Model Response: Claim 1. The policy tier is not set by the value of the data on the machine — it is set by what the machine reaches. The reception PC is joined to the internal wireless network, so it is a foothold: an adversary who loads malware from an external drive through one of those open USB ports is inside Delmar’s network, and the engineering file server is on the other end of it. That is exactly the CED’s moderate-risk pattern — a nonsensitive asset used to get at other resources — not a reason to skip the policy. Claim 2. Being staffed is not access control. The receptionist looks away, steps to the copier, or is talking to the visitor who is standing within reach of the tower; and a screen in the open lobby is in a stranger’s line of sight all day, which is shoulder surfing with no effort required.

Reception tier of the workstation policy. (1) The workstation locks automatically after two minutes and the user locks the screen before leaving it unattended — prevent. (2) A privacy screen filter is fitted, and no sensitive documents are left on the desk surface (clean desk) — prevent. (3) The USB ports are disabled in firmware and fitted with port blockers; any external drive must be handed to IT — prevent. (4) The workstation is connected to a surge protector on an uninterruptible power supply (UPS), so a power event does not corrupt the visitor log — correct. A reasonable fifth: badge-log review of lobby entries, which detects what the first three only prevent.

Model Response: The vestibule is not faulty — it did what a vestibule does, and the control that failed was human behavior, which is why EK 2.3.A.1 makes employee security awareness training a managerial control in its own right. Its second objective is precisely this: employees must be taught not to badge other people into restricted areas.

The two incidents are different failures. Badging the delivery driver through is piggybacking: the authorized person granted the access, with their knowledge and consent, so no hardware was beaten — the optician chose to override it. The wedged door is worse than either, because it converts the vestibule into an open corridor and lets an adversary tailgate in with nobody aware of it. The two missing entries on the badge log are the evidence: the log records one badge per entry, so nine badges and eleven bodies means two people came through on somebody else’s credential.

What to do instead. Training — mandatory awareness training on restricted-area access at onboarding and annually, with the rule stated as one badge per person and no exceptions for couriers or colleagues (prevent); deliveries are received at the lobby counter so no one has a reason to badge a stranger through. Backstop — a door contact with a held-open alarm on the inner door, so a wedge raises an alert within seconds (detect); a turnstile or anti-passback reader that admits one person at a time is the stronger physical option (prevent), and a camera on the vestibule that is recorded and monitored gives the investigation afterwards (detect). Replacing the vestibule with a single card reader trades a control that stops piggybacking for one that only records badges — a weaker control against the attack Delmar has actually seen.

Model Response: A defensible plan. Fund Findings 3 ($6,000), 2 ($14,000), 4 ($3,500), 5 ($11,000) and 6 ($38,000) — $72,500 — and put the remaining $77,500 toward Finding 1 as the first phase of the vault project. Finding 3 goes first regardless of its price: an unlocked badge controller cabinet in a public lobby defeats every reader in the building, so $6,000 buys back the whole access-control system. Finding 2 is the other high-severity item and it is cheap, because the file server problem is a missing cabinet and a wrong room, not a construction job. Findings 4, 5 and 6 are moderate, but at the lowest cost per unit of risk removed: $3,500 of port blocker closes the foothold into the internal network, $11,000 of UPS protects availability in the testing bay where the $180,000 generator cannot be justified, and $38,000 racks the stored optics above grade before the next storm.

Left unfunded. The vault reader and vestibule. The interim measure: the vault keeps its keyed lock, the key count drops to two named holders, a paper sign-in sheet is countersigned by the lab manager at each entry, and a monitored camera covers the vault door — compensating controls that detect what the reader would have prevented, and that leave documented remaining risk for the phase-two request.

Why Curtis is wrong. EK 2.3.B.8 says organizations prioritize by the severity and cost of the mitigation — two variables, not one. Spending all $150,000 on the highest severity finding buys one control and leaves the other five findings unmitigated, including two more HIGH ones that together cost $20,000; the building is measurably less safe after his plan than after this one. His rule ignores cost, so it cannot see that trade. But ranking cheapest first is the mirror-image error: it ignores severity, so it would buy a pile of low-value fixes while the vault stays open. The question is neither “what is worst” nor “what is cheap” but risk reduction per dollar, checked against the constraint that no HIGH finding is left still exposed with nothing at all in front of it — which is why the vault gets compensating controls rather than a note saying wait.