Portfolio prototype · Fictional data
Project ControlTower
Enterprise IT Controls & Continuous Compliance Automation
An independent cybersecurity portfolio prototype demonstrating how Python automation can help GRC teams identify missing, overdue, or incomplete IT control evidence across five operational domains.
Business challenge
Evidence for access management, change control, vulnerability management, backups and incident response is often spread across teams and tools, which makes it hard to see what is missing, late or incomplete.
ControlTower demonstrates a reproducible evidence-metadata review workflow. It is not a deployed enterprise platform.
Five control domains
- 01
Access Governance
Access reviews, MFA reviews and account evidence.
- 02
Change Control
Change tickets, approvals and deployment records.
- 03
Vulnerability Management
Scan reports and remediation evidence.
- 04
Backup and Restore
Backup jobs and restore-test evidence.
- 05
Incident Management
Incident drills and incident record evidence.
Automation architecture
- STEP 1
Fictional CSV Evidence Data
- STEP 2
Python Validation Engine
- STEP 3
Exception Detection
- STEP 4
CSV / JSON / Markdown Reports
- STEP 5
Human Review
No live Microsoft 365, Jira, SIEM or Rapid7 integrations. System names in the dataset are labels on fictional records.
Demonstration metrics
Results from synthetic test data — not real audit findings or enterprise compliance metrics.
5
Control domains
12
Fictional evidence records
6
Records flagged for review
6
Ready for manual sample review
2
Automated unit tests passed
Featured dashboard
Fictional evidence records by domain. A flag means the record needs human review — not a proven security failure.
- Access Governance1 flagged / 3 records
- Change Control2 flagged / 3 records
- Vulnerability Management1 flagged / 2 records
- Backup and Restore1 flagged / 2 records
- Incident Management1 flagged / 2 records
Technical deliverables
Each file opens on GitHub in a new tab.
- 01Python Validation EngineEvidence-metadata validation script.
- 02Fictional Evidence Dataset12 synthetic evidence records.
- 03Automated Unit TestsTests for the validation logic.
- 04Control CatalogControls across five domains.
- 05Architecture DiagramHow data moves through the workflow.
- 06Evidence Results and DashboardGenerated review summary.
- 07Excel Controls DashboardSpreadsheet view of the results.
- 08Test Plan and Security LimitationsTest approach and known limits.
Skills demonstrated
- Python Automation
- IT General Controls
- GRC Evidence Management
- Exception Reporting
- Access Governance
- Change Management
- Vulnerability Management
- Compliance Monitoring
- Executive Reporting
Limitations
- This is an educational prototype.
- All evidence records are fictional.
- No real company environment was assessed.
- There are no live enterprise API integrations.
- The program does not determine PCI DSS or SOC 2 compliance.
- Actual security control effectiveness requires independent testing.