{
  "kind": "synthetic-educational-scenario",
  "version": "1.0",
  "slug": "sbom-decision",
  "title": "Defer with a date, or patch for a reason",
  "description": "ShopCart’s synthetic SBOM shows a transitive finding that is not a real CVE and is not on KEV. Write the deferral, the patch, or the compensating control with a review date.",
  "minutes": 10,
  "skill": "SBOM prioritization",
  "evidence": "SYNTHETIC TABLETOP / SBOM-042\nShopCart is fiction. Maya is triaging a component, not a live incident.\n\nDirect: shopcart-api@2.4.0\nTransitive: leftpad-lite@0.9.1 (fictional package)\nFinding-ID: FINDING-SYNTH-2026-0042\nTeaching alias: CVE-SYNTH-2026-0042\nThis alias is not an NVD record and not a KEV listing.\nScanner label (simulated): 7.5 High\nKEV search: no results\nExposure: offline month-end batch only; not internet-facing; no privileged container\nBusiness: freeze starts in two days; the fix is a major version bump\n\nLadder: inventory → exploitation evidence → exposure → business.",
  "exhibits": [
    {
      "system": "CycloneDX-like SBOM excerpt",
      "title": "Inventory only · shopcart-api pulls leftpad-lite",
      "rows": [
        {
          "label": "Document",
          "value": "ShopCart fiction · not a release SBOM"
        },
        {
          "label": "Component",
          "value": "shopcart-api 2.4.0",
          "mark": "Direct"
        },
        {
          "label": "Depends on",
          "value": "leftpad-lite 0.9.1",
          "mark": "Transitive"
        },
        {
          "label": "What this proves",
          "value": "The component was listed",
          "mark": "Not a fix"
        }
      ],
      "note": "Annotation: an SBOM is inventory evidence. Owning this snippet does not patch leftpad-lite or close the finding."
    },
    {
      "system": "Simulated scanner card",
      "title": "FINDING-SYNTH-2026-0042",
      "rows": [
        {
          "label": "Finding-ID",
          "value": "FINDING-SYNTH-2026-0042"
        },
        {
          "label": "Teaching alias",
          "value": "CVE-SYNTH-2026-0042",
          "mark": "Not in NVD or KEV"
        },
        {
          "label": "Scanner label",
          "value": "7.5 High (simulated)",
          "mark": "Not the priority"
        },
        {
          "label": "Package",
          "value": "leftpad-lite@0.9.1 (fiction)"
        }
      ],
      "note": "Annotation: the High label is a teaching input. Do not treat CVE-SYNTH-2026-0042 as a real identifier or as proof of exploitability."
    },
    {
      "system": "Simulated KEV search",
      "title": "Catalog query returns nothing",
      "rows": [
        {
          "label": "Catalog",
          "value": "Teaching stand-in, not CISA’s site"
        },
        {
          "label": "Query",
          "value": "CVE-SYNTH-2026-0042"
        },
        {
          "label": "Results",
          "value": "No matching entries",
          "mark": "Empty"
        },
        {
          "label": "How to read it",
          "value": "Not listed. That is an input.",
          "mark": "Not “safe forever”"
        }
      ],
      "note": "Annotation: CISA KEV is an input to priority for real CVE records. This search is empty because the alias is synthetic. Absence is not a permanent close."
    }
  ],
  "worksheet": {
    "caption": "Decision record. A deferral without a date is not a decision.",
    "headers": [
      "Ladder step",
      "What you can say",
      "Your note"
    ],
    "rows": [
      [
        "Inventory",
        "Is it in a build ShopCart ships?",
        ""
      ],
      [
        "Exploitation evidence",
        "KEV or other in-the-wild evidence?",
        ""
      ],
      [
        "Exposure",
        "Who can reach this code path?",
        ""
      ],
      [
        "Business",
        "Freeze, data, change window?",
        ""
      ],
      [
        "Decision",
        "Defer, patch, or compensate — plus owner and date",
        ""
      ]
    ]
  },
  "record": {
    "caption": "One defensible record for FINDING-SYNTH-2026-0042. Patch or compensate could win on a different exposure.",
    "headers": [
      "Step",
      "Recorded fact",
      "Effect on the call"
    ],
    "rows": [
      [
        "Inventory",
        "SBOM lists leftpad-lite under shopcart-api",
        "Confirmed present. The file is not the mitigation."
      ],
      [
        "Exploitation evidence",
        "Alias not on KEV; no other in-the-wild evidence in hand",
        "Do not invent a real CVE. Do not close the row forever."
      ],
      [
        "Exposure",
        "Offline batch only; not internet-facing; no privileged container",
        "Low reach. Say so explicitly."
      ],
      [
        "Business",
        "Freeze in two days; fix is a major bump",
        "Emergency change is not justified by the High label alone."
      ],
      [
        "Decision",
        "Defer the bump until the first business day after the freeze. Devon owns it. Deny egress from the job except the known batch destination. Watch real OSV and NVD feeds for the real component, not this alias.",
        "Date, owner, and compensating control travel with the deferral."
      ]
    ]
  },
  "steps": [
    {
      "prompt": "The SBOM excerpt lists leftpad-lite under shopcart-api. What has Maya established?",
      "choices": [
        {
          "text": "Inventory: the fictional transitive component is in this build. The SBOM has not mitigated it.",
          "correct": true,
          "feedback": "OWASP A03:2025 treats inventory of nested components as prevention work. The bill of materials is evidence of what shipped. It is not a control that makes ShopCart secure."
        },
        {
          "text": "The finding is already handled because an SBOM file exists.",
          "correct": false,
          "feedback": "NIST maps “provide an SBOM” to SSDF PS.3.2, which is about collecting and sharing provenance. Provenance is not a patch."
        },
        {
          "text": "Only shopcart-api matters, because Maya did not type leftpad-lite into package.json herself.",
          "correct": false,
          "feedback": "The direct component pulled the transitive one. A03’s “you are likely vulnerable” list includes nested dependencies you do not track."
        }
      ]
    },
    {
      "prompt": "The simulated KEV search for CVE-SYNTH-2026-0042 is empty, and the scanner says 7.5 High. What may Maya write?",
      "choices": [
        {
          "text": "Not listed. The alias is not a real CVE or KEV row. The High label is not emergency priority by itself.",
          "correct": true,
          "feedback": "CISA describes KEV as a catalog of vulnerabilities exploited in the wild and as an input to prioritization, not the only input. An empty search on a synthetic alias is “no KEV evidence,” not “safe forever,” and not permission to invent an NVD entry."
        },
        {
          "text": "Open an emergency change tonight. Any High score outranks the freeze.",
          "correct": false,
          "feedback": "CVSS-like severity is one teaching label. Exposure and the change window are separate rungs. The freeze starts in two days and the fix is a major bump."
        },
        {
          "text": "Close it with no review date. If it is not on KEV, it cannot matter.",
          "correct": false,
          "feedback": "Not listed means this catalog does not currently supply exploitation evidence. It does not retire the component. A deferral without a date is not a decision."
        }
      ]
    },
    {
      "prompt": "Exposure is the offline batch job. The freeze starts in two days. Which record should Maya keep?",
      "choices": [
        {
          "text": "Defer the major bump until the first business day after the freeze. Name Devon as owner. Deny egress from that job except the known batch destination. Review on that date. Do not paste this alias into a real KEV tracker.",
          "correct": true,
          "feedback": "Inventory is confirmed, exploitation evidence is absent, exposure is low, and the business calendar blocks a rushed major upgrade. The compensating control and the date keep the deferral from becoming neglect. A different exposure could justify patching now."
        },
        {
          "text": "Patch during the freeze because the scanner said High, and skip the egress note because the SBOM exists.",
          "correct": false,
          "feedback": "That uses one rung and treats inventory as mitigation. The lesson’s ladder wants all four before the call."
        },
        {
          "text": "Compensate by turning off logging, with no owner and no date, so the freeze stays quiet.",
          "correct": false,
          "feedback": "A compensating control has to reduce the exposure you named. Silencing logs hides the job. It does not replace an owner or a review date."
        }
      ]
    }
  ],
  "takeaway": "Confirm the component, say what exploitation evidence you do and do not have, name the exposure, then let the calendar force a dated decision. High on a synthetic card is not a reason to break the freeze or to forget the row.",
  "note": "FINDING-SYNTH-2026-0042 and CVE-SYNTH-2026-0042 are teaching aliases. They are not NVD records and not KEV listings. Do not read them as exploit proof.",
  "links": [
    {
      "title": "Inventory, evidence, exposure, then the business (A4)",
      "href": "/learn/topics/sbom-evidence-and-priority/"
    },
    {
      "title": "Lab: Patch the right thing first",
      "href": "/labs/vulnerability-priority/"
    },
    {
      "title": "Glossary: SBOM",
      "href": "/reference/terms/sbom/"
    },
    {
      "title": "Glossary: KEV",
      "href": "/reference/terms/kev/"
    }
  ],
  "sources": [
    {
      "title": "CISA Known Exploited Vulnerabilities Catalog",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
    },
    {
      "title": "CISA: Reducing the significant risk of known exploited vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities"
    },
    {
      "title": "OWASP Top 10:2025 A03 Software Supply Chain Failures",
      "url": "https://owasp.org/Top10/2025/A03_2025-Software_Supply_Chain_Failures/"
    },
    {
      "title": "NIST EO 14028 software supply chain security guidance, FAQ 7",
      "url": "https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-supply-chain-security-guidance-12"
    }
  ]
}