What you’ll be able to do
- Choose one control that answers the VPN availability sentence, and say whether it prevents, detects, or compensates.
- Name who operates the control and which record shows that it ran.
- Write an exception with a compensating control, an owner, and an expiry.
- Reject a green GRC cell, a policy PDF, and a restore-test note as proof of this control.
Pick the control that matches the sentence
The card from the previous lesson is an availability risk on the internet-facing VPN. A control is a process, configuration, or technology meant to reduce that risk or detect that failure. Phishing-resistant MFA on the VPN-Admin group makes the appliance harder to administer from the internet. That is prevention: the second factor is required before an admin session exists.
A detective cousin is the alert when a VPN-Admin login has no second factor, or when the enrollment report shows a missing factor. YardOS’s monthly restore test is a real control, and Devon already owns it, but it answers a different loss: the warehouse system is encrypted or corrupted. Pasting the restore-test note onto the VPN card does not prove MFA. SP 800-53 Revision 5 is a catalog you select and tailor. This lesson does not assign a control identifier.
- Preventive: phishing-resistant MFA on every VPN-Admin account before the session exists.
- Detective: the enrollment report, and an alert when an admin login has no second factor.
- Wrong artifact for this risk: the YardOS restore-test note from F6.
- Compensating: a narrower path, with an expiry, when one account cannot take the factor yet.
The record is the thing that ran
Devon operates the directory change. Priya Shah still owns the risk. Maya files the record. The record is the identity provider’s enrollment report for the VPN-Admin group: each account name, the factor type, and the time the report was generated. One account with no phishing-resistant factor is a finding on that report. It is not a reason to hide the row.
A green cell beside the word MFA, a screenshot of a vendor logo, and a photo of the policy PDF are the same kind of object. They show that someone labeled a row. They do not show that the factor is on the account. F7’s rule still holds: cite a record with enough provenance to say what it can prove. An audit trail of who changed the group is useful beside the report. It does not replace the report.
An exception has an expiry
Control: phishing-resistant MFA on the VPN-Admin group, so the internet-facing appliance is harder to administer from anywhere. Devon operates the directory change. Priya Shah owns the risk. The record is the identity provider’s enrollment report for that group: account names, factor type, and the time the report was generated. A green cell in a GRC tool is not that record. Residual risk includes one break-glass VPN-Admin account that still has no phishing-resistant factor, kept for the hour when the identity provider itself is down. Compensating control: that account may sign in only from the Oakland jump host, which itself requires MFA, and the appliance management ports accept no other path. Priya owns the exception. It expires 9 April 2026, the maintenance window already tied to the vendor image. When that date passes without a new decision, the exception is closed.
S2 already treated a broken vendor image as a reason to write a window, not as a reason to delete the row. The same rule applies here. An exception documented once, with no expiry, becomes a second policy. Residual risk is whatever remains after this control, including that one account, and it stays on Priya’s card until the review.
CHECK YOUR JUDGMENT
Devon uploads a screenshot of a green MFA cell and says the break-glass exception was documented in January, so it can stay. The enrollment report shows one VPN-Admin account with no phishing-resistant factor. What should Maya accept?
NEXT FIELD LESSON