T-C-half-C — Center, ½ day: gap → suppliers → advice
Lab guide · Isla Mercantile Group · 195m net (09:00–12:30)
Schedule
Time
Block
Minutes
09:00
C0 — Engagement kickoff
15
09:15
C2 — Maturity quick-scan (CMB)
25
09:40
C3 — Baseline assessment (CBA)
50
10:30
Break
15
10:45
C9 — Supplier crypto risk (TPRM)
40
11:25
C7 — Design & policy
35
12:00
C8 — Report & readout
30
Before you start
Log in
Your slip has your own credentials. Nobody shares a login; working in pairs on one login (one drives, one checks) is fine.
System
Address
Login
Used in
Eon Insights
https://insights.edu.eoncore.net
traineeNN
I-blocks, I-TAG, X1
Eon Center
https://center.edu.eoncore.net
traineeNN (org_admin of team-NN)
C-blocks, K-blocks, X1
Center, Kartis pages only
https://center.edu.eoncore.net
kNN (kartis_only)
K-blocks in the Insights + Kartis tracks
Isla public sites
https://<vhost>.isla.edu.eoncore.net
none
I-M2, K-1, C6, I-M11
In Center, switch the UI to EN on first login. Your Center organisation team-NN has one customer: Isla Mercantile Group (team-NN). traineeNN and kNN are both members of team-NN and work on that same customer.
Shared environment
One Insights for the whole group. Tags are shared: every team sees the others' tags appear.
Custom views are shared: every view you save is in everyone's list. Prefix the name with your team or login (webshop — chain); do not change or delete a view you did not create.
There is no personal reset. Do not delete data, uploads or tags you did not create.
Tag rule: tag only hosts of your own app, one person per host, never remove tags you did not set. Full convention: Tag convention.
Center and the Kartis pages keep state per team customer: register upload, posture runs, finding status and labels are shared by traineeNN and kNN of the same team, and invisible to other teams.
Traffic replays (probe chapters) are started by the trainer. You need no shell on the server.
AI: the Insights Chat is available in the Insights blocks. The Kartis pages have no AI.
Isla at a glance
Client: Isla Mercantile Group, retail and payments, Curaçao. Internal names <host>.<app>.isla.test in 10.20.0.0/16; public names <vhost>.isla.edu.eoncore.net.
App (team)
Internal hosts
Subnet
Public vhosts
webshop
shop, api, db, pay.webshop.isla.test
10.20.1.0/24
www, shop, api, pay
intranet
sso, portal, cache.intranet.isla.test
10.20.2.0/24
intranet
payments
gw, vpn, hsm.payments.isla.test
10.20.3.0/24
none
loyalty
app, api, old.loyalty.isla.test
10.20.4.0/24
loyalty, loyalty-old
Hosts outside isla.test and isla.edu.eoncore.net are background noise. Search isla.test to hide them.
Client documents (handed out per block): client brief, ckm-intake.xlsx, register.xlsx, register-flawed.xlsx.
Exercises
C0 — Engagement kickoff
09:00 · 15 min
Exercise
Task
Finding
C0.1
Read the client brief in pairs: the two engagement questions, one judging criterion per stakeholder, two statements you would not accept without evidence
F08, F11
C0.2
Log in to Center, open Isla Mercantile Group (team-NN), copy its customer ID, set journey milestone "Maturity intake (CMB)" to In progress with a note
—
C2 — Maturity quick-scan (CMB)
09:15 · 25 min
Exercise
Task
Finding
C2.1
From the brief alone: which two CMB categories lowest, which one highest?
—
C2.2
/cmb/results → Isla — CMB self-assessment: overall score, band, three lowest and two highest categories; who does the work behind the highest
—
C2.3
Two answers to treat as claims to verify, one answer whose score misrepresents Isla; which block produces the evidence
F01, F02, F08
C3 — Baseline assessment (CBA)
09:40 · 50 min
Exercise
Task
Finding
C3.1
Interview the CISO (trainer). Short: the 10 marked questions; full: all 36, your pair's subcategories. Write her answers in her words; probe at least three
—
C3.2
Set a maturity level per question with a one-line reason; create assessment Isla — PQC baseline for team-NN and import the workbook
—
C3.3
Run the AI assessor on question 17 (full: also 33); compare its level with yours, edit, decide on Approve
F03
C3.4
Gap table per subcategory: current level, 12-month target, gap, driver (DORA / NIS2 article or PQC exposure)
F14
C9 — Supplier crypto risk (TPRM)
10:45 · 40 min
Exercise
Task
Finding
C9.1
DNS / Email and Technology: list every third party (SPF, DKIM, mail provider, CDN, cloud), match to the brief; who handles Isla data or keys and is missing?
F11
C9.2
Decision tree for the five suppliers in the brief plus the one you found: crypto role, tier, one-line reason (five minutes)
F11
C9.3
Per team one supplier (PayCarib, IdentiQ or Mailfuel): five questions before renewal (key custody, evidence, rotation, incidents, migration and exit) and the two clauses you would not sign without
—
C9.4 (full)
PayCarib refuses the agility clause T1.5.1. In pairs: what Isla loses, what it can accept instead, who decides
—
C7 — Design & policy
11:25 · 35 min
Exercise
Task
Finding
C7.1
Generate a Cryptography Baseline in Polgen for Isla (template Financieel EU, sector financial, English, NIS2 / DORA / ISO 27001 / NIST, Enterprise); download as Markdown
—
C7.2
Per gap from C3: the clause that covers it or "not covered"; then two clauses that answer no Isla gap
F01, F02, F03, F07, F08, F11, F14
C8 — Report & readout
12:00 · 30 min
Exercise
Task
Finding
C8.1
Generate the Kartis management report: which of F02, F03, F08, F09, F11, F12 appear, in which counter, which is missing and why?
F02, F03, F08, F09, F11, F12
C8.3
One page per group: where we stand (Q1, Q2), what it costs (hours), what first (three actions, owner, date); read out to the CISO