This manual is for IT-FPX4076 Assessment 2, start to submission. The middle deliverable in this course usually moves from stating rules to operating them, which means a procedure somebody could follow under pressure plus the governance that handles the places where the organization cannot meet its own requirements. Both halves are graded, and the second is where marks are quietly lost: every organization fails its own policy somewhere, and the criteria ask whether that failure is visible, owned, and dated. Below is the method our tutors use for it, a structure that maps to the criteria, and an annotated sample excerpt. Prefer to hand it off? A premium original sample for this exact assessment comes back in 24 to 48 hours, revised free until it meets the guide. Your courseroom may print this as IT FPX 4076 Assessment 2 or IT4076 Assessment 2; it is the same deliverable, and IT-FPX4076 Assessment 2 is what this manual walks through.
One honesty note before the manual: Capella revises courses and scoring guides over time, so always write to the exact scoring guide attached to your assessment in the courseroom. The course identity above is verified on capella.edu; the method and structure below are our tutors' approach to it, not Capella's official rubric text.
How IT-FPX4076 Assessment 2 is scored
No percentages are involved. An evaluator reads each criterion row against your work and places it at one of four levels, so read those levels as instructions rather than as feedback:
| Level | What it means on a procedure and exception set |
|---|---|
| Distinguished | The steps are executable by a named role without the author present, and every exception carries a compensating measure, an accepting authority, and an expiry that cannot lapse quietly. There is an extra move in each row; go and take it. |
| Proficient | The procedure is complete and the exception process is present and correct. Competent work that has not yet been pressure-tested against a real failure. |
| Basic | A description of what recovery involves rather than a procedure anybody could follow, with exceptions mentioned as a concept. |
| Non-performance | A required element is missing, commonly the accepting authority or the expiry. A blank there takes the row to the bottom on its own. |
Write the procedure for the worst plausible reader: somebody covering at two in the morning who has never done this before and cannot reach you. That standard turns a description into steps, and steps are what the criteria are actually asking for.
The IT-FPX4076 Assessment 2 method, step by step
-
Fix the recovery objectives in numbers before anything else
Two figures govern the whole document: how long the business will tolerate the service being down, and how much data it will tolerate losing. Take a regional insurance brokerage that has agreed on four hours and fifteen minutes respectively. Every step you write afterward either meets those numbers or generates an exception, and a runbook with no stated objectives cannot be judged against anything.
-
Write the procedure as numbered steps with a role on each one
Not a narrative. Step, actor, expected result, and what to do when the expected result does not appear. Include the things people forget under pressure: who declares the incident, who is authorized to fail over, who tells clients, and where the credentials are held when the usual system holding them is the thing that is down.
-
Measure the gap honestly
In our brokerage the policy administration platform is protected by a nightly backup, which means an actual data-loss exposure of up to 24 hours against a stated tolerance of fifteen minutes. That is a gap of 23 hours and 45 minutes, and writing the arithmetic is worth more than any adjective. A procedure that quietly assumes the objective is met is the defect the assurance criterion is written to catch.
-
Turn each gap into an exception record rather than a footnote
Name the requirement not being met, the system owner asking for relief, the reason, the compensating measure covering the interval, the residual risk, the person with authority to accept that risk, and the date the relief ends. Exceptions with no expiry silently become policy, which is how an organization ends up formally requiring something that a third of its systems have been excused from for years.
-
Attach an approval matrix keyed to risk
Say who may accept what. Low residual risk can sit with the system owner, moderate with the information security manager, high with an executive who can be named by position. An exception signed by the person who wanted it is not governance, and the criteria treat a missing matrix as a missing control rather than as an oversight.
-
Test the document on paper, then self-score
Walk the procedure with somebody who was not involved in writing it and mark every step where they had to guess. Those are your defects. Then place each criterion at D, P, B, or N yourself, rewrite anything below the top, and upload early enough that a two-business-day evaluation still leaves room for one revision.
A structure that maps to the criteria
The targets here are how our tutors proportion a runbook of this kind, not a Capella instruction; expand any section your guide weights more heavily.
| Section | What it must do | Guide |
|---|---|---|
| Scope and objectives | Which services the procedure covers, the tolerated downtime, the tolerated data loss, and who owns the document. | ~200 words |
| Roles and activation | Who declares, who executes, who authorizes a failover, who communicates, and how each is reached out of hours. | ~200 words |
| Procedure | Numbered steps with an actor, an expected result, and a stated action for when the result does not appear. | ~400 words |
| Gap analysis | Where current capability falls short of the objectives, quantified rather than described. | ~250 words |
| Exception register | Each gap as a record: requirement, requester, compensating measure, residual risk, accepting authority, expiry. | ~250 words |
| Testing and sources | Exercise schedule, what a test must demonstrate, how the document is versioned, and references in current APA. | ~150 words |
Annotated sample excerpt
One original model record from our team, at the level of specificity the top of the guide describes. Learn the fields, then complete them from your own scenario.
EX-2026-014 records that the policy administration platform cannot meet the 15 minute recovery point objective stated in section 2.3, because the vendor-hosted instance supports nightly snapshots only, leaving an exposure of up to 23 hours and 45 minutes.1 The compensating measure is a twice-daily export of the transaction journal to a separate region, which reduces worst-case exposure to under 12 hours, together with a documented manual re-entry procedure for same-day endorsements.2 Residual risk is assessed as moderate and accepted by the Chief Operating Officer on 3 June 2026; this exception expires on 3 December 2026, and the platform owner must present either a compliant replication option or a renewed request before that date.3
- 1Identifies the exception, cites the clause it departs from, and states the gap as a number. An auditor can verify every element of this sentence without a conversation.
- 2Gives a compensating measure that actually reduces the exposure and quantifies the reduction, rather than naming an unrelated control and hoping it counts.
- 3Names the accepting authority by position, dates the acceptance, and sets an expiry with an obligation attached to it. Expiry with a named consequence is what stops relief becoming permanent.
The full premium sample for your exact assessment, written fresh to your scoring guide and issue, is free to request. Study it, revise it into your own voice, and submit work you understand.
The five mistakes that cost Distinguished
- Objectives left as adjectives. Rapid recovery and minimal loss cannot be tested, and a procedure with no numbers has nothing to be measured against.
- A narrative where steps belong. Prose describing recovery leaves the reader deciding the order, which is the one thing a runbook exists to remove.
- Gaps mentioned but not measured. Saying the backup arrangement is imperfect earns nothing; saying it exposes 23 hours of data earns the analysis row.
- An exception with no expiry. Relief that never lapses is a policy change nobody approved and nobody recorded.
- Approval granted by the requester. When the person asking for relief is the person accepting the risk, the governance criterion has nothing left to grade.
Pre-submission checklist
- Recovery time and recovery point objectives appear as numbers in the scope section
- Every step names an actor, an expected result, and a fallback when it does not occur
- Out-of-hours contact and credential access are covered without depending on the failed system
- Each gap is quantified and carries a matching exception record
- Every exception has a compensating measure, an accepting authority by position, and an expiry date
- The document has been walked by somebody who did not write it, then self-scored row by row
Runbook due and the exceptions are unwritten?
Send the scenario, the recovery objectives, and the criteria. A premium original returns inside 24 to 48 hours with steps a stranger could follow, gaps measured, and exception records that expire on a date. First one is free.