{ "kind": "synthetic-educational-scenario", "version": "1.0", "slug": "grc-evidence-exception", "title": "The record, not the logo", "description": "Riverstone requires phishing-resistant MFA for VPN admins. Four artifacts arrive. File the one that shows the control ran, then close a contractor exception that expires Friday.", "minutes": 8, "skill": "Evidence and exceptions", "evidence": "SYNTHETIC TABLETOP / GRC-019\nRiverstone Logistics (fiction). No live directory.\n\nControl: phishing-resistant MFA on the VPN-Admin group.\nPriya Shah owns the risk. Devon operates the directory.\nMaya files the March 2026 record.\n\nFour artifacts are in the packet. One shows the control ran.\n\nException: contractor account casey.nguyen\n has no phishing-resistant factor.\nScope on the card: VPN-Admin sign-in, Oakland jump host only.\nOwner on the card: Priya Shah.\nExpiry: Friday 27 March 2026.\nToday in this exercise is that Friday.\nNo renewal is written.\n\nYou cannot change a real directory.", "exhibits": [ { "system": "Identity-provider marketing site", "title": "Vendor logo on the public homepage", "rows": [ { "label": "Page", "value": "Public marketing homepage" }, { "label": "Image", "value": "Product logo", "mark": "Screenshot" }, { "label": "Words on the page", "value": "MFA available", "mark": "Advertisement" }, { "label": "Riverstone accounts", "value": "None listed", "mark": "Not an export" } ], "note": "Annotation: a logo shows that a product is offered. It does not show a factor on a Riverstone account." }, { "system": "Policy PDF", "title": "The rule that says MFA is required", "rows": [ { "label": "Document", "value": "Riverstone access policy (synthetic)" }, { "label": "Sentence", "value": "MFA required for VPN administrators", "mark": "Intent" }, { "label": "Named owner", "value": "Priya Shah" }, { "label": "March export", "value": "Not attached" } ], "note": "Annotation: a policy is the rule people are supposed to follow. It is not the record that they did." }, { "system": "Identity-provider enrollment report", "title": "VPN-Admin group, March 2026", "rows": [ { "label": "Group", "value": "VPN-Admin" }, { "label": "Month", "value": "March 2026" }, { "label": "Generated", "value": "24 March 2026, 18:10 UTC", "mark": "Provenance" }, { "label": "Columns", "value": "Account, factor type, enrolled yes or no" }, { "label": "Named gap", "value": "casey.nguyen, no phishing-resistant factor", "mark": "On the page" } ], "note": "Annotation: this export lists the group for the named month. Read the columns, including the account that is missing a factor." }, { "system": "Chat", "title": "A line in #dock-ops", "rows": [ { "label": "Channel", "value": "#dock-ops (synthetic)" }, { "label": "From", "value": "Devon" }, { "label": "Text", "value": "everyone is enrolled", "mark": "Hearsay" }, { "label": "Time", "value": "24 March 2026, 18:22 UTC" }, { "label": "Attachment", "value": "None" } ], "note": "Annotation: a chat line is what someone said. It does not list accounts or factor types." } ], "worksheet": { "caption": "Name the artifact that shows the control ran, and the close you would sign.", "headers": [ "Question", "Your note" ], "rows": [ [ "Which artifact is the March record?", "" ], [ "Why are the logo, the PDF, and the chat not enough?", "" ], [ "How does the Friday exception close?", "" ] ] }, "record": { "caption": "One defensible packet for March 2026. Silence is not a renewal.", "headers": [ "Item", "What Maya keeps" ], "rows": [ [ "Evidence", "The 24 March 2026 enrollment report for VPN-Admin: account, factor type, and generation time. casey.nguyen is listed with no phishing-resistant factor." ], [ "Not evidence", "The vendor logo, the policy PDF that says MFA is required, and Devon’s chat line that everyone is enrolled." ], [ "Close", "Re-enroll casey.nguyen, remove that account from VPN-Admin, or renew in writing with Priya Shah as owner, jump-host scope, and a new expiry. Friday passing with no note does not renew the exception." ] ] }, "steps": [ { "prompt": "Priya asks which artifact shows that phishing-resistant MFA ran for VPN-Admin in March 2026. What should Maya file?", "choices": [ { "text": "The vendor logo screenshot. The homepage says MFA is available, so the control ran.", "correct": false, "feedback": "A logo is an advertisement. It does not name Riverstone accounts, factor types, or the March export." }, { "text": "The policy PDF. It says MFA is required, so the requirement is the evidence.", "correct": false, "feedback": "The PDF is the rule. Intent is not a list of who enrolled. File the export that shows accounts and factors." }, { "text": "The identity-provider enrollment report for the VPN-Admin group for March 2026.", "correct": true, "feedback": "That report is the thing that ran: group, month, factor type, and the time it was generated. The missing factor on casey.nguyen stays visible." }, { "text": "Devon’s chat message that everyone is enrolled.", "correct": false, "feedback": "A chat line is hearsay. It has no account list and no factor column, so it cannot show that the control ran." } ] }, { "prompt": "The exception for casey.nguyen expires Friday 27 March 2026. Today is that Friday, and no renewal is written. Which close should Maya accept?", "choices": [ { "text": "Re-enroll casey.nguyen on a phishing-resistant factor before that account is used as VPN-Admin again. Record who enrolled it and that Friday’s gap is closed.", "correct": true, "feedback": "Enrollment closes the exception by removing the gap. The note still names the account, the VPN-Admin scope, and that the Friday expiry was met by a factor rather than by silence." }, { "text": "Remove casey.nguyen from the VPN-Admin role and record the removal, the owner, and the Friday date.", "correct": true, "feedback": "Dropping the role closes the exception by ending the scope. Silence would have left the role in place after Friday." }, { "text": "Renew in writing: Priya Shah owns it, the scope stays the Oakland jump host only, and a new expiry is named.", "correct": true, "feedback": "A renewal is a new decision with an owner, a scope, and an expiry. Friday arriving with no note is not that decision." }, { "text": "Let Friday pass. Nobody objected, so the exception renews itself.", "correct": false, "feedback": "Silence is not a renewal. An exception needs an owner, a scope, and an expiry, or it closes when the date passes." } ] } ], "takeaway": "The enrollment report is the evidence that the control ran. A logo, a policy PDF, and a chat line are not. When Friday comes, re-enroll, remove the role, or renew with an owner, a scope, and a new expiry.", "note": "The directory, the logo, and the report are synthetic teaching artifacts. This exercise does not issue a certificate and does not ask you to paste a real enrollment export.", "links": [ { "title": "The control is not the screenshot of a vendor logo (R2)", "href": "/learn/topics/choose-control-and-evidence/" }, { "title": "Govern is a calendar, not a poster (R3)", "href": "/learn/topics/govern-as-cadence/" }, { "title": "One risk, one owner, one open question (R1)", "href": "/learn/topics/write-the-risk-sentence/" }, { "title": "Glossary: evidence", "href": "/reference/terms/evidence/" }, { "title": "Glossary: control", "href": "/reference/terms/control/" } ], "sources": [ { "title": "NIST CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0, final 2024-02-26", "url": "https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final" }, { "title": "NIST SP 800-53 Revision 5, Update 1 (final)", "url": "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final" } ] }