grceng.academy
Triage lab 40 bonus XP

Triage the supply-chain review

Start labRead the room

Objectives

The quarterly fourth-party review surfaced eight lines. Your manager wants 'the ones that can hurt us' ranked for Monday's risk committee.

Some lines are loud and harmless. Some are quiet and structural. Rank the structural ones.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

quarterly supply-chain review notes

C-1  payroll vendor added an AI subprocessor that processes employee HR tickets; not on the disclosed list
C-2  three Tier 1 vendors all disclose the same backup replication fourth party
C-3  breach-notice drill: vendor notice took 92 hours against a 72-hour clause
C-4  the subprocessor list feed was last diffed nine months ago
C-5  a vendor's portal still shows the old brand colours after their rebrand
C-6  the office plant watering service contract auto-renewed
C-7  a Tier 3 vendor's marketing site was unreachable for an afternoon
C-8  legal would like the contract template to be longer

Checks the server runs (4)

  • The right findings are raised
  • Benign lines are left out
  • Severity matches the actual exposure
  • Ranked worst first

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Read the fixture as a population, not a list

    This is a population, not a list: eight lines from one review. Your job is the subset that changes the company's exposure, ranked by how bad Monday gets if you ignore it.

  2. Step 2

    Decide what actually qualifies

    Qualifying lines change the data flows, the disclosure you rely on, or the clauses you converted into controls. Cosmetic and administrative lines do not qualify no matter how recently they happened.

    The right findings are raised

  3. Step 3

    Resist the loud lines

    A rebrand, an auto-renewal, a marketing site and a template preference all feel like vendor risk. None of them moves data or hides a change.

    Benign lines are left out

  4. Step 4

    Grade the exposure, not the wording

    Grade by exposure: undisclosed processing of HR data is the worst thing here; a structural dependency you cannot see outranks a clause that underperformed but was measured.

    Severity matches the actual exposure

  5. Step 5

    Rank so the first line is the one you act on

    Lead with the line you would want to know about first if you could only act on one.

    Ranked worst first

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.