✳ Practice range / Audit evidence and exception governance / 8 min

The record, not the logo

Meridian Space & Robotics requires phishing-resistant MFA for all members of its VPN-Admin group. Four artifacts arrive in the March audit packet alongside an expiring contractor exception. Determine which artifact proves the control operated and how to govern the Friday expiration.

YOUR CASE FILE

The synthetic tabletop identifier is GRC-019.
Meridian Space & Robotics (chronos.orbital) is a fictional aerospace enterprise.
This exercise touches no live identity directory.

Control requirement: phishing-resistant MFA enforced on the VPN-Admin group.
Propulsion Lead Priya Nair owns the operational risk.
Staff Infrastructure Engineer Kael Cho operates the identity directory.
Principal Security Architect Vera Vance assembles the March 2026 evidence packet.

Four candidate artifacts sit in the review folder; only one demonstrates that the control operated in March 2026.

Exception record: contractor account casey.nguyen lacks a phishing-resistant factor.
Approved scope on the exception card: VPN-Admin sign-in restricted to the Cape Canaveral telemetry jump host only.
Risk owner on the card: Priya Nair.
Expiration date: Friday 27 March 2026.
Today in this tabletop is Friday 27 March 2026, and no renewal has been signed.

Download the synthetic case ↓

SIMULATEDIdentity-provider sales site

Vendor logo on the public homepage

Page: Public sales homepage
Image: Product logoScreenshot
Words on the page: MFA availableAdvertisement
Meridian accounts: None listedNot an export

A vendor homepage screenshot only proves that a product feature exists on the market; it says nothing about how Meridian Space & Robotics configured its tenant.

SIMULATEDPolicy PDF

The rule that states MFA is required

Document: Meridian access control policy (synthetic)
Sentence: MFA required for VPN administratorsIntent
Named owner: Priya Nair
March export: Not attached

A signed policy PDF establishes management intent and standards, but intent is not operational evidence that accounts actually enrolled.

SIMULATEDIdentity-provider enrollment report

VPN-Admin group, March 2026

Group: VPN-Admin
Month: March 2026
Generated: 24 March 2026, 18:10 UTCProvenance
Columns: Account, factor type, enrolled yes or no
Named gap: casey.nguyen, no phishing-resistant factorOn the page

This timestamped directory export enumerates every member of VPN-Admin for the audit period, their registered factor types, and the exact exception gap on casey.nguyen.

SIMULATEDChat

A line in #ground-ops

Channel: #ground-ops (synthetic)
From: Kael Cho
Text: everyone is enrolledHearsay
Time: 24 March 2026, 18:22 UTC
Attachment: None

An unverified chat message is assertion, not audit evidence; it omits the population list, factor types, and active exceptions.

Record the artifact that proves control operation and the governance action required when the Friday exception expires.
Question	Team note
Which artifact is the March record?
Why are the logo, the PDF, and the chat not enough?
How does the Friday exception close?

Your answers stay in this browser. This exercise uses fictional data and makes no changes to any system.

Step 1 of 2

Priya Nair asks which artifact belongs in the audit folder to prove that phishing-resistant MFA operated on VPN-Admin in March 2026. Which item should Vera Vance file?

CASE REFLECTION

Result and takeaway

first decisions matched the scenario’s best-supported answer.

Audit evidence must be a timestamped system record showing control state across the in-scope population, never a vendor logo, a policy PDF, or a chat assertion. When a time-bounded risk exception reaches its expiration date, remediate the gap, remove the privilege, or sign an explicit written renewal.

Defensible March 2026 evidence and exception packet. Silence never renews an expired exception.
Item	What the packet keeps
Evidence	The 24 March 2026 identity-provider enrollment report for VPN-Admin showing account names, factor types, generation timestamp, and the documented gap on casey.nguyen.
Not evidence	The vendor homepage logo, the policy PDF stating MFA is required, and the chat message claiming everyone is enrolled.
Close	Either enroll casey.nguyen on a phishing-resistant factor, remove casey.nguyen from VPN-Admin, or execute a written renewal signed by risk owner Priya Nair with jump-host scope and a new expiration date.

Another case ↗