyber Capstone begins with a Mission that defines the storyline, mission, role, and objectives. Within that mission, CPL candidates may be assigned one of several ICC scenarios.
MISSION PACK
CONTROL POINT
Operational Technology Cybersecurity Professionals
The Control Point Mission Pack domain challenges participants to engineer and validate protections for OT environments where cyber compromise can affect physical processes, reliability, controllability, and safety. These Cyber Capstones emphasize secure vendor access, IT/OT boundaries, zones and conduits, controller logic integrity, controlled data flows, and known-good recovery.
Sample Scenarios
MISSION PACK
EVIDENCE CHAIN
GRC Cybersecurity Engineer Professionals
The Evidence Chain Mission Pack domain challenges participants to engineer how cybersecurity obligations, risks, controls, assessments, and evidence connect to defensible decisions. These Cyber Capstones emphasize control traceability, evidence integrity, exception and remediation governance, continuous assurance, and decision-ready reporting.
Sample Scenarios
MISSION PACK
FIRST WATCH
Cybersecurity Technician
This mission helps workforce-entry cyber defense candidates practice the role's core responsibilities. Participants must connect IT foundations with cybersecurity operations by reviewing alerts, identifying basic exposure conditions, building a Cyber Battle Map, documenting observations, and deciding when to escalate.
Sample Scenarios
MISSION PACK
MISSION CONTROL
Cybersecurity Project Managers
Cybersecurity projects cannot be closed on schedule and budget alone. This mission challenges the practitioner to coordinate the work, manage the risks, align stakeholders, validate the outcome, and prove readiness before the project is accepted as complete.
Sample Scenarios
MISSION PACK
BROKEN TRUST
Cybersecurity Architect & Engineer Professionals
The Broken Trust Mission Pack domain challenges participants to study how compromise can move through systems, identities, applications, and integrations that were assumed to be safe. These Cyber Capstones emphasize trust boundaries, identity misuse, partner exposure, and defensible monitoring.
Sample Scenarios
MISSION PACK
LAUNCH SHIELD
Security by Design Professionals
The Launch Shield Mission Pack domain focuses on planning, architecture, engineering, and design decisions before production deployment. These Cyber Capstones evaluate how participants identify exposure early, define requirements, place safeguards, and prove readiness before launch.
Sample Scenarios
MISSION PACK
RED RECON
Red Team Engineer Professionals
The Red Recon Mission Pack domain introduces disciplined red team engineering through an authorized scope, reconnaissance logic, threat mapping, and defensible reporting. These Cyber Capstones help participants study adversary behavior while connecting Red Team activity to Blue Team readiness and to the outcomes of governed exercises.
Sample Scenarios
