What you’ll be able to do
- Classify a handful of Riverstone records by harm if disclosed, altered, or lost.
- Explain why updates and backups are different controls for different losses.
- Design a backup plan that names what is copied, how often, where it lives, who can restore, and how restoration is tested.
- List residual work that still needs humans when the primary site is unavailable.
Protect the records according to the harm
Data protection starts with classification that a busy warehouse can actually use. TrackPort addresses and bills of lading are confidential and integrity-sensitive. YardOS pallet locations are availability- and integrity-sensitive; a wrong location is a theft opportunity and a missed delivery. FleetLink GPS is confidential in the short term because it can be used to intercept a trailer. Public marketing pages are mostly an availability concern. Encryption, access rules, and retention should follow those harms rather than a single “encrypt everything” poster.
CISA’s Secure Our World material describes strong passwords, MFA, phishing awareness, and software updates. These practices cut across many small organizations. They are not a complete program. Riverstone still needs to know which systems, if restored from last Tuesday, would ship the wrong freight.
Updates prevent; backups recover; resilience keeps the business going
Updates and patches shrink the window in which a known vulnerability can be used. They are prevention for a threat that is already public, which is why F2 put the KEV-listed VPN ahead of the lunch wiki. Backups do not patch the VPN. They answer a different question: if YardOS is encrypted, corrupted, or burned, can we rebuild integrity and availability from copies the attacker could not also encrypt?
A useful backup sentence names the asset, the copy frequency, the offline or immutable location, the identity allowed to restore, and the last successful test. A copy on a network share that the YardOS service account can write is a second victim, not a backup. Resilience is broader than restore: paper dock boards, a manual bill-of-lading process, and a phone tree for drivers may keep freight moving while IT rebuilds. NIST CSF 2.0’s Recover function is about those outcomes, not about buying a particular appliance.
- Prevention: patch, configuration, least privilege, encryption at rest and in transit.
- Recovery: backups, key escrow, identity restore, vendor contacts.
- Resilience: degraded operations that still meet the loss sentence.
- Test restores on a calendar; an untested backup is a hope.
Worked plan: Oakland warehouse
Riverstone’s Oakland site will: classify TrackPort and bills of lading as confidential; require encryption in transit and at rest; patch internet-facing appliances on a KEV-driven emergency track and everything else on a weekly track; take hourly YardOS snapshots plus nightly copies to an account the warehouse service cannot delete; restore YardOS to a lab host every month; and keep a printed load-board process for 24 hours of dock operations. Priya owns the paper process. Devon owns the restore test. Maya owns the evidence that the test happened.
What remains uncertain: whether the identity directory’s own recovery is tested, and whether backup encryption keys live only in the same cloud account as the data. Those are open questions, not secret answers. Write them down.
CHECK YOUR JUDGMENT
Ransomware encrypts YardOS. Nightly copies exist on a file share mapped by the same YardOS service account. Devon says recovery is fine because backups ran at 02:00. What should Maya treat as the actual state?
NEXT FIELD LESSON