Unit 15: Cybersecurity II Capstone Project
Lesson at a glance
| Item | Detail | | --------------------- | --------------------------------------------------------------------------------------- | | Suggested length | 10 × 60 minutes (final two weeks) | | Recommended placement | Weeks 21–22 | | Prerequisite | Units 1–14 | | Materials | Capstone option packets, panel rubric, presentation slides template, signed RoE on file |
Safety: Capstone work is performed within the lab range under signed RoE. No external systems. No personal data. Teacher conferences mandatory at midpoint.
Standards & credential alignment
- VA CTE Cybersecurity Capstone standards.
- NICE Workforce Framework - work-role-aligned demonstrations.
- OffSec PEN-100 / SOC-100 breadth demonstration.
Learning objectives
By the end of the capstone, students can:
- Plan, scope, execute, and document a substantial cybersecurity project.
- Present findings to a panel of professionals (mock or real).
- Defend technical choices and respond to pushback.
- Tie capstone work to an explicit career direction.
Capstone options (pick one)
Option A - Red Team / Blue Team Simulation
Two teams. One attacks the lab range under written RoE. One defends with the SIEM and IR playbook. Teacher referees.
Deliverables:
- Attacker pen test report (Unit 13 standard).
- Defender incident report + timeline (Unit 9 standard).
- Joint after-action report: what worked, what got missed, what the playbook should change.
Option B - SOC Investigation
Teacher provides a curated incident dataset (logs, packet captures, memory image, disk artifacts). Solo or pair.
Deliverables:
- Triage notes.
- ATT&CK-mapped timeline.
- IOC list.
- 8–12 page incident report.
- 7-minute panel presentation.
Option C - Secure Enterprise Build
Design and build a small enterprise from scratch in the lab:
- Active Directory or Azure AD lab.
- Three workstations, one server, one firewall.
- Hardened to a documented baseline (CIS or in-house).
- Monitoring (Wazuh or Security Onion).
- A tested IR runbook for one incident type.
- A written 5-page architecture rationale + threat model.
Deliverables:
- Architecture diagram.
- Hardening checklist with evidence.
- Threat model.
- Demo + 7-minute walk-through.
Option D - Professional Portfolio
A polished public portfolio that wins the first job:
- 5+ written, sanitized lab write-ups.
- 1 long-form post (technical deep-dive).
- A working personal site (GitHub Pages OK).
- A 60-second introduction video.
- A complete LinkedIn profile + resume.
- A 24-month plan (refined from Unit 14).
Deliverables:
- Live URL of portfolio.
- Resume + LinkedIn snapshot.
- 7-minute presentation that walks the panel through the portfolio.
Pacing - full unit (10 days)
| Day | Focus | | --- | -------------------------------------------------------- | | 1 | Capstone selection + scoping document | | 2 | Plan + RoE / authorization sign-off | | 3–4 | Deep work block 1 | | 5 | Mid-point conference with teacher (mandatory) | | 6–7 | Deep work block 2 | | 8 | Draft deliverable + dress-rehearsal presentation to peer | | 9 | Final revisions + presentation polish | | 10 | Panel presentations + portfolio submission |
Day 1 - Scoping document (mandatory before continuing)
Each student submits:
# Capstone Scoping Document
## Option (A/B/C/D):
## Why I picked this option:
## Specific deliverables (list):
## Tools / environment:
## Authorization / RoE statement:
## Definition of done (specific, measurable):
## Risks / dependencies:
## Daily plan (Days 3–9):
## Presentation outline:
Teacher signs off in writing before Day 2 work proceeds.
Day 5 - Mid-point conference (mandatory)
15-minute 1:1 with teacher. Show real progress. Adjust scope if needed. Identify the single thing that will make the project succeed in the second week.
Day 10 - Panel presentations
Format:
- 7-minute presentation.
- 3-minute panel Q&A.
- 5-minute panel deliberation (private).
Panel rubric (each scored 1–5):
- Technical execution.
- Documentation quality.
- Communication.
- Defense under questioning.
- Professional polish.
Suggested panel: teacher + 1–2 invited professionals + 1 second-year peer or alum.
Submission checklist
- [ ] Signed scoping document
- [ ] Final deliverable PDF(s) and any code in a reviewable archive
- [ ] Presentation slides (PDF)
- [ ] Recording of panel presentation
- [ ] Reflection (1 page): what changed about how you see this work, and what you'll do next
- [ ] Updated portfolio with capstone artifact
Capstone defense - common questions
- "Walk me through the moment you were most stuck. What did you do?"
- "If you had two more weeks, what would you do that you didn't?"
- "Where did your work break? What's the limitation a real engagement would hit?"
- "What's the single most important takeaway for someone deciding whether to hire you?"
Teacher background (read this before the lesson)
The capstone is where thin scoping produces thin portfolios. Day 1 is a gate. If the scoping document does not name deliverables, authorization, and a definition of done, do not let deep-work days start.
Hold the midpoint conference even when the learner "is fine." Fine usually means they have not written the report yet.
Panel members should receive the rubric 48 hours ahead. If you cannot recruit an outside professional, use a second instructor or a training lead — someone who will ask an inconvenient question.
Definition of done (quality bar)
A capstone is complete only when all of the following are true:
- Signed scoping document on file (Day 1).
- Mid-point conference notes with any scope change written down (Day 5).
- Final artifact a stranger can open without the author present.
- Authorization / RoE restated in the artifact (even for Option D portfolio pieces that describe labs).
- Presentation stays at 7 minutes; overtime is a rubric deduction, not a badge of effort.
- Reflection names one limitation, not only what went well.
Option-specific bars:
- A: Both teams produce a report to Unit 13 / Unit 9 standard, plus a joint AAR.
- B: Timeline is ATT&CK-mapped; IOCs are copy-pasteable; report is 8–12 pages, not 3.
- C: Architecture diagram, hardening evidence, threat model, and a demo that survives one failure.
- D: Live URL, five sanitized write-ups, resume, and a 24-month plan with dates — not slogans.
Materials checklist
- [ ] Capstone option packets printed
- [ ] Scoping template in the LMS
- [ ] Panel rubric + calendar hold for Day 10
- [ ] Recording plan (consent for minors if applicable)
- [ ] Signed RoE reconfirmed before Options A–C lab work
Differentiation, IEP, and 504 supports
- Executive function: Daily plan in the scoping document is required, not optional.
- Writing: Option B page count can be 6–8 with denser appendices for documented IEP writing goals.
- Speech: Panel can accept a recorded 7-minute presentation plus live 3-minute Q&A.
- Team load: Option A teams of three if a recorder role is needed; still one joint AAR.
- Adult overlay: Portfolio (D) may omit guardian language and use employer-safe sanitization rules.
Common misconceptions
- "I'll figure it out as I go." - The scoping document is the difference between a strong capstone and a missed one.
- "It has to be original." - Reproducing a known scenario well, and presenting it well, is exactly what entry-level roles ask for.
- "The presentation is at the end." - The presentation shapes the work. Plan it from Day 1.
- "More tools means a better project." - One authorized path, fully documented, beats an unauthorized extra tool.
Career connection
Capstone deliverables become portfolio pieces. Panel members hire and recommend. The artifact that can be opened without you in the room is the one that gets the interview.
Final reflection prompt (for students)
Two years ago you didn't know what cybersecurity was. Today you can scope an engagement, run it, document it, and defend it under questioning. Write 1 page on what changed about how you see technology, work, and yourself. Keep this. Read it again on the day you start your first cyber job.
Final reflection prompt (for teachers)
- Which capstone option produced the strongest outcomes? Why?
- Which student grew the most? What was the first turning point?
- What didn't work in the capstone structure that you'll change next year?
- Which of your students should you keep mentoring after graduation?