🔑This page doesn't reteach firewalls, malware removal, or file recovery — you already have those from 1.2.1–1.2.3. What's new is turning that work into documentation good enough for someone else to follow exactly.
AP Skill 2.A–2.DAP Skill
The Cybersecurity Lifecycle as a Write-Up Framework
You met the Cybersecurity Lifecycle back in 1.1.1 as a way to think about security in general. Here, it becomes something more specific: a structure for documenting exactly what you did during a remediation, in an order that makes sense to someone reading it after the fact.
🔄 The Lifecycle as a Write-Up Tool — click each stage
Document how you found the problem — what you checked, what you saw, and how you knew something was actually wrong. This is your evidence, not just your conclusion.
✍️A fix can genuinely belong to more than one stage — disabling a malicious service might count as both Respond (stopping the immediate threat) and Protect (making sure it can't restart the same way). Note both. The goal is an accurate account, not a forced fit into exactly one box.
AP Skill 2.A–2.DAP Skill
Worked Example: Writing Up a Fix
ExampleGuided Example — Documenting One Fix, Start to Finish
During your investigation, you notice an unfamiliar process running that's using an unusual amount of network activity, and a file-sharing service is enabled that nobody on the team remembers turning on.
Detect
Write down exactly how you noticed: 'Process monitoring showed an unrecognized process with continuous outbound network activity; a review of enabled services showed file sharing active with no record of it being intentionally configured.'
Concept
Building a How-To Artifact People Actually Use
Good technical how-tos share a few traits regardless of topic: they lead with what the reader will be able to do, they use short numbered steps instead of dense paragraphs, and they call out the exact thing to check at each step — not just the action to take.
Instead of
Try
"Check the firewall settings"
"Open the firewall rules and confirm ports 139 and 445 are blocked"
"Look for suspicious processes"
"Sort running processes by network activity — anything unfamiliar near the top is worth investigating"
💡This is the exact same identify → explain → determine → implement structure from 1.1.4, just written for a reader instead of a rubric.
Concept
Revisiting Team Norms
You set team norms back in 1.1.4. This project is a good moment to check whether they actually held up under real pressure — a live investigation with a rubric and a deadline is a very different test than a hypothetical discussion. If a norm didn't survive contact with real work, that's not a failure; it's useful information for revising it into something that will.