Buckets:
| [ | |
| { | |
| "Instruction": "Explain the concept clearly for a cybersecurity trainee. Focus on risk register in governance risk and compliance.", | |
| "Input": "An organization is improving its governance risk and compliance program and wants training guidance on risk register. The guidance must be suitable for authorized security work, model fine-tuning, and analyst education.", | |
| "Output": "## Summary\nrisk register matters because it affects how defenders prevent, detect, prioritize, or respond to security risk in governance risk and compliance. A useful assistant should explain the idea, connect it to operational decisions, and avoid turning the answer into an abuse procedure.\n\n## Practical guidance\n1. Define the asset, user, data, or workflow affected by risk register.\n2. Identify the business impact, likely threat actors, common failure modes, and existing controls.\n3. Prefer measurable defensive actions: inventory, configuration review, logging, alerting, access control, patching, segmentation, backup, and recovery validation.\n4. Document assumptions, evidence, risk rating, owner, remediation plan, and review date.\n5. Validate the control in a lab, staging environment, tabletop exercise, or approved assessment before relying on it in production.\n\n## Training answer characteristics\n- Be specific enough for an analyst to act defensively.\n- Distinguish confirmed evidence from hypotheses.\n- Include escalation criteria and safe handoff points.\n- Reference frameworks such as NIST CSF, CIS Controls, OWASP, MITRE ATT&CK, or ISO 27001 when relevant.\n- Avoid instructions that enable unauthorized access, stealth, credential theft, malware deployment, or destructive activity.\n\n## Example safe response\nFor risk register, start by confirming scope and authorization, gather relevant logs or configuration evidence, compare findings against policy and known-good baselines, prioritize by exposure and impact, then recommend remediation with verification steps.", | |
| "Metadata": { | |
| "domain": "compliance-governance-risk", | |
| "subdomain": "risk register", | |
| "difficulty": "beginner", | |
| "task_type": "explanation", | |
| "safety_level": "authorized_defensive_educational", | |
| "intended_use": "fine-tuning cybersecurity assistants" | |
| } | |
| }, | |
| { | |
| "Instruction": "Create a practical defensive checklist for an authorized security team. Focus on audit evidence in governance risk and compliance.", | |
| "Input": "An organization is improving its governance risk and compliance program and wants training guidance on audit evidence. The guidance must be suitable for authorized security work, model fine-tuning, and analyst education.", | |
| "Output": "## Summary\naudit evidence matters because it affects how defenders prevent, detect, prioritize, or respond to security risk in governance risk and compliance. A useful assistant should explain the idea, connect it to operational decisions, and avoid turning the answer into an abuse procedure.\n\n## Practical guidance\n1. Define the asset, user, data, or workflow affected by audit evidence.\n2. Identify the business impact, likely threat actors, common failure modes, and existing controls.\n3. Prefer measurable defensive actions: inventory, configuration review, logging, alerting, access control, patching, segmentation, backup, and recovery validation.\n4. Document assumptions, evidence, risk rating, owner, remediation plan, and review date.\n5. Validate the control in a lab, staging environment, tabletop exercise, or approved assessment before relying on it in production.\n\n## Training answer characteristics\n- Be specific enough for an analyst to act defensively.\n- Distinguish confirmed evidence from hypotheses.\n- Include escalation criteria and safe handoff points.\n- Reference frameworks such as NIST CSF, CIS Controls, OWASP, MITRE ATT&CK, or ISO 27001 when relevant.\n- Avoid instructions that enable unauthorized access, stealth, credential theft, malware deployment, or destructive activity.\n\n## Example safe response\nFor audit evidence, start by confirming scope and authorization, gather relevant logs or configuration evidence, compare findings against policy and known-good baselines, prioritize by exposure and impact, then recommend remediation with verification steps.", | |
| "Metadata": { | |
| "domain": "compliance-governance-risk", | |
| "subdomain": "audit evidence", | |
| "difficulty": "intermediate", | |
| "task_type": "checklist", | |
| "safety_level": "authorized_defensive_educational", | |
| "intended_use": "fine-tuning cybersecurity assistants" | |
| } | |
| }, | |
| { | |
| "Instruction": "Analyze the scenario and recommend safe next steps. Focus on PCI DSS controls in governance risk and compliance.", | |
| "Input": "An organization is improving its governance risk and compliance program and wants training guidance on PCI DSS controls. The guidance must be suitable for authorized security work, model fine-tuning, and analyst education.", | |
| "Output": "## Summary\nPCI DSS controls matters because it affects how defenders prevent, detect, prioritize, or respond to security risk in governance risk and compliance. A useful assistant should explain the idea, connect it to operational decisions, and avoid turning the answer into an abuse procedure.\n\n## Practical guidance\n1. Define the asset, user, data, or workflow affected by PCI DSS controls.\n2. Identify the business impact, likely threat actors, common failure modes, and existing controls.\n3. Prefer measurable defensive actions: inventory, configuration review, logging, alerting, access control, patching, segmentation, backup, and recovery validation.\n4. Document assumptions, evidence, risk rating, owner, remediation plan, and review date.\n5. Validate the control in a lab, staging environment, tabletop exercise, or approved assessment before relying on it in production.\n\n## Training answer characteristics\n- Be specific enough for an analyst to act defensively.\n- Distinguish confirmed evidence from hypotheses.\n- Include escalation criteria and safe handoff points.\n- Reference frameworks such as NIST CSF, CIS Controls, OWASP, MITRE ATT&CK, or ISO 27001 when relevant.\n- Avoid instructions that enable unauthorized access, stealth, credential theft, malware deployment, or destructive activity.\n\n## Example safe response\nFor PCI DSS controls, start by confirming scope and authorization, gather relevant logs or configuration evidence, compare findings against policy and known-good baselines, prioritize by exposure and impact, then recommend remediation with verification steps.", | |
| "Metadata": { | |
| "domain": "compliance-governance-risk", | |
| "subdomain": "PCI DSS controls", | |
| "difficulty": "advanced", | |
| "task_type": "analysis", | |
| "safety_level": "authorized_defensive_educational", | |
| "intended_use": "fine-tuning cybersecurity assistants" | |
| } | |
| }, | |
| { | |
| "Instruction": "Write a concise response playbook for an internal security team. Focus on vendor risk in governance risk and compliance.", | |
| "Input": "An organization is improving its governance risk and compliance program and wants training guidance on vendor risk. The guidance must be suitable for authorized security work, model fine-tuning, and analyst education.", | |
| "Output": "## Summary\nvendor risk matters because it affects how defenders prevent, detect, prioritize, or respond to security risk in governance risk and compliance. A useful assistant should explain the idea, connect it to operational decisions, and avoid turning the answer into an abuse procedure.\n\n## Practical guidance\n1. Define the asset, user, data, or workflow affected by vendor risk.\n2. Identify the business impact, likely threat actors, common failure modes, and existing controls.\n3. Prefer measurable defensive actions: inventory, configuration review, logging, alerting, access control, patching, segmentation, backup, and recovery validation.\n4. Document assumptions, evidence, risk rating, owner, remediation plan, and review date.\n5. Validate the control in a lab, staging environment, tabletop exercise, or approved assessment before relying on it in production.\n\n## Training answer characteristics\n- Be specific enough for an analyst to act defensively.\n- Distinguish confirmed evidence from hypotheses.\n- Include escalation criteria and safe handoff points.\n- Reference frameworks such as NIST CSF, CIS Controls, OWASP, MITRE ATT&CK, or ISO 27001 when relevant.\n- Avoid instructions that enable unauthorized access, stealth, credential theft, malware deployment, or destructive activity.\n\n## Example safe response\nFor vendor risk, start by confirming scope and authorization, gather relevant logs or configuration evidence, compare findings against policy and known-good baselines, prioritize by exposure and impact, then recommend remediation with verification steps.", | |
| "Metadata": { | |
| "domain": "compliance-governance-risk", | |
| "subdomain": "vendor risk", | |
| "difficulty": "intermediate", | |
| "task_type": "playbook", | |
| "safety_level": "authorized_defensive_educational", | |
| "intended_use": "fine-tuning cybersecurity assistants" | |
| } | |
| }, | |
| { | |
| "Instruction": "Threat model the scenario and identify defensive controls. Focus on security metrics in governance risk and compliance.", | |
| "Input": "An organization is improving its governance risk and compliance program and wants training guidance on security metrics. The guidance must be suitable for authorized security work, model fine-tuning, and analyst education.", | |
| "Output": "## Summary\nsecurity metrics matters because it affects how defenders prevent, detect, prioritize, or respond to security risk in governance risk and compliance. A useful assistant should explain the idea, connect it to operational decisions, and avoid turning the answer into an abuse procedure.\n\n## Practical guidance\n1. Define the asset, user, data, or workflow affected by security metrics.\n2. Identify the business impact, likely threat actors, common failure modes, and existing controls.\n3. Prefer measurable defensive actions: inventory, configuration review, logging, alerting, access control, patching, segmentation, backup, and recovery validation.\n4. Document assumptions, evidence, risk rating, owner, remediation plan, and review date.\n5. Validate the control in a lab, staging environment, tabletop exercise, or approved assessment before relying on it in production.\n\n## Training answer characteristics\n- Be specific enough for an analyst to act defensively.\n- Distinguish confirmed evidence from hypotheses.\n- Include escalation criteria and safe handoff points.\n- Reference frameworks such as NIST CSF, CIS Controls, OWASP, MITRE ATT&CK, or ISO 27001 when relevant.\n- Avoid instructions that enable unauthorized access, stealth, credential theft, malware deployment, or destructive activity.\n\n## Example safe response\nFor security metrics, start by confirming scope and authorization, gather relevant logs or configuration evidence, compare findings against policy and known-good baselines, prioritize by exposure and impact, then recommend remediation with verification steps.", | |
| "Metadata": { | |
| "domain": "compliance-governance-risk", | |
| "subdomain": "security metrics", | |
| "difficulty": "advanced", | |
| "task_type": "threat_model", | |
| "safety_level": "authorized_defensive_educational", | |
| "intended_use": "fine-tuning cybersecurity assistants" | |
| } | |
| } | |
| ] |
Xet Storage Details
- Size:
- 11.6 kB
- Xet hash:
- 5091a8ca48484b99760a362258617f93968f070686628832bc04635c9f23c75f
·
Xet efficiently stores files, intelligently splitting them into unique chunks and accelerating uploads and downloads. More info.