The program acts before the incident. People, AI agents and vendor accounts sit on one risk model, sequences for every priority breach scenario are interrupted before their final step, and access follows a subject’s stage continuously. Board key risk indicators carry thresholds tied to a stated risk appetite.
How to use this plan
Six practices. For each one, the actions that hold level 5, then the quick wins to start this quarter: Easy playbooks. Each playbook names an owner, a week window inside the 90 days, and the number that proves it worked. Print it, assign the owners, and run the assessment again in 90 days.
- 6practices
- 6quick wins (Easy playbooks)
- 13weeks
01 · See
Which signals can you see, for whom, and how fresh are they?
At level 5: Every subject on one record, all nine domains live, gaps and freshness reported.
How to hold level 5
- Re-test join quality each quarter: duplicate identities, orphaned agents, unmatched vendor accounts.
- Retire sources that fed no decision in the last two quarters.
Quick wins this quarter · Easy playbooks
- Publish the visibility-gap list with target datesEasy · weeks 1–2
List every signal no source measures and give each a target date and an owner. A gap is risk nobody can see, and a dated list keeps it on the agenda.
MetricOpen visibility gaps with a dated owner · owner: CISO
02 · Understand
How do you decide who needs attention, and what tells you the decision was right?
At level 5: Forecasts with recorded error; people and agents on one model; loss and appetite per breach scenario.
How to hold level 5
- Publish forecast error each quarter and retire predictors that stopped working.
- Re-validate loss estimates with finance each year.
Quick wins this quarter · Easy playbooks
- Agree a loss range per priority breach scenario with financeEasy · weeks 1–4
Set a loss range per breach scenario with finance and a risk appetite threshold with the board owner. The ranges turn stage counts into money the board can govern.
MetricPriority breach scenarios with an agreed loss range · owner: CISO
03 · Act
What changes when risk is found, how fast, and who or what makes the change?
At level 5: Access follows stage; sequences interrupted before the final step; agent lifecycle enforced.
How to hold level 5
- Review reversal and false-positive rates per playbook each quarter.
- Re-test every playbook in a tabletop exercise each year.
Quick wins this quarter · Easy playbooks
- Review reversal and false-positive rates each quarterEasy · weeks 1–4
Count reversed actions and complaints per playbook and tune the thresholds. Automation that annoys people loses its mandate.
MetricReversal rate per playbook · owner: CISO
04 · Prove
Can you show, with your own numbers, that risk went down?
At level 5: Board KRIs inside risk appetite; reduction over 6, 12 and 24 months; method audited.
How to hold level 5
- Re-baseline KRIs when the model version changes and show both series for two quarters.
- Repeat the independent review of the method every two years.
Quick wins this quarter · Easy playbooks
- Have internal audit review the measurement methodEasy · weeks 1–4
Hand the method, data lineage and model change log to internal audit. Independent review keeps the board’s trust in the numbers.
MetricOpen audit findings on the method · owner: GRC lead
05 · Govern
Who owns human risk, and what decision rights, budget and policy do they hold?
At level 5: A board owner for the KRIs; executive accountability; annual independent review.
How to hold level 5
- Rehearse the escalation path once a year.
- Re-confirm ownership and decision rights after each reorganization.
Quick wins this quarter · Easy playbooks
- Name the board owner of the human risk KRIsEasy · weeks 1–3
Agree which board member or committee reviews the KRIs each quarter and record it in the committee’s terms of reference. A named owner makes the KRIs real.
MetricBoard reviews held per year · owner: CISO
06 · Culture
Do people report, ask for help, and tell you the truth about friction?
At level 5: Culture KRIs inside appetite; executives measured; agent owners accountable.
How to hold level 5
- Keep the pulse questions unchanged so trends stay comparable, and review the wording every two years.
- Rotate champions and re-brief them each year.
Quick wins this quarter · Easy playbooks
- Report executives their own security behaviorsEasy · weeks 1–4
Show each executive their MFA, reporting and simulation results each quarter. Leaders change what they can see.
MetricExecutives above target on their own behaviors · owner: CISO
Why one field
The plan is already on this page.
The PDF is the same plan laid out for paper, so you can hand it to the owners. We ask for a work email and nothing else; no sales call unless you book one.
Not your level? Take the assessment: four minutes, and the result links the right playbook.
