BOOT-OT Evidence Workbook
Professional evidence workbook
Complete this while working the corresponding online lab. Entries save only in this browser until exported or printed. Do not enter live credentials, protected customer information, or uncontrolled personal data.
Scope, consequence and rollback
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
IPv4 and subnet plan
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Follow the packet
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Switch ports and VLANs
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
ACL and firewall policy review
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
BACnet path and broadcast boundary
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Protocol and certificate boundaries
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Asset and dependency inventory
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Supported platform hardening
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Remote-access design
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Certificate and time failure
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Logs and baseline
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Backup and representative restore
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Incident tabletop
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |
Defensible BAS network and recovery capstone
Required artifact: Authority and consequence; inventory/dependencies; architecture/flows; named access; baseline/logs/time; change/rollback; incident decision; restore/function proof; residual risk and owner.
| Identity, source, mode, authority | |
|---|---|
| Hazards, impacts, prohibited actions, stop criteria | |
| Expected normal and acceptance basis | |
| As-found evidence and timestamps | |
| Calculations with units and reasonableness | |
| Hypotheses, contradictions, discriminating test | |
| Action, expected result, abort/rollback | |
| Result, changed case, restoration, as-left | |
| Open risk, owner, due date, defense |