Applied Security Project or Assigned Initiative

What This Phase Is About

During the Applied Security Project phase of your externship, you move from observing and assisting to owning a defined piece of work. A host employer assigns you a real initiative—something the organization actually needs—and you are responsible for delivering a useful, professional result. This is the closest most students get to full professional practice before earning their first credential, and employers evaluate you on the same standards they apply to junior staff.

Defining the Project: The Brief

Before any work begins, you and your site supervisor must agree in writing on what you are doing, why it matters, and how success will be measured. This document is called the project brief. It captures the scope (what is included and what is not), the deliverables (the specific outputs you will produce), the timeline with milestones, and the acceptance criteria the employer will use to decide whether your work meets their standard.

A clear scope prevents scope creep—the gradual addition of tasks that were never agreed upon. A clear acceptance criterion protects you: if you meet what was written down, the work is done. Submit the brief to your school coordinator before you start executing. This step is not optional; it protects the employer, the school, and you.

Common project types include drafting or updating a security policy or procedure, reviewing results of a phishing simulation and producing a report, building a security metrics dashboard, assisting with or documenting an internal audit, or creating user security-awareness training materials.

Executing the Work: Professional Habits

Once the brief is approved, follow it. If something changes—a tool becomes unavailable, the scope shifts at the employer's request, or you discover the original approach will not work—document the change in your project journal and notify your school coordinator promptly.

The project journal is a running record of your decisions, obstacles, resources you consulted, and any revisions to your approach. You must make entries at least every two working days. The journal is not a diary; it is a professional record that another person should be able to read and understand what happened and why. Think of it like a technician's work order log or an auditor's working papers.

Safe handling of data and systems. Many cybersecurity projects involve sensitive information—network diagrams, vulnerability scan results, audit findings, or employee data from phishing simulations. Follow the employer's data-handling and confidentiality policies at all times. Do not copy sensitive data to personal devices or personal cloud storage. Do not access systems beyond what your assigned scope requires. If you are given elevated access, use it only for the specific task and report any accidental exposure of data immediately to your supervisor. These are not just professional courtesies; they reflect the same controls tested in the Security+, CySA+, and ISC2 CC domains covering data privacy, access control, and incident response.

If your project involves physical access to server rooms or network equipment, follow the site's physical security procedures: badge in properly, do not hold doors for unverified individuals (tailgating is a recognized attack vector), and secure any portable media when not in use.

Delivering Results: The Briefing and Written Summary

At the end of the project phase, you will present your results to your supervisor or a small employer audience. This is a professional briefing of ten to twenty minutes—not a casual conversation and not a lengthy lecture. Prepare slides or a structured visual aid. Practice your timing. Lead with what you were asked to do, what you did, and what the outcome is. Reserve a few minutes for questions.

You will also submit a one-to-two-page written summary covering: what the deliverable is, an honest self-assessment of what worked and what you would improve, and an explicit mapping of your work to at least two exam domain areas from Security+, CySA+, or ISC2 CC. Use the current CompTIA exam objectives documents and the ISC2 CC candidate handbook as references. For example, a phishing simulation review maps clearly to the Security+ domain covering threats, attacks, and vulnerabilities, and to the CySA+ domain covering threat and vulnerability management. A policy update maps to governance, risk, and compliance domains in both credentials.

The domain mapping is not busywork. It trains you to see connections between what you do on the job and the conceptual framework tested on your certification exams—a habit that accelerates both exam preparation and career growth.

Acceptance and Completion

Your school coordinator will confirm completion based on three things: written employer acceptance of the deliverable (an email or signed form from your supervisor), a project journal that covers at least eighty percent of your working days in this phase, and a written summary that clearly describes the deliverable, includes an honest self-assessment, and accurately maps to at least two credential domains. Meet all three and you pass this phase.