Scope and fit
A private range is infrastructure that must be secured and maintained between exercises. Reliability comes from repeatable provisioning and clear operating ownership.
Version the environment and scenario
Store images, configuration, learning objectives, and facilitator notes together. Record changes so instructors can tell which version a cohort used.
Automate access and reset safely
Create time-limited learner accounts and restore environments to a known state after a session. Remove learner data and credentials according to the range's retention policy.
Monitor the range boundary
Track capacity, failed deployments, outbound paths, privileged changes, and cleanup status. Separate range administration from scenario activity and test isolation before each new scenario release.
Decisions and tradeoffs
Use this table as a working review record. Replace assumptions with evidence from the target environment.
| Decision area | Working guidance |
|---|---|
| Version the environment and scenario | Store images, configuration, learning objectives, and facilitator notes together. Record changes so instructors can tell which version a cohort used. |
| Automate access and reset safely | Create time-limited learner accounts and restore environments to a known state after a session. Remove learner data and credentials according to the range's retention policy. |
| Monitor the range boundary | Track capacity, failed deployments, outbound paths, privileged changes, and cleanup status. Separate range administration from scenario activity and test isolation before each new scenario release. |
Implementation questions
What should the team decide about version the environment and scenario?
Store images, configuration, learning objectives, and facilitator notes together. Record changes so instructors can tell which version a cohort used. Use a named owner and a written acceptance check so this decision can be reviewed after deployment.
What should the team decide about automate access and reset safely?
Create time-limited learner accounts and restore environments to a known state after a session. Remove learner data and credentials according to the range's retention policy. Use a named owner and a written acceptance check so this decision can be reviewed after deployment.
What should the team decide about monitor the range boundary?
Track capacity, failed deployments, outbound paths, privileged changes, and cleanup status. Separate range administration from scenario activity and test isolation before each new scenario release. Use a named owner and a written acceptance check so this decision can be reviewed after deployment.
Plan, build, verify, operate
Version the environment and scenario: Store images, configuration, learning objectives, and facilitator notes together. Record changes so instructors can tell which version a cohort used. Record the result and the next owner before changing the next boundary.
Automate access and reset safely: Create time-limited learner accounts and restore environments to a known state after a session. Remove learner data and credentials according to the range's retention policy. Record the result and the next owner before changing the next boundary.
Monitor the range boundary: Track capacity, failed deployments, outbound paths, privileged changes, and cleanup status. Separate range administration from scenario activity and test isolation before each new scenario release. Record the result and the next owner before changing the next boundary.
Deployment checks
Turn the page into a reviewable handover by assigning each check to a person and retaining its result.
Operate a Private Cyber Range as a Reusable Service: decision 1
Write down the boundary, owner, dependency, and proof required for operate a private cyber range as a reusable service before implementation begins.
Operate a Private Cyber Range as a Reusable Service: decision 2
Write down the boundary, owner, dependency, and proof required for operate a private cyber range as a reusable service before implementation begins.
Operate a Private Cyber Range as a Reusable Service: decision 3
Write down the boundary, owner, dependency, and proof required for operate a private cyber range as a reusable service before implementation begins.
Handover and ownership
Before handover, name the system owner, support path, access boundary, backup or recovery responsibility, and the condition that pauses a change.
Keep a short record of what was tested, what remains outside scope, and when the review should happen again.
