Run the numbers, not the checklist

The organization

Organization: Coldline Freight (fictional)
Industry: Logistics: refrigerated trucking and warehousing for food and pharmaceutical shippers
Size: About 1,100 employees, 3 warehouses and 400 trucks; a 12-person IT team with three in security
Risk appetite: Low tolerance for cold-chain spoilage or customer data exposure; moderate tolerance for routine equipment losses.

Constraints

The annual SOC 2 audit starts next month.
The largest customer's annual security questionnaire is due in three weeks.
Loss figures below are the risk team's estimates from incident history and industry data. SLE is the single loss expectancy; ARO is the annualized rate of occurrence.

Remediation capacity: 2 findings. You can choose "Mitigate: remediate ("fix")" for at most 2.

You have 2 remediation slots.

F1 Ransomware could stop the warehouse management system for about five days

A ransomware outage of the warehouse management system would stop shipping for about five days. The team estimates the SLE at $2 million and the ARO at 0.1 (once in ten years), given the endpoint detection and tested offline backups already in place. Two proposals are on the table: a 24/7 managed detection service at $350,000 a year, which an industry framework recommends, or a business-interruption rider on the cyber insurance policy at $45,000 a year, covering losses up to $2 million after a $100,000 deductible.

Asset: Warehouse management system
Exposure: Internal network
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Shipment, inventory and customer order data
Compensating controls available: 24/7 managed detection and response service ($350,000 a year)
Remediation effort: High
Business owner: Chief Operating Officer

Your response to F1

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F2 Driver tablets are lost or stolen about 20 times a year

Drivers lose or have stolen about 20 route tablets a year. Each loss costs about $1,500 for the device, setup and driver downtime. The tablets are encrypted and enrolled in device management with remote wipe. A vendor proposes locked cab mounts for all 400 trucks at $160,000 installed, expected to last three years and to cut losses about in half.

Asset: Driver route tablets
Exposure: Business process
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Route and delivery data; tablets are encrypted
Compensating controls available: Locked cab mounts ($160,000 for the fleet)
Remediation effort: Medium
Business owner: VP of Fleet Operations

Your response to F2

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F3 Shipment portal shows other customers' shipments when the ID in the URL changes

A tester found that any signed-in customer on the shipment portal can view another customer's shipment details by changing the shipment number in the URL. The portal was in scope for last year's SOC 2 audit, which reported no exceptions. The team estimates the SLE at $800,000 (notification costs and contract penalties) and the ARO at 0.3. Adding the missing authorization check is about two weeks of work to build, test and release, roughly $20,000.

Asset: Customer shipment portal
Exposure: Internet-facing
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Customer names, addresses, shipment contents and delivery schedules
Compensating controls available: Alert on unusual numbers of shipment lookups per account
Remediation effort: Medium
Business owner: VP of Customer Operations

Your response to F3

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F4 Hardened FTP server still running for a customer that left

An internet-facing FTP server was set up to exchange shipping manifests with a customer that left 14 months ago. It still holds old manifests. The server is hardened to an industry configuration benchmark and passes the monthly compliance scan. The team estimates the SLE at $300,000 and the ARO at 0.2. Decommissioning it takes about a day; no current customer uses it.

Asset: Legacy FTP server for shipping manifests
Exposure: Internet-facing
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Old shipping manifests with customer addresses
Compensating controls available: Keep it hardened and limit access to known addresses
Remediation effort: Low
Business owner: VP of Customer Operations

Your response to F4

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F5 Cold-chain monitoring console uses the vendor's default password

The console that monitors and sets warehouse freezer temperatures is reachable from the internet and still uses the vendor's default administrator password. Default passwords for this model are published online. The team estimates the SLE at $450,000 (a warehouse of spoiled pharmaceutical product) and the ARO at 0.5. Changing the credentials and restricting the console to the VPN takes about a day.

Asset: Cold-chain temperature monitoring console
Exposure: Internet-facing
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Freezer temperature settings and alarms
Compensating controls available: Alert on any change to temperature settings
Remediation effort: Low
Business owner: VP of Warehouse Operations

Your response to F5

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

Overall note (optional, up to 1200 characters; shown back to you, never stored)

Your rationale and note are shown back to you once and never stored. Privacy