Introducing Lab Environments — Two Companies, 87 Artefacts, Nothing Annotated

Most GRC training explains a control and then asks whether you were listening. That is a reasonable way to learn vocabulary and a poor way to learn the job, because the job is not recall. The job is being handed a folder of somebody else's documents and working out what is wrong with them.

So we built that. Lab environments are a new kind of exercise on Do GRC. Each one is a fictional organisation, built whole: its policies refer to its systems, its systems appear in its registers, its staff appear in its identity exports, and its contracts bind its actual suppliers. You get the evidence and a question, and nothing else.

Nothing is annotated and nothing hints

There are no callouts, no highlighted rows, no “notice anything?” nudges. The evidence says what it says. A backup log that proves jobs ran and nothing about whether anything can be restored. An offboarding checklist that is complete on its own terms and never mentions the clinical system. A supplier register recording that a SOC 2 report was received, where the report itself carries a qualified opinion nobody read.

Most of the findings only exist in the gap between two documents, which is why the viewer lets you put them side by side. CSV renders as a table, JSON as a tree, Markdown as a document, diagrams as diagrams — the formats you would actually be sent.

Two organisations, two frameworks

Wattlebrook Health Group — a multi-site general practice and allied health provider in the ACT. 14 labs, 38 artefacts, 24 findings, roughly 12 hours and 532 points. Mapped to ISO/IEC 27001:2022 Annex A and the ACSC Essential Eight, with Australian privacy obligations in play.

Boxelder Payroll Systems — a US B2B payroll SaaS part-way through its first SOC 2 Type II observation period. 10 labs, 49 artefacts, 24 findings, roughly 9 hours and 431 points. Mapped to the Trust Services Criteria and NIST CSF 2.0, with US state breach-notification law and customer DPAs in play.

The pairing is deliberate. Both companies share one frozen assessment date, and several findings rhyme across them — a departed employee who still has access, a register that records approvals and never tracks expiry. Watching the same underlying failure get written up against Annex A in one environment and the TSC in the other is the fastest way we know to stop treating a framework as a vocabulary test.

You answer as an assessor, not a quiz-taker

Each lab asks two kinds of question. Structured fields — which accounts, which control, what rating, how many months overdue — are marked against a stored key, instantly and with no AI involved. Written prompts ask you to draft the finding, explain to a non-technical executive why their proposed fix does not work, or write it up for a board. Those are assessed against a rubric written for that specific question.

Feedback names the evidence you did not use and the point you did not reach. It never hands you the answer, because re-reading the evidence is the exercise. Re-attempts are unlimited and your best score counts.

Some of what is in there

A Type II readiness lab built entirely on the observation-period concept, where management proposes to run the two missed access reviews now and backdate the paperwork, and your job is to explain to a non-technical executive why that resolves nothing. A lab on an assurance report that was received, filed and never opened. An incident lab about a file of W-2s sent to the wrong customer and closed as a helpdesk ticket in three days, with no breach assessment and a 72-hour contractual clock nobody started.

Each environment ends with a three-hour capstone: the full evidence set, a findings register, a prioritised remediation roadmap, and a question about which findings share a systemic cause. A report listing 24 unconnected findings does not score well, which is also true in practice.

Three labs are free

Wattlebrook's first two labs and Boxelder's first are free to work end to end, evidence and marking included — no subscription. The remaining 21 come with a paid membership. Paid labs are still listed with their full brief, so you can see what you would be working on before deciding.

Start at /lab-environments for how it works, or go straight to /labs if you already have an account.

Two honest notes

Everything in a lab is invented.The companies, staff, customers, suppliers, systems and documents were written for the exercise, including documents modelled on assurance reports and banking agreements. Several contain deliberate errors, because finding them is the point. None of it evidences any real organisation's controls or may be relied on outside the exercise — see the disclaimer.

Written answers are marked by an AI. Your answer, the prompt and its rubric are sent to our AI provider; the structured fields never leave our database. Because you are writing about an invented company, a lab answer should not contain anything about you or your employer — please keep it that way. The AI transparency page and the privacy policy set out exactly what is sent and what is not.