Projects should have a clear audience, authentic decision or product, bounded scope, evidence, feedback, and a defined safety or privacy control. The same project can be scaled by changing depth, independence, source requirements, and stakeholder complexity.
J.1 Project Selection Criteria
Choose projects that:
- Support defined outcomes rather than novelty alone
- Can be completed with available time, access, and supervision
- Produce evidence that can be assessed consistently
- Avoid real credentials, sensitive data, unauthorized testing, or unsafe publication
- Include communication and reflection
- Have a sponsor or audience who can provide useful feedback without controlling the academic conclusion
- Can be maintained, transferred, or retired responsibly
J.2 K-12 Projects
| Learner band | Project | Main deliverable | Safety or privacy boundary |
|---|---|---|---|
| K-3 | Create a “Pause, Ask, Tell” story | Illustrated story or role-play | Fictional characters and situations only |
| K-3 | Design a kindness shield for digital spaces | Poster and explanation | No public sharing of real incidents |
| Grades 4-6 | Build a family cyber-safety checklist | Plain-language checklist | Do not record actual passwords or account details |
| Grades 4-6 | Redesign a fictional profile for privacy | Before-and-after profile | Use invented identities and images |
| Grades 4-6 | Create a source-checking game | Card game and instructions | Use age-appropriate fictional claims |
| Grades 7-8 | Conduct a school-approved security awareness campaign | Messages, poster, and evaluation | No deceptive live messages without formal approval |
| Grades 7-8 | Map the lifecycle of a fictional student account | Diagram and control recommendations | No use of real directory or student data |
| Grades 7-8 | Build a phishing evidence workbook | Fictional message set and answer guide | Nonclickable examples only |
| Grades 9-12 | Develop an incident tabletop for a community organization | Scenario, injects, role cards, and debrief | Fictional systems, people, and data |
| Grades 9-12 | Create a secure-design review for a school app concept | Threat model and design recommendations | Design analysis only; no testing of real applications |
| Grades 9-12 | Produce a cybersecurity career evidence portfolio | Curated artifacts and reflection | Remove sensitive information and obtain permission for shared work |
J.3 Undergraduate Capstones
| Project | Representative deliverables |
|---|---|
| Security architecture for a fictional small enterprise | Requirements, architecture, threat model, control rationale, recovery plan, and briefing |
| Identity lifecycle redesign | Current-state analysis, target workflow, access-review model, migration risks, and metrics |
| Incident detection and response exercise | Sanitized data set, detection logic, response runbook, tabletop, and after-action report |
| Secure software development review | Threat model, dependency analysis, code-review plan, pipeline controls, and release gate |
| Cloud shared-responsibility assessment | Architecture, responsibility matrix, configuration findings, evidence, and remediation roadmap |
| Privacy-aware analytics design | Data inventory, purpose, minimization, access, retention, impact analysis, and prototype |
| Cybersecurity learning module | Outcomes, lesson, practical activity, assessment, accessibility review, and evaluation data |
| Community cyber-resilience project | Needs assessment, educational materials, delivery plan, feedback, and sustainability plan |
| Supply-chain risk assessment | Component or service inventory, dependency mapping, risk analysis, monitoring, and exit plan |
| Digital forensics process evaluation | Approved evidence set, process, chain-of-custody documentation, findings, and limitations |
J.4 Graduate and Research Projects
| Project | Research or design focus |
|---|---|
| Cryptographic agility readiness model | How organizations inventory dependencies, prioritize transition, test compatibility, and govern change |
| Security and privacy evaluation of agentic AI workflows | Identity, permissions, tool use, data exposure, oversight, logging, and failure containment |
| Resilience metrics for critical educational services | Measures that connect system recovery, communication, learner impact, and institutional mission |
| Human-centered phishing reporting study | Which reporting designs reduce delay, shame, and uncertainty while improving useful evidence |
| Accessibility of cyber ranges | Barriers, accommodations, equivalent evidence, and design recommendations |
| Software supply-chain transparency study | Practical use and limitations of component inventories, provenance, vulnerability information, and supplier communication |
| Privacy-preserving student analytics | Data minimization, utility, fairness, governance, and evaluation of a bounded model |
| Security curriculum maintenance framework | Volatility classification, source governance, release testing, retirement, and succession |
| Operational technology tabletop design | Stakeholder, safety, availability, and recovery decisions without unsafe live-system testing |
| Comparative identity architecture evaluation | Usability, phishing resistance, recovery, lifecycle governance, and deployment tradeoffs |
J.5 Professional Program Projects
- Develop a ninety-day risk-reduction plan for a fictional organization.
- Evaluate an incident-response plan through a facilitated tabletop.
- Create a role-based security awareness module and measurement plan.
- Review a supplier's security evidence and prepare executive questions.
- Build an identity and privileged-access review checklist.
- Create a secure project-launch checklist for a product or service team.
- Develop a communications plan for account compromise or data exposure.
- Design an annual curriculum or workforce-development review process.
J.6 Capstone Gate Checklist
- [ ] Problem, audience, purpose, and success criteria are defined.
- [ ] Authorization, data, access, intellectual property, and publication boundaries are approved.
- [ ] Sources and methods are appropriate.
- [ ] Milestones include proposal, design review, evidence review, and final defense.
- [ ] Accessibility, ethics, privacy, safety, and operational consequence are addressed.
- [ ] Deliverables include limitations and recommendations.
- [ ] The final package can be transferred, reproduced, or responsibly archived.