✳ Learning path / 3 lessons
From risk sentence to operating cadence
Three lessons that turn one Riverstone risk into an owned control, the evidence that shows the control ran, and a month of CSF 2.0 Govern work. Builds on risk, evidence, and framework vocabulary. Practices the framework cards.
Work through the lessons in sequence, or choose the question you want to answer today.
01One risk, one owner, one open question
Turn the Riverstone VPN and the TrackPort export into separate risk sentences, with an owner, a review date, and the uncertainty still open.
The control is not the screenshot of a vendor logo
Choose one control for the VPN risk, name the record that shows it ran, and write an exception that expires.
Govern is a calendar, not a poster
Walk the six CSF 2.0 Govern categories in plain language, then run a 30-day Riverstone cadence. ISO/IEC 27001 stays a scoped ISMS.
Turn knowledge into a decision.
Once you have the ideas, try a short scenario. You’ll see why the tempting answer isn’t always the most useful one.
Open the practice range ↗