The program measures behaviors, with reporting first among them. Signals come from two or more risk domains and are shown per person and per team on a scorecard. A risky action earns a nudge or follow-up content, and trends are reported quarter over quarter.
How to use this plan
Six practices. For each one, the actions that move you to level 3, Connecting, then the quick wins to start this quarter: Easy playbooks. Each playbook names an owner, a week window inside the 90 days, and the number that proves it worked. Print it, assign the owners, and run the assessment again in 90 days.
- 6practices
- 6quick wins (Easy playbooks)
- 13weeks
01 · See
Which signals can you see, for whom, and how fresh are they?
At level 2: Behaviors from two or more domains, reporting counted, scorecards per team.
What moves you to level 3
- Connect email security so real phishing targeting is known per person.
- Join every source on the HR system’s person identifier.
- Sync privileged accounts from the identity provider on a schedule.
- Add a third and a fourth domain, for example endpoint and data handling.
Quick wins this quarter · Easy playbooks
- Pull MFA enrollment per person from the identity providerEasy · weeks 1–3
Export the MFA method per person and join it to the behavior scorecard. Weak MFA is the access signal that turns a click into a takeover.
MetricShare of the workforce on phishing-resistant MFA · owner: Identity team · connector: IDP
02 · Understand
How do you decide who needs attention, and what tells you the decision was right?
At level 2: Scorecards per person and team; repeat clickers named; incidents shared after major events.
What moves you to level 3
- Define cohorts that combine two signals, for example targeted people who click, or risky people who hold payment authority.
- Rank the breach scenarios by last year’s incident counts.
- Agree a monthly review of human-related incidents with the SOC.
Quick wins this quarter · Easy playbooks
- Define three two-signal cohortsEasy · weeks 1–4
Name cohorts that combine signals: targeted people who click, risky people with payment authority, and non-reporters in finance. A cohort is a population you can count and act on.
MetricCohorts defined, counted and trended · owner: Security awareness lead
03 · Act
What changes when risk is found, how fast, and who or what makes the change?
At level 2: Nudges and follow-up content after risky actions; control changes by manual request.
What moves you to level 3
- Target campaigns at named cohorts and cut the whole-workforce schedule.
- Write the first three playbooks: trigger, audience, action, owner, time limit.
- Agree with the identity team which cohort gets step-up MFA.
Quick wins this quarter · Easy playbooks
- Write the first three playbooksEasy · weeks 1–4
Document trigger, audience, action, owner and time limit for repeat clickers, weak-MFA privileged users and leavers. A written playbook is what gets automated later.
MetricPlaybooks written with an owner and a time limit · owner: Security awareness lead
04 · Prove
Can you show, with your own numbers, that risk went down?
At level 2: Behavior trends quarter over quarter to the CISO.
What moves you to level 3
- Report stage 3+ people per priority breach scenario with a trend.
- Report cohort sizes against targets the CISO set.
- Map the program’s metrics to the control framework the organization follows.
Quick wins this quarter · Easy playbooks
- Set a target for each cohort and report against itEasy · weeks 1–4
Agree with the CISO a target size for repeat clickers and weak-MFA privileged users and show progress each quarter. A number with no target is trivia.
MetricCohorts reported against a target · owner: CISO
05 · Govern
Who owns human risk, and what decision rights, budget and policy do they hold?
At level 2: A charter, GRC as co-owner, an AI policy, exceptions with expiry dates.
What moves you to level 3
- Move ownership to CISO staff with the SOC as a standing partner.
- Start a monthly review with IT and HR and record decisions.
- Set a target per priority cohort and have the CISO approve it.
Quick wins this quarter · Easy playbooks
- Give every policy exception an expiry dateEasy · weeks 1–3
Record exceptions in the ticket system with an end date and an owner. An expired exception is risk with no owner.
MetricExceptions past expiry · owner: GRC lead · connector: ITSM
06 · Culture
Do people report, ask for help, and tell you the truth about friction?
At level 2: An annual survey; reports counted; a help channel; recognition for reporters.
What moves you to level 3
- Run a quarterly pulse on security NPS, perceived friction and confidence with a participation target.
- Name a security champion in each business unit.
- Set the target: report rate above click rate.
Quick wins this quarter · Easy playbooks
- Run a three-question culture pulseEasy · weeks 1–4
Ask security NPS, perceived friction and confidence each quarter. Three questions get answered every quarter.
MetricPulse participation · owner: Security awareness lead · connector: SURVEY
Why one field
The plan is already on this page.
The PDF is the same plan laid out for paper, so you can hand it to the owners. We ask for a work email and nothing else; no sales call unless you book one.
Not your level? Take the assessment: four minutes, and the result links the right playbook.
