diff --git a/q5-ransomware-response/prevention-plan.md b/q5-ransomware-response/prevention-plan.md
index 0b64eac..33efaf6 100644
--- a/q5-ransomware-response/prevention-plan.md
+++ b/q5-ransomware-response/prevention-plan.md
@@ -154,14 +154,14 @@ ghaymah-cli storage bucket set-object-lock \
 
 | Priority | Control | Status |
 |---|---|---|
-| 🔴 Critical | SSH key-only authentication | Implement immediately |
-| 🔴 Critical | MFA for cloud console | Implement immediately |
-| 🔴 Critical | Least-privilege IAM roles | Implement immediately |
-| 🟠 High | Automated OS patching | This week |
-| 🟠 High | Network segmentation (public/private subnets) | This week |
-| 🟠 High | `noexec` on Block Storage mounts | This week |
-| 🟠 High | Immutable backup snapshots | This week |
-| 🟡 Medium | DNS filtering / egress control | This month |
-| 🟡 Medium | File Integrity Monitoring (FIM) | This month |
-| 🟡 Medium | Phishing simulation program | This quarter |
-| 🟢 Low | Security awareness training | This quarter |
+| Critical | SSH key-only authentication | Implement immediately |
+| Critical | MFA for cloud console | Implement immediately |
+| Critical | Least-privilege IAM roles | Implement immediately |
+| High | Automated OS patching | This week |
+| High | Network segmentation (public/private subnets) | This week |
+| High | `noexec` on Block Storage mounts | This week |
+| High | Immutable backup snapshots | This week |
+| Medium | DNS filtering / egress control | This month |
+| Medium | File Integrity Monitoring (FIM) | This month |
+| Medium | Phishing simulation program | This quarter |
+| Low | Security awareness training | This quarter |