Required Inputs
- Organization: Company name, industry, size (employees, revenue), and technology footprint.
- Scope: Enterprise-wide or specific business unit / system / application.
- Framework Preference: NIST CSF 2.0, ISO 27001, CIS Controls v8, or hybrid.
- Current Security Posture: Existing security program documentation, prior assessments, audit results.
- Regulatory Requirements: Applicable cybersecurity regulations (SOC 2, GDPR, HIPAA, PCI-DSS, CMMC, etc.).
- Known Incidents: Past security incidents, breaches, or near-misses.
- Technology Stack: Key platforms, cloud providers, network architecture overview.
- Budget Context: Current cybersecurity spend and investment capacity.
Execution Steps
1. Framework Selection Guidance
Select the appropriate framework based on organizational context.
Framework Comparison Matrix
| Criterion | NIST CSF 2.0 | ISO 27001:2022 | CIS Controls v8 |
|---|---|---|---|
| Best For | Comprehensive risk-based program design | Formal ISMS certification | Tactical, prioritized implementation |
| Approach | Outcomes-based, flexible | Requirements-based, prescriptive | Safeguard-based, prioritized |
| Structure | 6 Functions, 22 Categories, 106 Subcategories | 93 controls in 4 themes | 18 Controls, 153 Safeguards in 3 IGs |
| Certification | No formal certification | Yes (accredited certification) | No formal certification |
| Regulatory Mapping | Maps to most US/intl regulations | Recognized globally for compliance | Maps to NIST CSF and ISO 27001 |
| Maturity Model | 4 tiers (Partial to Adaptive) | Binary (conforms / does not conform) | 3 Implementation Groups (IG1-IG3) |
| Effort to Implement | Medium-High | High (requires formal ISMS) | Low-Medium (start with IG1) |
| Ideal Org Size | Mid-large, any industry | Any size seeking certification | Small-mid, or starting a security program |
Recommended Selection Logic
IF regulatory requirement mandates specific framework --> Use that framework
ELIF organization needs certification --> ISO 27001
ELIF organization is starting from scratch --> CIS Controls v8 (begin with IG1)
ELIF organization needs comprehensive program assessment --> NIST CSF 2.0
ELIF defense contractor or US government supply chain --> NIST CSF 2.0 + CMMC
ELSE --> NIST CSF 2.0 as primary, map to ISO 27001/CIS as needed
2. NIST CSF 2.0 Maturity Assessment
Assess current maturity across all 6 functions, 22 categories.
Maturity Tier Definitions
| Tier | Name | Definition |
|---|---|---|
| 1 | Partial | Ad hoc, reactive. Risk management not formalized. Limited awareness. |
| 2 | Risk Informed | Risk management practices approved but may not be organization-wide. Some processes defined. |
| 3 | Repeatable | Formal policies and procedures, consistently implemented. Regular updates. Risk-informed decisions. |
| 4 | Adaptive | Organization adapts practices based on lessons learned and predictive indicators. Continuous improvement. |
NIST CSF 2.0 Assessment Matrix
| Function | Category | Category ID | Current Tier | Target Tier | Gap | Priority |
|---|---|---|---|---|---|---|
| GOVERN | Organizational Context | GV.OC | [1-4] | [1-4] | [0-3] | [C/H/M/L] |
| GOVERN | Risk Management Strategy | GV.RM | [1-4] | [1-4] | [0-3] | |
| GOVERN | Roles, Responsibilities, Authorities | GV.RR | [1-4] | [1-4] | [0-3] | |
| GOVERN | Policy | GV.PO | [1-4] | [1-4] | [0-3] | |
| GOVERN | Oversight | GV.OV | [1-4] | [1-4] | [0-3] | |
| GOVERN | Cybersecurity Supply Chain Risk Mgmt | GV.SC | [1-4] | [1-4] | [0-3] | |
| IDENTIFY | Asset Management | ID.AM | [1-4] | [1-4] | [0-3] | |
| IDENTIFY | Risk Assessment | ID.RA | [1-4] | [1-4] | [0-3] | |
| IDENTIFY | Improvement | ID.IM | [1-4] | [1-4] | [0-3] | |
| PROTECT | Identity Management, Auth, Access Control | PR.AA | [1-4] | [1-4] | [0-3] | |
| PROTECT | Awareness and Training | PR.AT | [1-4] | [1-4] | [0-3] | |
| PROTECT | Data Security | PR.DS | [1-4] | [1-4] | [0-3] | |
| PROTECT | Platform Security | PR.PS | [1-4] | [1-4] | [0-3] | |
| PROTECT | Technology Infrastructure Resilience | PR.IR | [1-4] | [1-4] | [0-3] | |
| DETECT | Continuous Monitoring | DE.CM | [1-4] | [1-4] | [0-3] | |
| DETECT | Adverse Event Analysis | DE.AE | [1-4] | [1-4] | [0-3] | |
| RESPOND | Incident Management | RS.MA | [1-4] | [1-4] | [0-3] | |
| RESPOND | Incident Analysis | RS.AN | [1-4] | [1-4] | [0-3] | |
| RESPOND | Incident Response Reporting and Communication | RS.CO | [1-4] | [1-4] | [0-3] | |
| RESPOND | Incident Mitigation | RS.MI | [1-4] | [1-4] | [0-3] | |
| RECOVER | Incident Recovery Plan Execution | RC.RP | [1-4] | [1-4] | [0-3] | |
| RECOVER | Incident Recovery Communication | RC.CO | [1-4] | [1-4] | [0-3] |
Overall Maturity Score
Function Score = Average of Category Tiers within Function
Overall Score = Weighted Average of Function Scores
Recommended Weights:
Govern: 15% Identify: 15% Protect: 25%
Detect: 20% Respond: 15% Recover: 10%
3. Threat Landscape Analysis
Threat Actor Profiling
| Actor Type | Motivation | Capability | Targeting | Relevance to Organization |
|---|---|---|---|---|
| Nation-State (APT) | Espionage, disruption, IP theft | Very High | Specific sectors: defense, energy, finance, healthcare, tech | [High/Medium/Low] |
| Organized Crime | Financial gain | High | Opportunistic + targeted (high-value data, ransomware) | [High/Medium/Low] |
| Hacktivists | Ideological, reputational damage | Medium | Visible brands, controversial industries | [High/Medium/Low] |
| Insider Threat | Financial, grievance, negligence | Varies | Direct access to sensitive data and systems | [High/Medium/Low] |
| Competitors | Competitive advantage, IP theft | Medium | Trade secrets, customer data, pricing | [High/Medium/Low] |
| Script Kiddies | Notoriety, curiosity | Low | Opportunistic (unpatched, exposed systems) | [High/Medium/Low] |
Attack Vector Mapping
| Attack Vector | Likelihood | Common Techniques | Primary Targets | Current Defense Maturity |
|---|---|---|---|---|
| Phishing / Social Engineering | Very High | Spear phishing, BEC, vishing, smishing | Email users, executives, finance | [1-4] |
| Ransomware | High | Encryption, double extortion, RaaS | Endpoints, file servers, backups | [1-4] |
| Supply Chain Compromise | High | Software supply chain, vendor access abuse | Third-party integrations, SaaS | [1-4] |
| Credential Theft / Abuse | High | Credential stuffing, password spray, MFA bypass | Identity systems, VPN, cloud | [1-4] |
| Vulnerability Exploitation | High | Zero-day, N-day, unpatched systems | Public-facing applications, infrastructure | [1-4] |
| Insider Threat | Medium | Data exfiltration, privilege abuse, sabotage | Sensitive data stores, admin systems | [1-4] |
| Cloud Misconfiguration | Medium | Exposed storage, overprivileged IAM, public APIs | Cloud workloads, storage, databases | [1-4] |
| DDoS | Medium | Volumetric, application-layer | Public-facing services, DNS | [1-4] |
| Physical Access | Low | Tailgating, USB drops, device theft | Offices, data centers, laptops | [1-4] |
4. Vulnerability Assessment Methodology
Assessment Layers
| Layer | Method | Frequency | Tools/Approach |
|---|---|---|---|
| Network infrastructure | Automated vulnerability scanning | Monthly (external), Quarterly (internal) | Nessus, Qualys, Rapid7 |
| Web applications | DAST + SAST + manual testing | Per release + quarterly | Burp Suite, OWASP ZAP, Checkmarx |
| Cloud configuration | Cloud security posture management (CSPM) | Continuous | Prisma Cloud, Wiz, AWS Config |
| Endpoint | EDR telemetry + vulnerability scanning | Continuous + monthly | CrowdStrike, SentinelOne, Microsoft Defender |
| Identity and access | Access review + privilege audit | Quarterly | SailPoint, Azure AD access reviews |
| Third-party / SaaS | Vendor security assessment + SaaS posture | At onboarding + annually | SecurityScorecard, BitSight, questionnaires |
Vulnerability Severity Classification (CVSS-Aligned)
| Severity | CVSS Score | Remediation SLA | Escalation if SLA Missed |
|---|---|---|---|
| Critical | 9.0 - 10.0 | 24-72 hours | CISO immediately |
| High | 7.0 - 8.9 | 7-14 days | CISO weekly |
| Medium | 4.0 - 6.9 | 30-60 days | Security team lead |
| Low | 0.1 - 3.9 | 90 days or next patch cycle | Standard reporting |
| Informational | 0.0 | Track only | N/A |
5. Crown Jewel Analysis
Identify and classify the organization's most critical digital assets.
Asset Classification Matrix
| Asset Category | Examples | Confidentiality Impact | Integrity Impact | Availability Impact | Overall Criticality |
|---|---|---|---|---|---|
| Customer PII/PHI | Customer database, health records | Catastrophic | Major | Major | Critical |
| Financial data | Banking credentials, financial statements pre-release | Catastrophic | Catastrophic | Major | Critical |
| Intellectual property | Source code, formulas, designs, trade secrets | Catastrophic | Major | Moderate | Critical |
| Authentication systems | Active Directory, SSO, PKI, MFA infrastructure | Major | Catastrophic | Catastrophic | Critical |
| Core business applications | ERP, CRM, manufacturing systems | Moderate | Major | Catastrophic | High |
| Employee PII | HRIS, payroll, benefits data | Major | Moderate | Moderate | High |
| Communication systems | Email, messaging, collaboration platforms | Moderate | Moderate | Major | High |
| Public-facing systems | Website, customer portal, mobile apps | Moderate | Major | Major | High |
| Internal documentation | Policies, procedures, internal wikis | Low | Moderate | Low | Medium |
| Development/test systems | Non-production environments | Low | Low | Low | Low |
Crown Jewel Prioritization
Crown Jewel Score = (Confidentiality Impact x 0.4) + (Integrity Impact x 0.3) + (Availability Impact x 0.3)
Scoring: Catastrophic = 5, Major = 4, Moderate = 3, Minor = 2, Negligible = 1
Crown Jewels = Assets scoring >= 4.0
6. Control Gap Analysis and Remediation Prioritization
Gap Analysis Matrix
| Control Area | Required Control | Current State | Gap Description | Risk If Unaddressed | Remediation Effort | Priority Score |
|---|---|---|---|---|---|---|
| [Area] | [Control description] | [Implemented/Partial/Missing] | [Specific gap] | [Critical/High/Med/Low] | [Low/Med/High] | [Calculated] |
Remediation Priority Score Calculation
Priority Score = Risk Impact (1-5) x Likelihood of Exploitation (1-5) / Implementation Effort (1-5)
Score > 5.0 --> Immediate (Sprint 1)
Score 3.0-5.0 --> Near-term (30-90 days)
Score 1.0-3.0 --> Medium-term (90-180 days)
Score < 1.0 --> Long-term (180-365 days)
Quick Wins Identification (High Impact, Low Effort)
| Quick Win | Effort | Risk Reduction | Typical Cost |
|---|---|---|---|
| Enable MFA on all external-facing accounts | Low | Very High | $2-5/user/month |
| Disable legacy authentication protocols | Low | High | $0 (configuration) |
| Implement email authentication (SPF, DKIM, DMARC) | Low | High | $0-500/year |
| Deploy endpoint detection and response (EDR) | Medium | Very High | $5-15/endpoint/month |
| Implement privileged access management (PAM) | Medium | Very High | $20K-100K+ |
| Enable cloud security posture management (CSPM) | Medium | High | $10K-50K/year |
| Conduct phishing simulation and training | Low | Medium | $3-8/user/year |
| Review and restrict admin accounts | Low | High | $0 (process) |
7. Cyber Risk Quantification (FAIR Methodology)
Factor Analysis of Information Risk (FAIR) Framework
Risk ($) = Loss Event Frequency (LEF) x Loss Magnitude (LM)
Where:
LEF = Threat Event Frequency (TEF) x Vulnerability (Vuln)
TEF = Contact Frequency (CF) x Probability of Action (PoA)
LM = Primary Loss + Secondary Loss
Primary Loss = Productivity Loss + Response Cost + Replacement Cost + Fines/Judgments
Secondary Loss = Reputation Damage x Secondary Loss Event Frequency (SLEF)
FAIR Risk Scenario Template
| FAIR Factor | Low Estimate | Most Likely | High Estimate | Basis for Estimate |
|---|---|---|---|---|
| Threat Event Frequency (per year) | [#] | [#] | [#] | [Industry data, threat intelligence, historical incidents] |
| Vulnerability (probability of success given attempt) | [0-1] | [0-1] | [0-1] | [Control effectiveness, pentest results, maturity assessment] |
| Loss Event Frequency (per year) | [Calc] | [Calc] | [Calc] | TEF x Vulnerability |
| Primary Loss ($) | [$] | [$] | [$] | [Direct cost estimation] |
| - Productivity Loss | [$] | [$] | [$] | [Hourly revenue x downtime hours] |
| - Response Cost | [$] | [$] | [$] | [IR firm, forensics, legal, overtime] |
| - Replacement Cost | [$] | [$] | [$] | [System rebuild, data restoration] |
| - Fines and Judgments | [$] | [$] | [$] | [Regulatory penalty ranges, litigation estimates] |
| Secondary Loss ($) | [$] | [$] | [$] | [Reputation, customer churn] |
| - Customer Notification Cost | [$] | [$] | [$] | [$5-50/record industry average] |
| - Credit Monitoring | [$] | [$] | [$] | [$10-30/person x affected population] |
| - Customer Churn | [$] | [$] | [$] | [Churn rate increase x customer LTV] |
| - Brand/Reputation | [$] | [$] | [$] | [Revenue impact estimate] |
| Annualized Loss Expectancy | [$] | [$] | [$] | LEF x Total Loss Magnitude |
Loss Exceedance Curve Output
| Probability of Exceeding | Annual Loss Amount |
|---|---|
| 90% (likely exceeds) | $[amount] |
| 50% (median scenario) | $[amount] |
| 10% (worst case plausible) | $[amount] |
| 5% (tail risk) | $[amount] |
8. Third-Party / Supply Chain Cyber Risk Assessment
Vendor Risk Tiering
| Tier | Criteria | Assessment Rigor | Frequency |
|---|---|---|---|
| Critical | Access to crown jewels, critical business function, > $1M spend, or single-source dependency | Full security assessment + onsite/virtual audit + continuous monitoring | Annual assessment + continuous |
| High | Access to sensitive data, important business function, $100K-$1M spend | Detailed questionnaire (SIG/CAIQ) + evidence review + external scoring | Annual |
| Medium | Limited data access, replaceable function, $10K-$100K spend | Standard questionnaire + external risk rating review | Biennial |
| Low | No data access, commodity service, < $10K spend | External risk rating only | At onboarding |
Third-Party Assessment Checklist (Critical/High Tier)
| Domain | Key Questions | Evidence Required |
|---|---|---|
| Governance | Security program, CISO role, board reporting | Security policy, org chart |
| Access Control | SSO, MFA, privileged access, access reviews | Access control policy, PAM evidence |
| Data Protection | Encryption (transit + rest), DLP, classification | Encryption standards, DLP policy |
| Incident Response | IR plan, breach notification SLA, past incidents | IR plan, notification procedures |
| Business Continuity | DR plan, RTO/RPO, testing frequency | DR test results |
| Compliance | SOC 2 Type II, ISO 27001, relevant certifications | Current audit reports, certificates |
| Vulnerability Management | Scanning frequency, patching SLAs, pentest schedule | Scan reports (redacted), pentest summary |
| Subcontractor Management | Fourth-party risk assessment process | Subcontractor policy, list of critical subs |
9. Incident Response Readiness Evaluation
IR Readiness Scorecard
| Capability | Maturity Level (1-4) | Evidence | Gap |
|---|---|---|---|
| IR plan documented and approved | [1-4] | [Plan document, approval date] | [Gap if any] |
| IR team identified with roles and contact info | [1-4] | [Team roster, contact card] | |
| IR playbooks for top threat scenarios | [1-4] | [Playbook documents] | |
| Detection capability (SIEM, EDR, NDR) | [1-4] | [Tool inventory, coverage map] | |
| Forensic capability (in-house or retained) | [1-4] | [Retainer agreement, tool inventory] | |
| Legal/breach counsel pre-retained | [1-4] | [Retainer agreement] | |
| Cyber insurance in force | [1-4] | [Policy summary] | |
| Tabletop exercise conducted (last 12 months) | [1-4] | [Exercise report] | |
| Technical IR drill conducted (last 12 months) | [1-4] | [Drill report] | |
| Communication templates pre-approved | [1-4] | [Template documents] | |
| Regulatory notification procedures documented | [1-4] | [Procedure document per jurisdiction] | |
| Backup and recovery tested | [1-4] | [Recovery test results] |
IR Readiness Score: Sum of all scores / 48 (max) = [X]%
| Score Range | Readiness Level | Recommendation |
|---|---|---|
| 85-100% | Advanced | Maintain and continuously improve |
| 70-84% | Established | Address specific gaps identified |
| 50-69% | Developing | Significant investment needed; prioritize detection and playbooks |
| < 50% | Initial | IR program build required; engage external support |
10. Security Architecture Review Checklist
Network Architecture
| Control | Expected State | Current State | Finding |
|---|---|---|---|
| Network segmentation (microsegmentation for crown jewels) | Implemented | [Status] | [Finding] |
| Zero trust network access (ZTNA) for remote access | Implemented or planned | [Status] | |
| Web application firewall (WAF) on all public apps | Implemented | [Status] | |
| DDoS protection on public-facing services | Implemented | [Status] | |
| DNS security (DNSSEC, DNS filtering) | Implemented | [Status] | |
| East-west traffic monitoring | Implemented | [Status] |
Identity and Access
| Control | Expected State | Current State | Finding |
|---|---|---|---|
| MFA on all accounts (phishing-resistant preferred) | Enforced | [Status] | [Finding] |
| SSO for all SaaS and enterprise applications | Implemented | [Status] | |
| Privileged access management (PAM) with session recording | Implemented | [Status] | |
| Just-in-time (JIT) access for admin privileges | Implemented | [Status] | |
| Automated access provisioning/deprovisioning | Implemented | [Status] | |
| Service account management and rotation | Implemented | [Status] |
Data Protection
| Control | Expected State | Current State | Finding |
|---|---|---|---|
| Encryption at rest (AES-256 or equivalent) | All sensitive data | [Status] | [Finding] |
| Encryption in transit (TLS 1.2+ minimum) | All connections | [Status] | |
| Data loss prevention (DLP) | Implemented at key egress points | [Status] | |
| Data classification and labeling | Implemented | [Status] | |
| Backup encryption and immutability | Implemented | [Status] | |
| Key management (HSM or cloud KMS) | Implemented | [Status] |
Endpoint and Cloud
| Control | Expected State | Current State | Finding |
|---|---|---|---|
| EDR on all endpoints (servers + workstations) | 100% coverage | [Status] | [Finding] |
| Mobile device management (MDM) | All corporate/BYOD devices | [Status] | |
| CSPM for all cloud environments | Implemented | [Status] | |
| Container security (image scanning, runtime protection) | If using containers | [Status] | |
| Infrastructure as code (IaC) security scanning | If using IaC | [Status] | |
| Cloud workload protection platform (CWPP) | If using cloud compute | [Status] |
11. Cybersecurity Investment Prioritization
Risk Reduction per Dollar (RRPD) Framework
RRPD = Annualized Risk Reduction ($) / Total Cost of Ownership (3-year)
Where:
Annualized Risk Reduction = ALE(before control) - ALE(after control)
Total Cost = Implementation + Annual Operation x 3 + Training
Higher RRPD = Better investment
Investment Prioritization Matrix
| Investment | ALE Before | ALE After | Risk Reduction | 3-Year TCO | RRPD Ratio | Rank |
|---|---|---|---|---|---|---|
| [Security control/tool] | [$] | [$] | [$] | [$] | [X.X] | [#] |
Investment Decision Categories
| RRPD Ratio | Decision | Justification |
|---|---|---|
| > 3.0 | Strong invest | Risk reduction far exceeds cost |
| 1.5 - 3.0 | Invest | Positive ROI on risk reduction |
| 1.0 - 1.5 | Consider | Marginal return; evaluate alternatives |
| 0.5 - 1.0 | Defer unless regulatory | Cost exceeds quantified risk reduction |
| < 0.5 | Do not invest | Poor risk-adjusted return; seek alternatives |
12. Regulatory Mapping
Cybersecurity Regulation Cross-Reference
| Control Domain | NIST CSF 2.0 | SOC 2 (TSC) | GDPR | HIPAA | PCI-DSS 4.0 | ISO 27001 |
|---|---|---|---|---|---|---|
| Access Control | PR.AA | CC6.1-6.3 | Art. 32 | 164.312(a)(1) | Req 7-8 | A.9 |
| Data Encryption | PR.DS | CC6.1, CC6.7 | Art. 32 | 164.312(a)(2)(iv) | Req 3-4 | A.10 |
| Logging/Monitoring | DE.CM, DE.AE | CC7.1-7.2 | Art. 32 | 164.312(b) | Req 10 | A.12.4 |
| Incident Response | RS.MA, RS.AN | CC7.3-7.5 | Art. 33-34 | 164.308(a)(6) | Req 12.10 | A.16 |
| Vulnerability Mgmt | ID.RA, PR.PS | CC7.1 | Art. 32 | 164.308(a)(1) | Req 6, 11 | A.12.6 |
| Vendor Management | GV.SC | CC9.2 | Art. 28 | 164.308(b)(1) | Req 12.8 | A.15 |
| Security Training | PR.AT | CC1.4 | Art. 39 | 164.308(a)(5) | Req 12.6 | A.7.2.2 |
| Risk Assessment | ID.RA, GV.RM | CC3.1-3.2 | Art. 35 | 164.308(a)(1)(ii)(A) | Req 12.2 | A.8.2 |
| Business Continuity | PR.IR, RC.RP | A1.1-A1.3 | Art. 32 | 164.308(a)(7) | Req 12.10 | A.17 |
| Data Retention/Disposal | PR.DS | CC6.5 | Art. 5(1)(e), 17 | 164.310(d)(2) | Req 3.1, 9.4 | A.8.3 |
Compliance Gap Heat Map
| Regulation | Current Compliance | Gap Count (Critical) | Gap Count (High) | Gap Count (Medium) | Overall Status |
|---|---|---|---|---|---|
| [Regulation] | [%] | [#] | [#] | [#] | [Red/Yellow/Green] |
Output Template
## Cybersecurity Risk Assessment: [Organization]
### Assessment Parameters
| Field | Detail |
|---|---|
| Framework(s) | [NIST CSF 2.0 / ISO 27001 / CIS Controls v8] |
| Scope | [Enterprise / specific systems] |
| Assessment Date | [Date] |
| Assessor | [Name/team] |
| Classification | [Confidential] |
### Executive Summary
[Overall cybersecurity posture, maturity score, top 3-5 critical findings,
headline risk quantification, investment recommendation]
### Maturity Assessment Summary
| NIST CSF Function | Current Tier | Target Tier | Gap |
|---|---|---|---|
| Govern | [1-4] | [Target] | [Gap] |
| Identify | [1-4] | [Target] | [Gap] |
| Protect | [1-4] | [Target] | [Gap] |
| Detect | [1-4] | [Target] | [Gap] |
| Respond | [1-4] | [Target] | [Gap] |
| Recover | [1-4] | [Target] | [Gap] |
| **Overall** | [Weighted] | [Target] | [Gap] |
### Threat Landscape
[Threat actor relevance assessment, top attack vectors, industry-specific threats]
### Crown Jewel Analysis
[Critical asset inventory with classification and current protection assessment]
### Control Gap Analysis
[Prioritized gaps with remediation recommendations]
### Cyber Risk Quantification (FAIR)
| Risk Scenario | Annualized Loss Expectancy | 90th Percentile Loss |
|---|---|---|
| [Scenario 1] | [$X] | [$X] |
| [Scenario 2] | [$X] | [$X] |
| **Total Cyber Risk Exposure** | **[$X]** | **[$X]** |
### Third-Party Risk Summary
[Vendor tier distribution, critical vendor assessment status, key findings]
### Investment Roadmap
| Phase | Investment | Cost | Risk Reduction | RRPD |
|---|---|---|---|---|
| Immediate (0-30 days) | [Quick wins] | [$X] | [$X] | [X.X] |
| Near-term (30-90 days) | [High-priority controls] | [$X] | [$X] | [X.X] |
| Medium-term (90-180 days) | [Program maturity] | [$X] | [$X] | [X.X] |
| Long-term (180-365 days) | [Advanced capabilities] | [$X] | [$X] | [X.X] |
### Regulatory Compliance Status
[Compliance gap summary per applicable regulation]
### Appendices
- A: Detailed NIST CSF 2.0 assessment (all 106 subcategories)
- B: Vulnerability scan summary (redacted)
- C: Third-party vendor risk register
- D: FAIR model assumptions and data sources
- E: Regulatory mapping detail
Quality Checks
- Framework selection is justified based on organizational context, not assumed.
- NIST CSF 2.0 assessment covers all 6 functions including Govern (added in CSF 2.0).
- Threat landscape analysis is specific to the organization's industry and profile, not generic.
- Crown jewel analysis identifies specific critical assets with CIA impact ratings.
- Control gap analysis includes both the gap description and a prioritized remediation recommendation.
- FAIR risk quantification uses ranges (low/most likely/high), not single-point estimates.
- Third-party risk assessment tiers vendors by data access and business criticality.
- Incident response readiness evaluation produces a scored assessment, not just a checklist.
- Security architecture review covers network, identity, data, endpoint, and cloud layers.
- Investment prioritization uses Risk Reduction per Dollar (RRPD) to rank spending decisions.
- Regulatory mapping cross-references specific control requirements across all applicable regulations.
- Vulnerability remediation SLAs are defined by CVSS severity with escalation procedures.