Risk Assessment & Tabletop Exercise Policy

Document ID: PLCY-RSK-001
Version: 1.0
Effective Date: December 22, 2025
Last Review: December 22, 2025
Owner: Hop And Haul Team

---

CONFIDENTIAL

This document is CONFIDENTIAL and for internal use only. Do not distribute outside the organization.

1. Purpose

This document establishes the framework for conducting risk assessments and tabletop exercises to identify, evaluate, and mitigate risks to Hop And Haul's operations, data, and infrastructure.

---

2. Scope

This policy applies to:

• All Hop And Haul production systems and infrastructure
• Third-party integrations and dependencies
• Business processes and operational procedures
• Personnel and organizational risks
• Regulatory and compliance obligations

---

3. Risk Assessment Framework

3.1 Risk Categories

Category	Description	Examples
Infrastructure	AWS, Cloudflare, network failures	Region outage, tunnel disruption
Application	Swift Vapor runtime, logic errors	Memory issues, API failures
Data	PostgreSQL, data integrity, loss	Corruption, breach, ransomware
Security	Authentication, authorization	JWT compromise, privilege escalation
Compliance	Regulatory, contractual	DOT violations, data privacy
Operational	Process, human error	Misconfiguration, deployment failure
Third-Party	Vendor, supply chain	Provider outage, API deprecation

3.2 Risk Scoring Matrix

Likelihood Scale:

Score	Likelihood	Frequency
1	Rare	Less than once per 5 years
2	Unlikely	Once per 2-5 years
3	Possible	Once per 1-2 years
4	Likely	Multiple times per year
5	Almost Certain	Monthly or more frequent

Impact Scale:

Score	Impact	Description
1	Negligible	Minor inconvenience, no data loss
2	Minor	Limited service degradation, <1 hour
3	Moderate	Partial outage, 1-4 hours, limited data impact
4	Major	Full outage, 4-24 hours, significant data impact
5	Critical	Extended outage, data breach, regulatory action

Risk Rating:

Rating	Score Range	Action Required
Critical	20-25	Immediate mitigation required
High	12-19	Mitigation within 30 days
Medium	6-11	Mitigation within 90 days
Low	1-5	Accept or monitor

---

4. Risk Register

4.1 Infrastructure Risks

ID	Risk	Likelihood	Impact	Rating	Mitigation	Owner
INF-001	AWS region failure	2	5	10 (M)	Multi-region deployment, automated failover	Infrastructure
INF-002	Cloudflare tunnel disruption	2	4	8 (M)	Backup DNS, direct failover capability	Infrastructure
INF-003	Database instance failure	3	4	12 (H)	Multi-AZ, read replicas, automated failover	Infrastructure
INF-004	S3 availability loss	1	3	3 (L)	Cross-region replication	Infrastructure
INF-005	Network partition	2	4	8 (M)	Multi-AZ, health checks	Infrastructure

4.2 Application Risks

ID	Risk	Likelihood	Impact	Rating	Mitigation	Owner
APP-001	Memory safety issue	1	4	4 (L)	Swift memory safety, code review	Development
APP-002	API performance degradation	3	3	9 (M)	Auto-scaling, caching, monitoring	Development
APP-003	Deployment failure	3	3	9 (M)	Blue-green deployment, rollback	DevOps
APP-004	Configuration drift	2	3	6 (M)	Infrastructure as code, drift detection	Infrastructure
APP-005	Dependency vulnerability	3	4	12 (H)	Dependency scanning, update policy	Security

4.3 Security Risks

ID	Risk	Likelihood	Impact	Rating	Mitigation	Owner
SEC-001	JWT key compromise	2	5	10 (M)	Key rotation, HSM storage, monitoring	Security
SEC-002	Privilege escalation	2	5	10 (M)	Role-based access, audit logging	Security
SEC-003	Cross-tenant data access	1	5	5 (L)	Org-scoped queries, tenant isolation	Development
SEC-004	DDoS attack	3	3	9 (M)	Cloudflare protection, rate limiting	Infrastructure
SEC-005	Credential stuffing	4	3	12 (H)	Rate limiting, MFA, monitoring	Security

4.4 Data Risks

ID	Risk	Likelihood	Impact	Rating	Mitigation	Owner
DAT-001	Database corruption	2	5	10 (M)	Point-in-time recovery, integrity checks	Infrastructure
DAT-002	Accidental data deletion	3	4	12 (H)	Soft deletes, backup retention, RBAC	Development
DAT-003	Ransomware	2	5	10 (M)	Immutable backups, network segmentation	Security
DAT-004	Data exfiltration	2	5	10 (M)	DLP, encryption, access controls	Security
DAT-005	Backup failure	2	4	8 (M)	Backup monitoring, restoration testing	Infrastructure

4.5 Compliance Risks

ID	Risk	Likelihood	Impact	Rating	Mitigation	Owner
CMP-001	DOT regulation violation	2	4	8 (M)	Policy controls, driver state validation	Operations
CMP-002	Data privacy breach	2	5	10 (M)	Encryption, access controls, audit	Security
CMP-003	Audit finding	3	3	9 (M)	Continuous compliance, control testing	Compliance
CMP-004	Contract breach	2	4	8 (M)	SLA monitoring, incident response	Operations
CMP-005	Records retention failure	2	3	6 (M)	Automated retention, policy enforcement	Compliance

4.6 Third-Party Risks

ID	Risk	Likelihood	Impact	Rating	Mitigation	Owner
TPR-001	Cloudflare service outage	1	5	5 (L)	Backup DNS, direct access capability	Infrastructure
TPR-002	AWS service degradation	2	4	8 (M)	Multi-region, service redundancy	Infrastructure
TPR-003	Payment processor failure	2	4	8 (M)	Backup processor, queue management	Operations
TPR-004	Insurance API unavailable	3	3	9 (M)	Caching, manual verification workflow	Operations
TPR-005	Twilio outage	2	3	6 (M)	Backup voice provider, SMS fallback	Operations

---

5. Tabletop Exercise Program

5.1 Exercise Schedule

Exercise Type	Frequency	Duration	Participants
Security incident	Quarterly	2 hours	Security, Infrastructure, Operations
Infrastructure failure	Quarterly	2 hours	Infrastructure, Operations, Development
Data breach	Bi-annually	4 hours	All departments + Legal
Business continuity	Annually	Full day	Executive team + All departments
Compliance scenario	Annually	2 hours	Compliance, Legal, Operations

5.2 Exercise Scenarios

Scenario Library

ID	Scenario	Category	Complexity
TTX-001	AWS us-east-1 complete outage	Infrastructure	High
TTX-002	Cloudflare Zero Trust compromise	Security	High
TTX-003	PostgreSQL data corruption	Data	Medium
TTX-004	JWT signing key leaked	Security	High
TTX-005	Ransomware attack	Security	Critical
TTX-006	Insider threat - data exfiltration	Security	High
TTX-007	Third-party API breach	Third-Party	Medium
TTX-008	DOT audit with deficiencies	Compliance	Medium
TTX-009	Driver safety incident cascade	Operational	Medium
TTX-010	Multi-tenant data exposure	Security	Critical

5.3 Scenario: AWS Region Failure (TTX-001)

Scenario Brief:

At 2:00 PM EST on a Tuesday, AWS reports a major outage affecting us-east-1. All EC2, RDS, and S3 services in the region are unavailable. The outage is expected to last 4-6 hours. Hop And Haul has active drivers on the road and pending transactions.

Inject Timeline:

Time	Inject	Expected Response
T+0	AWS status page shows us-east-1 degraded	Monitoring alerts trigger
T+5m	Customer reports API errors	Incident declared
T+15m	AWS confirms extended outage	DR plan activated
T+30m	Social media complaints increasing	Communications plan activated
T+1h	Competitor offers driver incentives	Business decision required
T+2h	Driver stranded mid-route	Safety protocol activation
T+4h	AWS begins recovery	Failback planning

Discussion Questions:

1. How quickly can we detect the outage versus relying on AWS status?
2. What is our communication plan for drivers mid-transaction?
3. How do we handle the data synchronization during failback?
4. What manual processes can we activate for critical operations?

5.4 Scenario: JWT Signing Key Compromise (TTX-004)

Scenario Brief:

Security monitoring detects unusual token patterns suggesting the JWT signing key may have been compromised. An attacker could be forging authentication tokens to access any account.

Inject Timeline:

Time	Inject	Expected Response
T+0	Anomaly detected: token from unknown IP	Security alert
T+5m	Second anomalous token detected	Investigation initiated
T+15m	Pattern suggests key compromise	Incident escalation
T+30m	Confirm: forged tokens in use	Key rotation decision
T+45m	Key rotated, all sessions invalidated	Mass user logout
T+1h	User complaints spike	Communications response
T+2h	Forensics identifies leak source	Remediation planning

Discussion Questions:

1. What is our threshold for declaring a key compromise?
2. How do we balance security (rotate now) vs. user experience (mass logout)?
3. How do we communicate with users about forced re-authentication?
4. What forensic data do we need to preserve?

5.5 Scenario: Multi-Tenant Data Exposure (TTX-010)

Scenario Brief:

A customer reports seeing another organization's data in their dashboard. Investigation reveals a code deployment introduced a bug that bypassed org_id filtering in certain queries.

Inject Timeline:

Time	Inject	Expected Response
T+0	Customer support ticket: "seeing wrong data"	Triage
T+10m	Confirmed: cross-tenant data visible	Severity escalation
T+20m	Bug identified in recent deployment	Rollback decision
T+30m	Scope assessment: 50 orgs potentially affected	Breach notification assessment
T+1h	Rollback complete, access restored	Forensic analysis
T+2h	Full exposure scope determined	Legal consultation
T+24h	Notification decision required	Customer communication

Discussion Questions:

1. At what point does this become a reportable breach?
2. How do we determine the full scope of data exposure?
3. What is our communication strategy with affected tenants?
4. How do we prevent similar bugs from reaching production?

---

6. Exercise Execution

6.1 Pre-Exercise Preparation

Task	Owner	Timeline
Select scenario	Security Director	T-4 weeks
Customize injects	Exercise facilitator	T-3 weeks
Identify participants	Department leads	T-2 weeks
Schedule exercise	Operations	T-2 weeks
Prepare materials	Exercise facilitator	T-1 week
Brief participants (no spoilers)	Exercise facilitator	T-1 day

6.2 Exercise Roles

Role	Responsibilities
Facilitator	Runs exercise, delivers injects, manages time
Scribe	Documents responses, decisions, action items
Participants	Respond to scenario, make decisions
Observer	Notes process effectiveness, gaps
Subject Matter Expert	Provides technical clarification

6.3 Exercise Ground Rules

1. No "out of game" discussions during exercise
2. Make decisions with information available at that inject
3. Assume normal staffing levels
4. Document assumptions explicitly
5. No judgment - focus on learning
6. Phones silenced unless playing a role

6.4 Post-Exercise Activities

Activity	Timeline	Owner
Hot wash (immediate debrief)	End of exercise	Facilitator
Detailed report	T+1 week	Scribe
Action item assignment	T+1 week	Security Director
Gap remediation	T+30-90 days	Action owners
Follow-up exercise (if needed)	T+6 months	Security Director

---

7. Exercise Documentation

7.1 Exercise Report Template

TABLETOP EXERCISE REPORT

Exercise ID: TTX-YYYY-MM-###
Date: [Date]
Scenario: [Scenario ID and Title]
Duration: [Actual duration]
Facilitator: [Name]

PARTICIPANTS
- [Name, Role, Department]
- ...

SCENARIO SUMMARY
[Brief description of scenario and objectives]

TIMELINE OF RESPONSES
| Time | Inject | Response | Decision Made |
|------|--------|----------|---------------|

KEY DECISIONS
1. [Decision and rationale]
2. ...

GAPS IDENTIFIED
| Gap | Severity | Recommendation |
|-----|----------|----------------|

ACTION ITEMS
| Item | Owner | Due Date | Status |
|------|-------|----------|--------|

LESSONS LEARNED
1. [Lesson]
2. ...

RECOMMENDATIONS FOR NEXT EXERCISE
[Suggestions for future exercises]

SIGN-OFF
Facilitator: _____________ Date: _______
Security Director: _____________ Date: _______

---

8. Risk Assessment Process

8.1 Annual Risk Assessment

Phase	Activities	Timeline
Planning	Define scope, gather documentation	Q1 Week 1-2
Identification	Threat modeling, vulnerability assessment	Q1 Week 3-6
Analysis	Likelihood and impact scoring	Q1 Week 7-8
Evaluation	Risk prioritization, treatment decisions	Q1 Week 9-10
Treatment	Mitigation planning, resource allocation	Q1 Week 11-12
Review	Board presentation, approval	Q1 Week 13

8.2 Continuous Risk Monitoring

Activity	Frequency	Owner
Threat intelligence review	Weekly	Security
Vulnerability scanning	Weekly	Security
Risk register update	Monthly	Security Director
Control effectiveness review	Quarterly	Compliance
Third-party risk review	Quarterly	Security

8.3 Risk Treatment Options

Option	When to Use	Example
Mitigate	Risk exceeds tolerance, controls available	Implement MFA
Transfer	Risk can be shared, insurance available	Cyber insurance
Accept	Risk within tolerance, cost exceeds benefit	Low-impact vendor risk
Avoid	Risk unacceptable, activity not essential	Discontinue feature

---

9. Infrastructure-Specific Assessments

9.1 Zero Trust Architecture Review

Control	Assessment Criteria	Frequency
Cloudflare Tunnel	No public ports, tunnel health	Monthly
Identity verification	JWT validation, role enforcement	Quarterly
Device trust	(If applicable) Device posture	Quarterly
Network segmentation	Tunnel isolation, VPC rules	Quarterly
Access logging	Complete audit trail	Monthly

9.2 Swift Vapor Application Security

Assessment	Criteria	Frequency
Dependency audit	Known vulnerabilities, updates	Monthly
Memory safety review	No unsafe code blocks	Per release
API security testing	OWASP Top 10	Quarterly
Authentication flow	JWT handling, expiration	Quarterly
Multi-tenant isolation	Org_id enforcement	Quarterly

9.3 PostgreSQL Security Assessment

Assessment	Criteria	Frequency
Access controls	No direct access, app-only	Monthly
Encryption	At-rest and in-transit	Quarterly
Backup integrity	Restoration testing	Monthly
Query logging	Audit trail completeness	Monthly
Tenant isolation	Org_id constraints, RLS	Quarterly

---

10. Metrics and Reporting

10.1 Key Risk Indicators

Metric	Target	Frequency
Critical risks open	0	Monthly
High risks open > 30 days	0	Monthly
Tabletop exercises completed	4/year	Quarterly
Action items closed on time	> 90%	Quarterly
Risk register currency	< 30 days	Monthly

10.2 Board Reporting

Report	Content	Frequency
Risk summary	Top 10 risks, trend, treatment status	Quarterly
Exercise summary	Exercises completed, key findings	Quarterly
Annual assessment	Full risk register, year-over-year	Annual

---

11. Document References

Document	Relevance
PLCY-DRP-001 Disaster Recovery Plan	Recovery procedures tested in exercises
PLCY-INC-001 Incident Response	Incident handling procedures
PLCY-SEC-001 Security Controls	Control effectiveness
PLCY-AUD-001 Audit Trail Specs	Audit requirements

---

12. Revision History

Version	Date	Author	Changes
1.0	December 22, 2025	Security Director	Initial release