This manual is for IT-FPX4993 Assessment 3, start to submission. The closing deliverable in IT-FPX4993, Cybersecurity Capstone, usually pulls the portfolio together and points it forward: a post-incident review with a timeline, a root cause separated from its symptoms, the control gaps the event exposed, a phased roadmap with owners and costs, a residual risk position, and a document a stranger can navigate. Verdicts are recorded criterion by criterion against whichever guide came with your assessment. Below is the order our tutors follow, an outline built criterion by criterion, and a passage annotated down the margin. Prefer to hand it off? A premium original sample for this exact assessment comes back within 24 to 48 hours with every artifact naming the same system the same way, revised free until the guide is satisfied. Your courseroom may print this as IT FPX 4993 Assessment 3 or IT4993 Assessment 3; it is the same deliverable, and IT-FPX4993 Assessment 3 is what this manual walks through.
One honesty note before the manual: Capella revises courses and scoring guides over time, so always write to the exact scoring guide attached to your assessment in the courseroom. The course identity above is verified on capella.edu; the method and structure below are our tutors' approach to it, not Capella's official rubric text.
How IT-FPX4993 Assessment 3 is scored
Separate verdicts, four levels, one per criterion, and this is the deliverable where coherence across the whole portfolio is finally assessed:
| Level | What it means on a post-incident review and roadmap deliverable |
|---|---|
| Distinguished | The timeline is built from records rather than recollection, the root cause is distinguished from what it looked like at the time, the roadmap carries owners, costs and sequencing that respects real dependencies, and residual risk is owned by a named role with a review trigger. The criterion wants one thing past a summary, and it says which. |
| Proficient | The review is complete and the roadmap is credible. Strong work one column below the top, usually because the phases have dates but no money or no owner. |
| Basic | A narrative of what happened followed by a list of recommendations. Readable material with no traceability back to the earlier artifacts lands here. |
| Non-performance | A required element is absent, most often the cost of the roadmap or the executive summary. The floor is for what is not there. |
Treat this document as the one you will hand an interviewer. That means captions and dates on every figure, one name per system across every artifact, an executive summary written for somebody who reads a single page, and nothing confidential left inside it.
The IT-FPX4993 Assessment 3 method, step by step
-
Build the timeline from records, not from memory
Log entries, ticket timestamps, message threads and change records, each with a time and a source. Then mark the two intervals that matter most, which are the gap between the first observable indicator and anybody noticing, and the gap between noticing and the first containing action.
-
Separate the root cause from the symptom
The encrypted file share is what people saw. The cause is further back, in a credential that worked from an unexpected place, a permission nobody reviewed, or a backup nobody had restored from in eleven months. Write one cause statement and support it with the timeline entries that carry it.
-
Turn each gap into a control, and each control into a phase
Every finding from the review should appear in the roadmap, and every roadmap item should trace back to a finding. A recommendation with no finding behind it looks imported from a template, and a finding with no recommendation reads as unfinished work.
-
Sequence on dependencies and cost, then say who owns each phase
Phases with dates but no money and no role attached are a schedule nobody can approve. Put a cost, an owner by role, and the measure that will show the phase worked next to every item, and order them so nothing depends on something scheduled later.
-
Write the residual position and who accepts it
What the roadmap does not close, why that remainder is tolerable, which role accepts it, and the single change that would force an earlier review. A closing document that claims the risk is now handled is the one sentence that costs credibility across every other section.
-
Reconcile the artifacts before you write the summary
Read the diagram, the register, the review and the roadmap side by side and make the nouns and the totals agree. Then leave the one-page summary until the tables have stopped changing, and keep it short enough that a reader could repeat it back accurately.
A structure that maps to the criteria
Internal planning lengths for a closing capstone document, not Capella rules; expand whichever criterion your own guide leans on hardest.
| Section | What it must do | Guide |
|---|---|---|
| Incident timeline | Events with times and sources, plus the interval to detection and the interval to containment stated explicitly. | ~300 words |
| Root cause and contributing factors | One cause statement supported by timeline entries, with the conditions that let it succeed listed separately. | ~250 words |
| Control gaps | What was absent, what existed and failed, and what existed and was never verified, each traced to the timeline. | ~250 words |
| Roadmap | Phases with dependencies, owners by role, costs, dates and the measure that will show each phase worked. | ~350 words |
| Residual risk and acceptance | What the roadmap leaves open, why it is tolerable, the accepting role, and the trigger for an earlier review. | ~200 words |
| Portfolio presentation and sources | Executive summary, captions and dates, consistent naming, redaction statement, and sources cited by revision and year in current APA. | ~200 words |
Annotated sample excerpt
A short model paragraph our team wrote where a guide's highest level sits. Take the structure of the reasoning, then build it from your own timeline.
The visible event at the housing agency was 14 terabytes of tenant files encrypted over a Friday night, but the cause sits eleven weeks earlier, in a contractor account that was created for a three-week records project and never disabled, and which retained write access to the file share after the project closed.1 Three conditions let that account matter: it authenticated with a password only, its sign-ins from outside the agency's address range produced a log entry that nothing was watching, and the backup job that would have made the encryption survivable had not been restore-tested since the previous September, which is why recovery took nine days rather than one.2 Stating it this way matters because the tempting cause, which is that somebody clicked something, is neither supported by the timeline nor actionable, while a dormant account with standing write access and an unverified backup produces three recommendations a director can fund on Monday.3
- 1Separates what people saw from where the cause sits, and dates both. A cause with a distance in weeks behind it reads as an investigation rather than a narrative.
- 2Lists the conditions that let the cause succeed, each of which becomes a control. Three conditions produce three roadmap rows without any further invention.
- 3Rejects the easy cause explicitly and says why, on grounds of evidence and actionability. Naming the explanation you declined is the move that lifts the analysis criterion.
The full premium sample for your exact assessment, written fresh to your scoring guide and issue, is free to request. Study it, revise it into your own voice, and submit work you understand.
The five mistakes that cost Distinguished
- A timeline reconstructed from recollection. Times without sources cannot be checked, and the two intervals that matter depend entirely on those timestamps.
- The symptom recorded as the cause. Encrypted files are the outcome, and a review that stops there produces recommendations nobody can act on.
- Recommendations with no finding behind them. An item that appears in the roadmap and nowhere in the review looks copied from a template rather than earned.
- Phases carrying dates and nothing else. Without a figure and a role beside each one, the roadmap is a set of headings nobody has agreed to fund.
- Artifacts that contradict each other. One system carrying two names, or one cost carrying two figures, is enough for a reader to distrust every document in the set.
Pre-submission checklist
- Each criterion in your guide addressed under its own heading
- Timeline entries carrying a time and a source, with both intervals stated
- One root cause statement, with contributing conditions listed separately
- Every gap traced to the timeline and every roadmap item traced to a gap
- Phases carrying cost, owner by role, dependency order and a success measure
- Residual risk owned with a review trigger, one page summary written last, current APA both ways
Closing portfolio due and the artifacts disagreeing?
Send the earlier deliverables, the incident material and the criteria for this stage. The timeline comes back sourced, the root cause comes back separated from the symptom, and the roadmap comes back with costs, owners and dependency order, with every artifact naming the same system the same way. First premium sample free.