Assess Cybersecurity Risk with NIST

Build a NIST CSF 2.0 risk register and executive brief for a small retailer.

Introduction

30 Second Summary

Small business leaders often face a long list of security concerns with limited time and money. They need a clear way to see which problems could hurt the business most.

In this project, you will assess five cybersecurity risks for Northstar Outfitters, a fictional online retailer. Your local GRC assessment package will turn technical weaknesses into a prioritized treatment plan for leadership.

What You'll Build

You will open a local LibreOffice Calc workbook that shows Northstar Outfitters' leaders which cybersecurity risks need attention first.

By the end of this project, you'll have:

A business-focused risk register that traces five scenarios from critical assets to defensible risk statements.
A prioritized treatment plan that maps every risk to a NIST Cybersecurity Framework 2.0 outcome.
A one-page executive PDF that shows the top risks, accountable owners, and next actions.
Secret Mission: Estimate how the two highest risks change after their planned controls are applied.

Are there any prerequisites?

You'll need administrator access to a computer running Windows 10 or Windows 11. Keep up to 1.5 GB of disk space available for LibreOffice 26.8.0.

Before We Start

Start by locking in the business question behind this assessment. You are assessing Northstar Outfitters so its leaders know which cybersecurity risks should be treated first and why.

Set Up Your GRC Workspace

A repeatable GRC assessment needs a compatible spreadsheet tool. A clearly named evidence file keeps your work easy to find.

LibreOffice Calc keeps the assessment on your computer. This step confirms compatibility before you create the blank evidence workbook.

In this step, get ready to:

Confirm that your Windows computer meets the installation requirements.
Install LibreOffice 26.8.0 with the default setup.
Create the blank assessment workbook and reopen it from your Documents folder.

Confirm your Windows compatibility

The LibreOffice installer supports Windows 10 or 11. It also needs administrator access to copy the application files.

Press Win+Pause to open the System page.
Under Windows specifications, confirm that the Edition reports Windows 10 or Windows 11.
Under Device specifications, record the System type shown here: your Windows system type.
In Settings, select Accounts.
Select Your info.
Confirm that Administrator appears under your name.

Your Windows edition and account now meet the software requirements.

Select File Explorer from the taskbar.
Select This PC in the left pane.
Under Devices and drives, confirm that your Windows drive has at least 1.5 GB available for the installation.

Good, your computer has the supported operating system and installation capacity this workspace needs.

Compatibility check not passing?

If your computer reports an earlier Windows edition or less than 1.5 GB of free space, resolve that requirement before installing LibreOffice.

Ask the computer owner for administrator access if Administrator does not appear under your name. Help me understand which LibreOffice requirement my Windows computer is missing.

Install LibreOffice Calc

The installed release must match the project version so your menus stay consistent. Check your current state before choosing an installation path.

Why LibreOffice Calc?

LibreOffice Calc stores the workbook locally on your computer. You can complete the assessment without a cloud account or paid subscription.

Press the Windows key to open search.
Type LibreOffice Calc into the search field.
Check whether LibreOffice Calc appears in the search results.

✔️ I see version 26.8.0

Select LibreOffice Calc from the search results.
Select Help from the top menu.
Select About LibreOffice.
Confirm that the dialog shows version 26.8.0.
Close the About LibreOffice dialog.

Your Calc installation is already on the required release.

ⓧ I see an older version

The installed release needs an update before you create the project workbook.

Close LibreOffice.
Open the official LibreOffice download page in your browser.
Choose the Windows package matching your Windows system type.
Download LibreOffice 26.8.0.
Open the Main Installer from your browser downloads.
Choose the default installation.

The permission prompt authorizes the installer to copy application files. Expect the installation to spend a few minutes completing the default setup.

Click Install.
Select Yes if the User Account Control prompt appears.
Click Finish when the installation completes.

The installer has finished updating LibreOffice.

Press the Windows key to open search.
Type LibreOffice Calc into the search field.
Press Enter to open Calc.
Select Help from the top menu.
Select About LibreOffice.
Confirm that the dialog shows version 26.8.0.
Close the About LibreOffice dialog.

That update worked. Calc now opens on the project release.

ⓧ LibreOffice is not installed

The official Main Installer creates the local Calc workspace with the default setup.

Open the official LibreOffice download page in your browser.
Choose the Windows package matching your Windows system type.
Download LibreOffice 26.8.0.
Open the Main Installer from your browser downloads.
Choose the default installation.

The permission prompt authorizes the installer to copy application files. Expect the installation to spend a few minutes completing the default setup.

Click Install.
Select Yes if the User Account Control prompt appears.
Click Finish when the installation completes.

LibreOffice is now installed locally with the default setup.

Press the Windows key to open search.
Type LibreOffice Calc into the search field.
Press Enter to open Calc.
Select Help from the top menu.
Select About LibreOffice.
Confirm that the dialog shows version 26.8.0.
Close the About LibreOffice dialog.

You have cleared the main setup hurdle. Calc is installed and opening successfully.

Installer not completing?

Confirm that the downloaded package matches your Windows system type. Use the official Main Installer from the LibreOffice download page.

Ask an administrator to approve the User Account Control prompt if your account cannot do so. Help me troubleshoot my LibreOffice installation.

Create and verify your evidence file

The workbook becomes the evidence file for every later assessment decision. The official NIST Cybersecurity Framework 2.0 and NIST SP 1300 Small Business Quick-Start Guide remain available as your reference sources.

Select File from the Calc menu bar.
Select New.
Select Spreadsheet.
Select File from the Calc menu bar.
Select Save As.
Select the Documents folder in the Save As dialog.
Enter Northstar-Outfitters-GRC-Assessment.ods in the File name field.
Click Save.

The blank workbook is now stored in your Documents folder with the project name.

Open The NIST Cybersecurity Framework (CSF) 2.0 in a browser tab.
Open the NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide in another browser tab.

Both official NIST references are now available for the assessment work ahead.

Before you test the file, do you expect Calc to reopen the saved workbook with its blank sheet intact?

Close the LibreOffice Calc window.
Switch back to File Explorer from earlier.
Select the Documents folder.
Double-click Northstar-Outfitters-GRC-Assessment.ods.

Calc reopens the blank workbook successfully. The file name confirms that you are working in the saved assessment evidence file.

Workbook not reopening?

Confirm that the file appears in your Documents folder with the complete .ods extension. Open that file with LibreOffice Calc.

If the file is missing, repeat the Save As process from the blank spreadsheet. Help me find or reopen my saved LibreOffice Calc workbook.

✔️ Awesome, I've got everything!

Your local GRC workspace is ready. Keep the reopened blank workbook available for the next step.

ⓧ I'd like to double check the full setup

Confirm that LibreOffice 26.8.0 is installed locally with the default setup.
Confirm that LibreOffice Calc opens successfully.
Confirm that Northstar-Outfitters-GRC-Assessment.ods is a blank workbook in your Documents folder.
Confirm that the saved workbook reopens successfully.

Your evidence workspace is ready. Next, you will turn Northstar Outfitters' business context into an asset inventory and its first five risk statements.

Build the First Risk Register

Your LibreOffice Calc workspace is ready. Leadership now needs a consistent trail from business context to risk impact.

A risk register connects business assets to events that could harm them. Can one impact rating by itself produce a clear priority order?

In this step, get ready to:

Define the fictional business scenario without using real personal or company data.
Rate five business assets by their importance to daily operations.
Capture five impact-rated risks to test the resulting priority order.

Define the assessment scenario

Every defensible assessment starts with a clear boundary. The scenario records who you are assessing plus which systems belong in scope.

Double-click the first sheet tab in the workbook from earlier.
Enter Scenario as the sheet name.
Press Enter to apply the name.
Select cell A1.
Populate the assessment context by pasting this data:

Northstar Outfitters is a fictional 25-person online retailer with no dedicated security team.
Scope covers systems used to receive orders and run daily operations.
No real personal or company data will be used.

Why define the scenario first?

The first statement establishes the fictional organization plus its limited security staffing.
The second statement limits the assessment to systems that support orders plus daily operations.
The final statement keeps real personal or company data outside the exercise.

Save Northstar-Outfitters-GRC-Assessment.ods.
Confirm the first sheet tab reads Scenario.
Confirm the three scenario statements appear in cells A1 through A3.

Scenario rows not separating?

Undo the paste if all three statements land in one cell.
Select cell A1 before pasting the data again.
Check that the sheet tab is named Scenario without extra spaces.
Help me fix the Scenario sheet in LibreOffice Calc.

Rate the critical business assets

Asset criticality measures how strongly the business depends on an asset. This exercise uses a five-point scale to make that dependence visible.

Select the plus icon beside the existing sheet tabs.
Enter Asset Inventory as the new sheet name.
Select cell A1 on the Asset Inventory sheet.
Populate the asset inventory by pasting this data:

Asset	Criticality (1-5)
customer order database	5
e-commerce admin portal	5
finance workstation	5
cloud email accounts	4
employee laptop	4

1 means low importance and 5 means mission-critical for this exercise.

What do these ratings show?

A rating of 5 identifies an asset that is mission-critical for this exercise.
A rating of 4 identifies an asset with high importance to the fictional business.
The scale provides business context for the risk scenarios you record next.

Save Northstar-Outfitters-GRC-Assessment.ods.
Confirm five assets appear in cells A2 through A6.
Confirm their ratings appear in cells B2 through B6.

Asset data in the wrong columns?

Undo the paste if every value appears in column A.
Select cell A1 before pasting the tab-separated data again.
Confirm each asset is beside its matching criticality rating.
Help me repair the Asset Inventory sheet.

Record the first five risks

Each register row connects a business asset to a credible loss scenario. The same structure makes different risks easier to compare.

Select the plus icon beside the existing sheet tabs.
Enter Risk Register as the new sheet name.
Select cell A1 on the Risk Register sheet.
Populate the risk register by pasting this data:

Risk ID	Asset	Threat	Vulnerability	Risk Statement	Impact (1-5)
R-01	Cloud email accounts	Phishing	Multi-factor authentication is not enforced	A phishing attacker could use stolen credentials to take over cloud email accounts, enabling fraudulent messages and access to business information.	4
R-02	Finance workstation	Ransomware	Software updates are delayed	Ransomware could exploit outdated software on the finance workstation, interrupting invoicing and payroll.	5
R-03	Customer order database	Data corruption or ransomware	Backups are not restore-tested	Customer order data could become unavailable because backups may not restore successfully, delaying order fulfillment.	5
R-04	E-commerce admin portal	Misuse by a former contractor	Access reviews are infrequent	A former contractor could retain unnecessary administrator access and expose or alter customer data.	5
R-05	Employee laptop	Loss or theft	Customer exports are stored without full-disk encryption	A lost laptop could expose locally stored customer exports.	4

How does each risk row work?

A threat identifies the event or actor that could cause harm.
A vulnerability identifies the weakness that makes the scenario possible.
A risk statement connects that scenario to a business consequence.
The impact rating estimates the seriousness of that consequence for this exercise.

Save Northstar-Outfitters-GRC-Assessment.ods.

Before you compare the completed ratings, do you think impact alone gives leadership one clear first priority?

Inspect the values in the Impact (1-5) column.
Identify every row carrying the highest impact rating.

You will see R-02, R-03, and R-04 tied at 5. R-01 sits below them at 4.

This tie is the intended shortfall. Impact alone leaves leadership without one clear first action.

Register columns misaligned?

Undo the paste if a risk statement spills into the wrong column.
Select cell A1 before pasting the complete table again.
Confirm each row begins with its matching risk ID.
Help me fix the Risk Register layout.

✔️ Awesome, I've got everything!

Your workbook now contains the scenario, asset inventory, and five-row risk register.

ⓧ I'd like to double check the full workbook

Scenario
Northstar Outfitters is a fictional 25-person online retailer with no dedicated security team.
Scope covers systems used to receive orders and run daily operations.
No real personal or company data will be used.

Asset Inventory
Asset	Criticality (1-5)
customer order database	5
e-commerce admin portal	5
finance workstation	5
cloud email accounts	4
employee laptop	4

1 means low importance and 5 means mission-critical for this exercise.

Risk Register
Risk ID	Asset	Threat	Vulnerability	Risk Statement	Impact (1-5)
R-01	Cloud email accounts	Phishing	Multi-factor authentication is not enforced	A phishing attacker could use stolen credentials to take over cloud email accounts, enabling fraudulent messages and access to business information.	4
R-02	Finance workstation	Ransomware	Software updates are delayed	Ransomware could exploit outdated software on the finance workstation, interrupting invoicing and payroll.	5
R-03	Customer order database	Data corruption or ransomware	Backups are not restore-tested	Customer order data could become unavailable because backups may not restore successfully, delaying order fulfillment.	5
R-04	E-commerce admin portal	Misuse by a former contractor	Access reviews are infrequent	A former contractor could retain unnecessary administrator access and expose or alter customer data.	5
R-05	Employee laptop	Loss or theft	Customer exports are stored without full-disk encryption	A lost laptop could expose locally stored customer exports.	4

How to read this reference

Each standalone name identifies one workbook sheet. The tab-separated rows beneath it show the expected contents of that sheet.

That is the first evidence chain complete. Next, you will add likelihood to break the impact-only tie and create a defensible priority order.

Prioritize the Risks

The impact-only register still leaves leadership with a three-way tie. R-02, R-03, and R-04 all carry an impact rating of 5.

Likelihood describes how plausible a scenario is within this fictional exercise. LibreOffice Calc combines it with impact to produce an inherent risk score.

This fictional exercise uses a custom Impact x Likelihood method. NIST CSF 2.0 does not prescribe this scoring formula.

In this step, get ready to:

Assign fictional likelihood ratings to the five risk scenarios.
Calculate inherent risk from impact and likelihood.
Turn the scores into a sorted visual priority order.

Add likelihood estimates

The likelihood scale runs from 1 for unlikely to 5 for highly likely. These values are fictional estimates created for this exercise.

Switch back to the Risk Register sheet from earlier.
Enter Likelihood (1-5) in cell G1.
Enter Inherent Risk in cell H1.
Enter 5 in cell G2 for R-01.
Enter 4 in cell G3 for R-02.
Enter 2 in cell G4 for R-03.
Enter 3 in cell G5 for R-04.
Enter 2 in cell G6 for R-05.

You now see a likelihood estimate beside every impact rating. The different values give you a way to break the impact-only tie.

Calculate inherent risk

An inherent risk score gives each scenario one comparison value. The simplified model multiplies the two ratings from the same row.

Before you calculate the first score, do you think R-01 can reach the top once likelihood is included?

Select cell H2.
Enter =F2*G2 into the selected cell.
Press Enter.

You see 20 in H2. The high likelihood has lifted R-01 above its impact-only position.

Select cell H2 again.
Move your pointer to the fill handle at the lower-right corner of the selected cell.
Drag the fill handle down through cell H6.

The unsorted scores now read 20, 20, 10, 15, and 8 from H2 through H6.

Before you test the formula, predict how H2 changes when the likelihood in G2 drops from 5 to 4.

Select cell G2.
Replace 5 with 4.

You see H2 change from 20 to 16.

Restore 5 in cell G2.

The score returns to 20.

Now predict how H2 changes when the impact in F2 drops from 4 to 3.

Select cell F2.
Replace 4 with 3.

You see H2 change to 15.

Restore 4 in cell F2.

The score returns to 20. Your formula now responds to changes in either input.

Why Is This Scoring Method Simplified?

The workbook uses multiplication to make the comparison transparent. A leader can trace each score back to its impact rating and likelihood estimate.

NIST CSF 2.0 leaves scoring methods to the organization. The ratings in this workbook remain fictional exercise estimates.

Seeing an Unexpected Score?

Confirm that the impact values remain in cells F2:F6.
Confirm that the likelihood values are in cells G2:G6.
Select H2 to check that the formula bar shows =F2*G2.

If the filled cells do not update, help me troubleshoot the inherent risk formulas in my LibreOffice Calc register.

Sort and highlight the priorities

Sorting moves the largest scores to the top of the register. A color scale adds a visual signal without replacing the underlying numbers.

Before you sort, which two risks do you expect to reach the top once likelihood is included?

Drag across cells A1:H6 to select the complete register.
Click Data in the menu bar.
Click Sort.
Select Inherent Risk for Sort Key 1.
Select Descending.
Click OK.

The register now places R-01 and R-02 first with scores of 20.

Select cells H2:H6.
Click Format in the menu bar.
Select Conditional.
Select Condition.
Choose All cells.
Select Color Scale.
Apply the conditional format.
Save your changes to Northstar-Outfitters-GRC-Assessment.ods.

The two cells containing 20 sit at the highest end of the gradient. The cell containing 8 sits at the lowest end.

Before the final check, predict the five risk IDs in order from highest to lowest score.

Read the risk IDs and inherent risk scores from the top row to the bottom row.
Confirm that the color scale remains visible across H2:H6.

You see R-01 at 20, R-02 at 20, R-04 at 15, R-03 at 10, and R-05 at 8.

Register Sorted Incorrectly?

Confirm that you selected the complete range A1:H6 before sorting.
Confirm that Inherent Risk is the first sort key.
Confirm that the sort direction is Descending.

If only column H moved, help me restore and correctly sort my complete risk register.

✔️ My register matches

Good work. Your register now shows why likelihood changes the treatment order.

ⓧ I'd like to double check the register

The Risk Register sheet contains eight columns. The headings run from Risk ID through Inherent Risk.

The R-01 row contains Cloud email accounts. Its threat is Phishing. Its vulnerability is Multi-factor authentication is not enforced. Its risk statement is A phishing attacker could use stolen credentials to take over cloud email accounts, enabling fraudulent messages and access to business information. Its impact is 4. Its likelihood is 5. Its inherent risk is 20.
The R-02 row contains Finance workstation. Its threat is Ransomware. Its vulnerability is Software updates are delayed. Its risk statement is Ransomware could exploit outdated software on the finance workstation, interrupting invoicing and payroll. Its impact is 5. Its likelihood is 4. Its inherent risk is 20.
The R-04 row contains E-commerce admin portal. Its threat is Misuse by a former contractor. Its vulnerability is Access reviews are infrequent. Its risk statement is A former contractor could retain unnecessary administrator access and expose or alter customer data. Its impact is 5. Its likelihood is 3. Its inherent risk is 15.
The R-03 row contains Customer order database. Its threat is Data corruption or ransomware. Its vulnerability is Backups are not restore-tested. Its risk statement is Customer order data could become unavailable because backups may not restore successfully, delaying order fulfillment. Its impact is 5. Its likelihood is 2. Its inherent risk is 10.
The R-05 row contains Employee laptop. Its threat is Loss or theft. Its vulnerability is Customer exports are stored without full-disk encryption. Its risk statement is A lost laptop could expose locally stored customer exports. Its impact is 4. Its likelihood is 2. Its inherent risk is 8.
Cell H2 contains =F2*G2. The corresponding formulas continue through H6.
Cells H2:H6 use Color Scale conditional formatting.

Your priority order now separates the urgent scenarios from the impact-only tie. Next, you will connect every risk to a treatment outcome, an accountable owner, and a delivery window.

Map NIST CSF Treatments

Your color-highlighted register in LibreOffice Calc now ranks R-01 and R-02 first with inherent risk scores of 20.

A score identifies urgency. The NIST Cybersecurity Framework (CSF) 2.0 links each priority to a recognized security outcome.

A risk treatment defines the response. A risk owner and target window make delivery accountable.

In this step, get ready to:

Extend the risk register with treatment planning fields.
Map every risk to a NIST CSF 2.0 outcome.
Confirm the treatment order includes ownership and delivery expectations.

Add the treatment plan columns

The new columns connect each scored risk to a current gap. They also record the decision needed to address it.

Switch back to the Risk Register sheet in the workbook from earlier.
Populate cells I1:M1 with these headers in order: Current State, NIST CSF 2.0 Outcome, Treatment Action, Risk Owner, and Target Window.

You'll see five new headers extending the register from column I through column M.

What do these fields capture?

Current State records the control gap that exists today.
NIST CSF 2.0 Outcome anchors the response to a recognized cybersecurity result.
Treatment Action states the work needed to address the gap.
Risk Owner assigns accountability for the response.
Target Window sets the expected delivery period.

Map the two highest risks

The first two rows share the highest score. Mapping them first keeps immediate attention on cloud email compromise and ransomware.

Treatment Entries for the Top Risks

R-01. Current State: MFA is not enforced. Outcome: PR.AA-03. Treatment: Enforce multi-factor authentication for cloud email accounts. Owner: IT Manager. Window: 30 days.
R-02. Current State: Updates are delayed. Outcome: PR.PS-02. Treatment: Enable automatic updates and document an organization-defined patching window. Owner: IT Manager. Window: 30 days.

Populate cells I2:M2 with the R-01 treatment entry above.
Populate cells I3:M3 with the R-02 treatment entry above.

The two risks scoring 20 now have defined responses. Both rows also identify who owns the work and when it should be delivered.

Complete and review the treatment plan

The remaining risks still require a complete response plan. Their lower scores affect priority without removing accountability.

Treatment Entries for the Remaining Risks

R-04. Current State: Contractor access is reviewed informally. Outcome: PR.AA-05. Treatment: Remove unnecessary accounts and begin recurring access reviews. Owner: Operations Manager. Window: 14 days.
R-03. Current State: Backups exist but restore tests are not documented. Outcome: PR.DS-11. Treatment: Run a restore test and record the result and corrective actions. Owner: Operations Manager. Window: 45 days.
R-05. Current State: Full-disk encryption is not enabled. Outcome: PR.DS-01. Treatment: Enable full-disk encryption and record the device's encryption status. Owner: IT Manager. Window: 30 days.

Populate cells I4:M6 with the R-04, R-03, and R-05 entries above.
Save Northstar-Outfitters-GRC-Assessment.ods.

Before you scan the finished register, which two risk IDs do you expect to remain at the top?

Confirm the sorted row order remains R-01, R-02, R-04, R-03, and R-05.
Review cells I2:I6 to confirm every risk has one current state.
Review cells J2:J6 to confirm every risk has one NIST CSF 2.0 outcome.
Review cells K2:K6 to confirm every risk has one treatment action.
Review cells L2:L6 to confirm every risk has one owner.
Review cells M2:M6 to confirm every risk has one target window.

You'll see R-01, R-02, R-04, R-03, and R-05 in that order with scores of 20, 20, 15, 10, and 8. Every row also shows one current state, one outcome, one action, one owner, and one target window.

Treatment Values in the Wrong Rows?

Match each treatment to its Risk ID because the earlier sort changed the row positions.
Check that R-04 appears above R-03 in the sorted register.
Ask for help comparing the completed treatment rows. Help me check my NIST CSF treatment mappings against the sorted risk IDs.

That's the accountability layer complete: every prioritized risk now has a defined response and a named owner. Next, you'll turn the register into an executive risk brief.

Deliver an Executive Risk Brief

Your LibreOffice Calc workbook already gives every risk a response plan. It now needs a clear decision page for leadership.

Leadership should not have to read every register field to understand the exposure. An executive brief turns your NIST CSF 2.0 mappings into decisions they can approve.

In this step, get ready to:

Distill the assessment into four concise leadership blocks.
Add a treatment table for the two risks scoring 20.
Export the defined evidence page as a presentation-ready PDF.

Create the executive summary

An executive summary translates the register into decisions. Four short blocks give leaders the context they need before reviewing the treatment table.

Use the add-sheet control beside the workbook tabs to create one sheet.
Name the new sheet Executive Summary.
Enter this content under Assessment Scope: Northstar Outfitters is a fictional 25-person online retailer with no dedicated security team. The assessment covers systems used to receive orders and run daily operations. No real personal or company data is used.
Enter this content under Scoring Method: The exercise uses Impact x Likelihood with 1-to-5 fictional estimates. This is a custom project method. NIST CSF 2.0 does not prescribe this formula.
Enter this content under Top Risks: R-01 for cloud email phishing scores 20. Account takeover could enable fraudulent messages. It could also expose business information. R-02 for finance workstation ransomware scores 20. Ransomware could interrupt invoicing. It could also interrupt payroll.
Enter this content under First Actions for Approval: Enforce multi-factor authentication for cloud email accounts. Enable automatic updates on the finance workstation. Document an organization-defined patching window.
Save Northstar-Outfitters-GRC-Assessment.ods.

You can now scan the sheet to see the scope, scoring method, top risks, and first approval decisions.

Why This Summary Works

The scope establishes what the assessment covers. The scoring method explains how the priorities were calculated.

The top-risk block focuses attention on the two scores of 20. The approval block turns those findings into immediate decisions.

Add the priority treatment table

The short narrative identifies the decisions. A treatment table connects each decision to its business consequence and delivery commitment.

Add these column headings below the four blocks: Risk ID, Business Consequence, NIST CSF 2.0 Outcome, Action, Owner, and Target Window.
Enter the R-01 row with Fraudulent messages and access to business information, PR.AA-03, Enforce multi-factor authentication for cloud email accounts, IT Manager, and 30 days.
Enter the R-02 row with Interrupted invoicing and payroll, PR.PS-02, Enable automatic updates and document an organization-defined patching window, IT Manager, and 30 days.
Select the finished summary area containing the four blocks and treatment table.
Click Format in the top menu bar.
Select Print Ranges.
Select Define.
Save Northstar-Outfitters-GRC-Assessment.ods.

The Executive Summary sheet now shows each top risk beside its consequence, NIST CSF 2.0 outcome, action, owner, and target window.

Export and inspect the executive brief

A defined print range limits the export to the executive evidence page. The exported file preserves that view without spreadsheet editing controls.

Click File in the top menu bar.
Select Export As.
Select Export as PDF.
Click Export.
Enter Northstar-Outfitters-Executive-Summary.pdf as the file name.
Choose the Documents folder used by the workbook.
Confirm the export in the file dialog.

Before you open the export, do you expect to see spreadsheet controls or only the executive evidence page?

Open the Documents folder through the folder icon on the Windows taskbar.
Double-click Northstar-Outfitters-Executive-Summary.pdf.

You'll see the assessment scope, the Impact x Likelihood method, and the two risks scoring 20.

The recommended actions, owners, and target windows are visible without spreadsheet editing controls.

PDF Missing Summary Content?

Reselect the finished evidence area on the Executive Summary sheet.
Define the print range again before repeating the export.
Use Help me fix my executive summary PDF export..

You have turned a detailed risk register into a leadership-ready brief. Your assessment package now communicates exposure, ownership, and next actions without requiring spreadsheet access.

Secret mission

Estimate Residual Risk

Estimate how planned controls change Northstar Outfitters' two highest risks. Update the workbook with residual scores. Refresh the executive PDF to show the comparison.

Clean Up Your Resources

Your assessment files and spreadsheet software stay on this Windows computer at no ongoing cost. Decide whether to keep them, pause your work for later, or delete them entirely.

Resources you used:

A completed GRC assessment workbook saved as Northstar-Outfitters-GRC-Assessment.ods in your Documents folder.
A refreshed executive summary PDF saved locally as Northstar-Outfitters-Executive-Summary.pdf.
A local installation of LibreOffice Calc version 26.8.0.

Keep everything running

No action is needed while you want to keep developing this assessment. Both evidence files remain available for portfolio demonstrations or future GRC exercises.

Keep Northstar-Outfitters-GRC-Assessment.ods in your Documents folder.
Keep Northstar-Outfitters-Executive-Summary.pdf in its current saved location.
Retain LibreOffice version 26.8.0 for future spreadsheet projects.

Pause - I'll come back to this later

Pausing closes the open files while preserving your assessment package. Your saved workbook remains ready for the next session.

Save Northstar-Outfitters-GRC-Assessment.ods in LibreOffice Calc.
Close the workbook.
Close Northstar-Outfitters-Executive-Summary.pdf in its PDF viewer.

Your risk register and executive brief remain stored locally with no ongoing cost. You can reopen the workbook from your Documents folder whenever you return.

Delete - I don't want to use this again

Deleting the two evidence files removes the local portfolio copy of your work. LibreOffice can be installed again if another spreadsheet project needs it.

For the project files:

Close Northstar-Outfitters-GRC-Assessment.ods in LibreOffice Calc.
Close Northstar-Outfitters-Executive-Summary.pdf in its PDF viewer.
Open the Documents folder in File Explorer.
Delete Northstar-Outfitters-GRC-Assessment.ods.
Use File Explorer search to locate Northstar-Outfitters-Executive-Summary.pdf in its saved location.
Delete Northstar-Outfitters-Executive-Summary.pdf.

For LibreOffice:

Use Windows' installed-app management to find LibreOffice version 26.8.0.
Choose the uninstall option for LibreOffice version 26.8.0.
Complete the uninstaller prompts.

Confirm the cleanup:

Search File Explorer for Northstar-Outfitters-GRC-Assessment.ods.
Search File Explorer for Northstar-Outfitters-Executive-Summary.pdf.
Search Windows for LibreOffice Calc.

You should see neither project file in its saved location. LibreOffice Calc is no longer available to launch.

Nice Work!

You completed the assessment! Your Northstar Outfitters assessment now gives leaders a prioritized treatment plan grounded in NIST CSF 2.0 outcomes.

You've learned how to:

Build a scoped asset inventory for the systems Northstar Outfitters relies on. Convert each threat scenario into a business-focused risk statement.
Surface two top priorities with Impact x Likelihood scoring. Assign every risk a NIST CSF 2.0 outcome. Give every treatment a named owner plus a target window.
Export a one-page executive brief as Northstar-Outfitters-Executive-Summary.pdf. Give leadership a clear view of the top exposures plus the recommended actions.
Secret Mission: Estimate residual risk after the proposed controls. Show R-01 falling from 20 to 8. Show R-02 falling from 20 to 10.

Ready to quiz yourself?