What you’ll be able to do
- Write one risk sentence that names the asset, the adverse event, who cannot do their work, and which property failed.
- Name a person as the owner and a date when the sentence will be reviewed.
- Keep likelihood and impact guesses separate from evidence already in hand.
- Leave a different loss, such as the TrackPort export, on its own card.
One sentence, one loss
After the contractor export scare, Devon asks Maya for a GRC row that says “Critical — VPN and TrackPort — owner: Security.” Maya will not write that row. F1 already gave the sentence: if X happens to asset Y, person Z cannot do W, and property P failed. F2 already split the internet-facing VPN from the lunch-menu wiki. This lesson uses those pieces. It does not reteach likelihood catalogs.
Riverstone has at least two losses in play. One is the VPN appliance on the internet, the one that authenticates drivers into FleetLink and YardOS. The other is a TrackPort export of customer delivery addresses through a shared warehouse login. Those are different assets, different properties, and different owners. A single adjective cannot hold both.
Evidence on one line, guesses on another
The VPN sentence Maya will defend: if the unpatched internet-facing VPN appliance is exploited, drivers cannot sign in to FleetLink, the Oakland morning dock wave stalls, and availability failed. The TrackPort sentence stays on its own card: if a shared warehouse login exports customer addresses, those locations are disclosed, and confidentiality failed. F2 already recorded why the VPN jumps a patch queue. This card does not merge that queue with the export.
Evidence already in hand is short. The appliance is reachable from the internet. The product is listed in CISA’s Known Exploited Vulnerabilities catalog, which is evidence of exploitation somewhere, not proof that Riverstone has been exploited. The open question from F2 is still open: nobody has checked whether a geofence or a filter already limits management logins. Calling likelihood “high,” or inventing a percentage, is a guess. The feared dock-wave stall is the impact story. It is not a measured outage. Write the guess in a guess line so a later reader can throw it out.
- Evidence: internet exposure, and a KEV listing for this kind of appliance.
- Guess: a likelihood label, until the geofence question is checked.
- Impact story: drivers cannot authenticate, so the Oakland dock wave stalls.
- Not this card: the TrackPort address export.
A dated card with a name on it
Priya Shah owns this risk. She already accepts break-glass decisions for the warehouse. Devon operates the appliance. Maya writes the card and does not become the owner by writing it. “Security” is not a person who can accept residual risk. The card is dated 10 March 2026 and comes back on 9 April 2026, whether or not a tool painted the row green.
CSF 2.0 (NIST CSWP 29, final 26 February 2024) is how Riverstone will later talk about outcomes for this one system. The sentence comes first. A profile, a control, and a calendar are the next two lessons. Nothing on this card is a certificate, and nothing on it is a measured audit result.
| Field | Teaching card |
|---|---|
| Risk sentence | If the unpatched internet-facing VPN appliance is exploited, drivers cannot sign in to FleetLink, the Oakland morning dock wave stalls, and availability failed. |
| Owner | Priya Shah |
| Written | 10 March 2026 |
| Review | 9 April 2026 |
| Evidence in hand | The appliance is on the internet. The product is on CISA’s KEV catalog. No local exploit has been shown. |
| Uncertainty | Whether a geofence or filter already limits management logins. Not checked. |
| Separate risk | TrackPort address export through a shared warehouse login. Confidentiality. Own card, own owner. |
CHECK YOUR JUDGMENT
Devon wants one row: “Critical — VPN and the TrackPort export — owner: Security.” The geofence on the VPN management port has not been checked. What should Maya write?
NEXT FIELD LESSON