cqrenet/antifragile
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Add engagement model, consultant field guide, deliverable templates, CQRE tools integration, and Czech localization

Browse Source 
New documents:
- core/engagement-model.md: Full client-facing engagement lifecycle (Sections 1-6) plus consultant delivery discipline (Section 7)
- core/consultant-field-guide.md: Decision models, client qualification, module selection, 10 common mistakes, technical onboarding, proposal writing
- core/about-cqre.md: Company overview template with [PLACEHOLDER] markers for client-facing use
- core/about-cqre-cs.md: Czech version of company overview (O společnosti CQRE)
- core/executive-summary-cs.md: Czech translation of the board executive summary
- assessment-templates/nist-csf-baseline.md: Full Brownhat Diagnostic workshop methodology (NIST CSF 2.0)
- assessment-templates/nist-csf-baseline-cs.md: Czech version of Brownhat Diagnostic (for Czech-language workshops)
- assessment-templates/module-completion-report.md: Module completion package template
- assessment-templates/risk-register-example.md: 8 fully populated risk entries (Meridian Logistics GmbH fictional engagement)
- playbooks/privileged-access-architecture.md: Module 13 - Teleport, Tailscale/Headscale, JIT access, vendor governance
- playbooks/sovereign-communications.md: Module 14 - Delta Chat chatmail relay, Matrix/Element, crisis channels

Updated documents:
- playbooks/sovereign-tool-stack.md: Added Elysium, CAExporter, E8-CAT, macOS_IntuneManagement, IntunePolicyParser, M365-Scripts; updated capability matrix and module pairings
- core/modular-engagements.md: Module 2 now includes CAExporter as first step; Module 6 includes Elysium password audit
- reference/nist-csf-mapping.md: Added back-reference to nist-csf-baseline.md
- assessment-templates/README.md: Changed Q1/Q2/Q3/Q4 to Phase 1/2/3/4, added Status column
- index.md: Registered all new documents; restructured consultant navigation into three labeled groups (1-25)
- README.md: Updated directory tree; updated Quick Start for Consultants

Czech localization pointers:
- executive-summary.md: Added Česká verze pointer
- nist-csf-baseline.md: Added Česká verze pointer
- engagement-model.md: Added note that client-facing Czech translation is planned

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Tomas Kracmar
2026-05-27 21:33:52 +02:00
parent 7bab42398a
commit 64f73371c9
24 changed files with 3325 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
antifragile-consulting/README.md
+34 -12
View File
@@ -17,7 +17,11 @@ Most security and resilience frameworks optimize for **robustness**—the abilit
```
├── core/ # Foundational frameworks and principles
│ ├── move-fast-and-fix-things.md # Company philosophy: speed, repair, existing tools
│ ├── about-cqre.md # Company overview template — fill before sharing with clients
│ ├── about-cqre-cs.md # Czech version of company overview (O společnosti CQRE)
│ ├── move-fast-and-fix-things.md # Company philosophy: speed, repair, existing tools (Brownhat brand)
│ ├── engagement-model.md # How engagements work: lifecycle, deliverables, pricing, consultant discipline
│ ├── consultant-field-guide.md # Internal playbook: decision models, qualification, mistakes, technical onboarding
│ ├── antifragile-manifest.md # The five pillars of antifragile enterprise
│ ├── modular-engagements.md # Menu of independent, self-contained modules
│ ├── ai-sovereignty-framework.md # AI sovereignty as a strategic mandate
@@ -28,6 +32,7 @@ Most security and resilience frameworks optimize for **robustness**—the abilit
│ ├── blue-purple-team-foundation.md # Building defensive capability from existing tools
│ ├── retained-capability.md # What to keep in-house when outsourcing security (MSSP, pentest, compliance)
│ ├── executive-summary.md # One-page board brief
│ ├── executive-summary-cs.md # Czech version of board brief (Výkonné shrnutí)
│ ├── c-suite-conversation-guide.md # Persuasion scripts for top management
│ └── t0-asset-framework.md # Tier 0 asset classification and protection
├── playbooks/ # Executable modernisation and response plans
@@ -42,10 +47,16 @@ Most security and resilience frameworks optimize for **robustness**—the abilit
│ ├── ad-endpoint-hardening.md # On-prem AD, Windows endpoint, hybrid identity
│ ├── zero-budget-hardening.md # Maximize existing tool investment
│ ├── implementation-playbook.md # Step-by-step operational guide
│ └── business-case-template.md # Financial justification and ROI framework
│ ├── sovereign-tool-stack.md # Open-source arsenal and capability map
│ ├── sovereign-tool-stack.md # Open-source arsenal and capability map
│ ├── privileged-access-architecture.md # PAM: Teleport, Tailscale/Headscale, JIT access (Module 13)
│ ├── sovereign-communications.md # Delta Chat chatmail, Matrix/Element, crisis channels (Module 14)
│ └── business-case-template.md # Financial justification and ROI framework
├── assessment-templates/ # Diagnostic tools and maturity models
│ ├── README.md # Assessment roadmap and development plan
│ ├── nist-csf-baseline.md # The Brownhat Diagnostic: 2-half-day NIST CSF workshop (entry engagement)
│ ├── nist-csf-baseline-cs.md # Czech version of Brownhat Diagnostic workshop questionnaire
│ ├── module-completion-report.md # Template for the module completion package (every module)
│ ├── risk-register-example.md # 8 fully populated risk entries from a realistic engagement
│ ├── antifragile-risk-register.md # Antifragile risk taxonomy and register template
│ └── m365-project-risk-register.md # M365 project-specific risk register
├── reference/ # External standards, mappings, and citations
@@ -88,17 +99,28 @@ Our approach is not an alternative to established frameworks. It is the fastest
2. **Review** [Business Case Template](playbooks/business-case-template.md) — financial justification, ROI, and risk quantification
3. **Browse** [C-Suite Conversation Guide](core/c-suite-conversation-guide.md) — how your advisors should frame the conversation
## Platform Independence
This framework is **platform-agnostic at the strategic level**. The Antifragile Manifest, assessment methodology, and Sovereign Tool Stack operate independently of any vendor ecosystem.
Many playbooks use Microsoft 365 as the reference environment because it is the most common client footprint (E3/Business Premium). Consultants working with Google Workspace, AWS-native, or mixed environments should read the **Platform Adaptation** appendix in [Modular Engagements](core/modular-engagements.md#platform-adaptation-non-microsoft-environments), which maps every M365-specific module to equivalent non-Microsoft tooling.
## Quick Start for Consultants
1. **Open** `core/move-fast-and-fix-things.md` — understand the engagement posture
2. **Read** `core/antifragile-manifest.md` — understand the philosophy
3. **Study** `playbooks/m365-e3-hardening.md` — master the primary client environment (most clients are E3)
4. **Study** `playbooks/ad-endpoint-hardening.md` — cover on-premises AD and endpoint gaps
5. **Study** `playbooks/zero-budget-hardening.md` — extract value from existing tools in 30 days
6. **Deploy** `playbooks/rapid-modernisation-plan.md` — run the 30-60-90-180 day roadmap
7. **Reference** `core/t0-asset-framework.md` and `core/ai-sovereignty-framework.md` — classify assets and own intelligence
8. **Map** `reference/cis-controls-mapping.md` and `reference/nist-csf-mapping.md` — align to standards
9. **Adapt** `reference/vertical-power-utilities.md`, `reference/vertical-telco.md`, or `reference/vertical-banking.md` — tailor for regulated critical infrastructure clients
1. **Open** `core/move-fast-and-fix-things.md` — understand the engagement posture and the Brownhat brand
2. **Read** `core/engagement-model.md` — understand how engagements are structured, scoped, priced, and delivered
3. **Read** `core/consultant-field-guide.md` — internalize the decision models, learn to qualify clients, understand the common mistakes
4. **Read** `core/antifragile-manifest.md` — understand the philosophy
4. **Study** `core/modular-engagements.md` — the full module menu (Modules 1–14) and platform adaptation guide
5. **Run** `assessment-templates/nist-csf-baseline.md` — the Brownhat Diagnostic: mandatory entry engagement for every new client
6. **Study** `playbooks/sovereign-tool-stack.md` — the full tool arsenal, commercial partnerships, and when to use each
7. **Study** `playbooks/m365-e3-hardening.md` — primary client environment for MS clients (most are E3)
8. **Study** `playbooks/ad-endpoint-hardening.md` — on-premises AD and endpoint gaps
9. **Study** `playbooks/zero-budget-hardening.md` — extract value from existing tools in 30 days
10. **Deploy** `playbooks/rapid-modernisation-plan.md` — run the 30-60-90-180 day roadmap
11. **Reference** `core/t0-asset-framework.md` and `core/ai-sovereignty-framework.md` — classify assets and own intelligence
12. **Map** `reference/cis-controls-mapping.md` and `reference/nist-csf-mapping.md` — align to standards
13. **Adapt** `reference/vertical-power-utilities.md`, `reference/vertical-telco.md`, or `reference/vertical-banking.md` — tailor for regulated critical infrastructure clients
## Usage and Licensing