Files

T

Allen Houchins 97e04257b9 Add risk scoring rubric and mitigation/approval requirements to risk management policy (#50170 )

Adds the risk scoring rubric and mitigation/approval requirements to
Fleet's risk management policy in the handbook.

## What changed

Two new sections in `handbook/it/security.md`, between the risk
management policy and the existing risk corrective action timelines:

**Risk scoring rubric** — documents how risks in the risk register are
scored:
- Likelihood scale (1 Very unlikely → 5 Very likely)
- Impact scale (1 Very low impact → 5 Very high impact)
- Risk score = `likelihood × impact`, with level bands Low (1–6), Medium
(7–19), High (20–25)
- The full 5×5 matrix of every likelihood/impact combination

The matrix is built as a native markdown table rather than an embedded
screenshot, and each cell states its risk level in text ("20 (High)")
instead of relying on color alone, so it renders on fleetdm.com, stays
diffable, and is readable without color.

**Risk mitigation and approval** — documents when a risk requires
mitigation and who must approve accepting it instead:
- Low and Medium: mitigation not required (best effort, within the
corrective action timeline), no approval needed to accept
- High: mitigation required via a documented treatment plan, and
accepting it instead requires Head of Security and CIO approval
- Accepting a high risk needs a business justification, compensating
controls, and an expiration date no longer than one year, reviewed on or
before expiry
- Missing the corrective action timeline is treated as an accepted risk
and needs the same approval
- Rescoring a risk down requires the same approval as accepting it at
its original level

## Why

The rubric was previously only documented in our risk register tool, and
the policy didn't say what triggers mitigation or whose approval is
needed to accept a risk. Both are now in the handbook alongside the
corrective action timelines they interact with.

## Notes for reviewers

- The level bands are derived from the existing rubric's color
boundaries: Low tops out at 6, Medium covers 8–16, High starts at 20.
The band ranges are written as 1–6 / 7–19 / 20–25 to cover the gaps that
`likelihood × impact` can't produce.
- Only high risks gate on approval. Medium risks are treated the same as
low ones: mitigate on a best-effort basis within the existing 120-day
corrective action timeline, no approval required to accept. Approval
authorities follow the pattern already used elsewhere in this handbook
page (policy exceptions require Head of Security and CEO approval), with
the CIO as the second approver for high risks.
- The pre-existing "Acceptable Risk Levels" section is left as-is. It
says risks that are either low impact or low probability are generally
acceptable, which the rubric mostly agrees with, with the exception of
very high impact × unlikely (score 10, Medium). Happy to fold that
section into the rubric in a follow-up if reviewers prefer one source of
truth.

# Checklist for submitter

- [x] Handbook-only change. No code, tests, migrations, configuration
settings, or fleetd changes.

2026-07-29 13:30:53 -05:00

it.rituals.yml

Handbook: continuous flow for all product groups (4.91.0) (#49500 )

2026-07-17 15:23:16 -07:00

README.md

Handbook: Document IT as DRI for sending Google logins on first day (#46853 )

2026-06-05 13:22:37 +01:00

security.md

Add risk scoring rubric and mitigation/approval requirements to risk management policy (#50170 )

2026-07-29 13:30:53 -05:00

README.md

🌐 IT

This page details processes specific to working with and within this department.

Team

Role	Contributor(s)
VP of IT Strategy	Allen Houchins (@allenhouchins)
Solutions Consultant (SC)	^{_{See 🚂 Go-To-Market operations}}
IT Support Administrator	Andrea Pepper (@lppepper2)

Contact us

To make a request of this department, create an issue and a team member will get back to you within one business day. (If urgent, mention a team member in the #help-it Slack channel.)
- Any Fleet team member can view the kanban board for this department, including pending tasks and the status of new requests.
- Please use issue comments and GitHub mentions to communicate follow-ups or answer questions related to your request.

Responsibilities

The IT department is directly responsible for solutions consulting, dogfooding, internal frameworks and schemas, equipment management, and internal IT support.

Register a domain for Fleet

Domain name registrations are handled through Namecheap. Access is managed via 1Password.

Secure company-issued equipment for a team member

As soon as an offer is accepted, Fleet provides laptops for core team members to use while working at Fleet. The IT engineer will work with the new team member to get their equipment requested and shipped to them on time.

Check the "📦 Warehouse" team in dogfood before purchasing any equipment including laptops, to ensure we efficiently utilize existing assets before spending money. If Fleet IT warehouse inventory can meet the needs of the request, file a warehouse request.
Apple computers shipping to the United States and Canada are ordered using the Apple eCommerce Portal, or by contacting the business team at an Apple Store or contacting the online sales team at 800-854-3680. The IT engineer can arrange for same-day pickup at a store local to the Fleetie if needed.
- Note: Most Fleeties use 16-inch MacBook Pros. Team members are free to choose any laptop or operating system that works for them, as long as the price is within reason.
- When ordering through the Apple eCommerce Portal, look for a banner with Apple Store for FLEET DEVICE MANAGEMENT | Welcome [Your Name]. Hovering over Welcome should display Your Profile. If Fleet's account number is displayed, purchases will be automatically made available in Apple Business (AB).
Apple computers for Fleeties in other countries should be purchased through an authorized reseller to ensure the device is enrolled in ADE. In countries that Apple does not operate or that do not allow ADE, work with the authorized reseller to find the best solution, or consider shipping to a US based Fleetie and then shipping on to the teammate.

A 3-year AppleCare+ Protection Plan (APP) should be considered default for Apple computers >$1500. Base MacBook Airs, Mac minis, etc. do not need APP unless configured beyond the $1500 price point. APP provides 24/7 support, and global repair coverage in case of accidental screen damage or liquid spill, and battery service.

Include delivery tracking information when closing the support request so the new employee can be notified.

On the morning of a new team member's first day, IT sends them the Google Logins PDF sheet via email before their onboarding calls begin. This ensures they can access Gmail, Google Calendar, and other Google Workspace tools needed during onboarding.

Process incoming equipment

Upon receiving any device, follow these steps to process incoming equipment.

Find the device in "🍽️ Dogfood" to confirm the correct equipment was received.
Visibly inspect equipment and all related components (e.g. laptop charger) for damage.
Remove any stickers and clean devices and components.
Using the device's charger, plug in the device.
Using your company laptop, navigate to the host in dogfood, and click actions » Unlock and copy the unlock code.
Turn on the device and enter the unlock code.
If the previous user has not wiped the device, navigate to the host in dogfood, and click actions » wipe and wait until the device is finished and restarts.

If you need to manually recover a device or reinstall macOS

Enter recovery mode using the appropriate method.
Connect the device to WIFI.
Using the "Recovery assistant" tab (In the top left corner), select "Delete this Mac".
Follow the prompts to activate the device and reinstall the appropriate version of macOS.

Ship approved equipment

Once the department approves inventory to be shipped from Fleet IT, follow these step to ship the equipment.

Compare the equipment request issue with the "📦 Warehouse" team and verify physical inventory.
Plug in the device and ensure inventory has been correctly processed and all components are present (e.g. charger cord, power converter).
Package equipment for shipment.
Change the "host" info to reflect the new user. If you encounter any issues, repeat the process incoming equipment steps.
Ship via FedEx to the address listed in the equipment request.
Add a comment to the equipment request issue, at-mentioning the requestor with the FedEx tracking info and close the issue.

Monitor compliance tests

Every Monday, log in to Vanta and create GitHub issues for any tests that are due or need remediation in the next 3 weeks.
To do this, access "Tests" on the left side menu. This will provide a status report of the tests, when they are due, and who the DRI is.
Click on a test, then click on "Tasks".
Click on "Create task." Then, "Create GitHub issue."
This will bring you to a screen where you can select the appropriate DRIs and GitHub labels (multiple, if necessary, but always include the ":help-it" label). Vanta will autopopulate the issue with a brief description of the test due and what needs to be remediated. You can manually add details if necessary.
Follow up with the DRI of each issue daily until it's resolved. As needed, loop in their manager, the Head of People, Fleet's CTO, or the Head of IT. If the test is within 3 days of being overdue, DM the fleetie and their manager, asking to have the issue prioritized and completed before the due date.

Exclude a host from a screen lock policy

The macOS - Screen lock after inactivity (15 minutes or less) and Windows - Interactive logon screen lock timeout configured policies, plus their associated configuration profiles (screen-lock-inactivity.mobileconfig, Screen lock timeout.xml), are deployed to every host on the 💻 Workstations fleet. To exclude a host (e.g., a kiosk, a conference-room display driver, or a host under approved temporary investigation), add its Fleet host ID to the matching exclusion label.

On macOS, contributors who only need a temporary break from the screen saver (without changing MDM) should set a hot corner to Disable Screen Saver in System Settings → Desktop & Dock → Hot Corners first. Use the steps below when a full host exemption from the profile and policy is required — not for ordinary short-term personal use.

Confirm the request has security approval per the policy exception process. Exceptions must include a business justification and an expiration date no longer than one year.
Look up the host's Fleet ID in dogfood (visible in the host's URL).
Open a Draft pull request against the fleet repo editing the appropriate label file:
- macOS: it-and-security/lib/all/labels/macos-screen-lock-exclusions.yml
- Windows: it-and-security/lib/all/labels/windows-screen-lock-exclusions.yml
Add the host ID to the hosts: list with a comment identifying the host and the expiration date of the exception. Example:
```
hosts:
  - "1234"  # PR #1234 - exception expires 2026-12-01
```
Wait until all automated checks on the pull request have passed. On the exception or tracking issue (for example the confidential :help-it request), add a comment that links to the pull request, then convert the draft to Ready for review.
Get the PR reviewed and merged. The next fleetctl gitops run (on merge to main) will:
- Add the host to the exclusion label
- Remove the configuration profile from that host
- Stop counting the host against the screen lock policy
To revoke the exception, remove the host ID line from the label file and merge a follow-up PR. Do not leave hosts: [] behind on a label that has live exclusions on it — an empty list will wipe all members.

Rituals

Stubs

The following stubs are included only to make links backward compatible.

README.md

🌐 IT

Team

Contact us

Responsibilities

Register a domain for Fleet

Secure company-issued equipment for a team member

Send Google login credentials to a new team member

Process incoming equipment

Ship approved equipment

Monitor compliance tests

Exclude a host from a screen lock policy

Rituals

Stubs

Update a company brand front

Prepare "Let's get you set up!" meeting notes

Process the CEO's inbox

Process the CEO's calendar

Check LinkedIn for new activity

Add LinkedIn connections to CRM

Connect with active community members

Schedule travel for the CEO

Schedule CEO interview

Confirm CEO shadow dates

Program the CEO to do something

Process and backup Sid agenda

Process and backup E-group agenda

Process the help-being-ceo Slack channel

Unroll a Slack thread

Delete an accidental meeting recording

Communicate Fleet's potential energy to stakeholders

Archive a document

Approve a new position

Inform managers about hours worked

Prepare for the All hands

Share recording of all hands meeting

Update personnel details

Change a Fleetie's role

Change a Fleetie's manager

Prepare salary benchmarking information

Recognize employee workiversaries

Update a team member's compensation

Change the DRI of a consultant

Add an advisor

Convert a Fleetie to a consultant

Review Fleet's US company benefits