01
One accountable owner
Every domain and material lifecycle gap has a named decision owner, delivery lead and escalation path.
Operating framework
From coverage to confidence.
A lightweight management model for assigning ownership, testing controls, strengthening evidence and making enterprise-security decisions on a repeatable cadence.
01 · Design principles
A framework leaders can actually operate.
Use the model as a decision aid. Tailor it to organizational context, applicable law, contractual obligations and the professional standards relevant to each domain.
02
Evidence over intention
Assess what can be demonstrated today—not what a policy says should happen or what a future project might deliver.
03
Risk-shaped depth
Apply deeper assurance where criticality, exposure, regulatory duties or credible harm justify it.
04
Cross-functional decisions
Bring security, operations, people, legal, technology, safety and continuity into the same operating picture.
05
Test the system
Use exercises, incidents, inspections and control tests to reveal weak coordination and false confidence.
06
Improve continuously
Turn every material event, near miss and review finding into owned corrective action and verified learning.
02 · Maturity
Five observable levels of capability.
Score each lifecycle phase independently. A domain is only as resilient as its weakest material phase, so do not average away a critical blind spot.
Exposed
Material exposure is not consistently known, owned or addressed.
Reactive
Response depends on individuals and is activated mainly after events.
Defined
Minimum controls, ownership and escalation paths are documented.
Assured
Controls operate consistently and are tested with credible evidence.
Adaptive
Signals, learning and changing conditions continuously shape decisions.
03 · Assessment
Separate capability from confidence.
The maturity level describes the observed capability. The confidence score describes how strongly the assessment is supported. Report both; never let a polished score hide weak evidence.
0–100
assessment confidence
50%
Control evidence
0–4
Current records, configurations, logs, inspections or observed practice.
30%
Independent challenge
0–4
Review by a competent party outside the delivery owner’s direct line.
20%
Exercise recency
0–4
Evidence from a recent test, incident, exercise or operational disruption.
This scoring model is an original, non-normative management aid. It does not certify compliance with any cited standard and should be adapted before formal assurance use.
04 · Governance
Clear decisions at every level.
Keep oversight distinct from delivery and independent challenge. Small organizations may combine roles, but decision rights and conflicts should remain explicit.
BOARD / OVERSIGHT
Set risk appetite
- Approve material tolerance and investment principles.
- Challenge systemic gaps and overdue exposure.
- Require evidence of readiness for critical scenarios.
EXECUTIVE SPONSOR
Resolve trade-offs
- Own cross-enterprise outcomes.
- Remove delivery and funding barriers.
- Accept or escalate material residual risk.
FRAMEWORK LEAD
Maintain coherence
- Operate the review cadence.
- Maintain taxonomy and assessment quality.
- Connect risks across domain boundaries.
DOMAIN OWNER
Deliver capability
- Maintain controls and evidence.
- Own corrective actions.
- Escalate changing exposure quickly.
INDEPENDENT ASSURANCE
Challenge confidence
- Test material claims and samples.
- Report gaps without delivery conflicts.
- Track closure to verified outcomes.
WORKFORCE / PARTNERS
Surface reality
- Report weak signals and near misses.
- Apply controls in daily work.
- Participate in exercises and learning.
05 · Operating cadence
Review at the speed of changing risk.
The cadence below is a baseline. Increase frequency for high-hazard operations, major transformation, elevated threat conditions or active remediation.
WEEKLY
Signal review
Triage material incidents, near misses, threat changes, control failures and overdue emergency actions.
MONTHLY
Domain review
Review exposure, evidence, dependencies, action progress and decisions that require cross-functional support.
QUARTERLY
Executive review
Challenge systemic gaps, resource trade-offs, residual risk and preparedness for priority scenarios.
ANNUALLY
Re-baseline
Refresh context, materiality, ownership, source mappings, maturity targets and the assurance plan.
06 · Adoption path
Start focused. Build evidence. Scale deliberately.
Begin with the scenarios and dependencies that could cause the greatest harm. Do not attempt to score every entry before ownership and assessment criteria are agreed.
Establish
Name the sponsor and owners. Select priority domains. Agree materiality, terms and escalation routes.
Baseline
Assess priority lifecycle phases. Record evidence and uncertainty. Fund urgent gap reduction.
Exercise
Test cross-domain scenarios. Validate decision rights, communications, dependencies and recovery assumptions.
Assure
Complete independent challenge, refresh targets and publish an evidence-backed improvement roadmap.
Apply the framework
Start with the domain that matters most now.
Use the matrix to frame the exposure, compare lifecycle coverage and identify the next decision that needs an owner.
Open the matrix