A first target
Full coverage is the goal of a federated program, and it takes time. A new program needs a nearer target, one that is reachable and already worth having.
The definition
The operational minimum is maintained security plans for the organization's most critical resources. Each part of that carries weight.
- Maintained. The plans are kept current. A plan written once and left alone does not count.
- Security plans. Each resource has a risk-informed plan, which means its risk has been assessed.
- Most critical resources. The program begins with the resources whose loss or compromise would hurt the organization most.
Finding the critical resources
Where no plans exist yet, early adopters are the way in. They bring their own critical resources and can refer the program to the people who run others.
Where plans do exist, import them and bring them up to date.
Why this target
It is small enough to reach with the first few teams and significant enough to show leadership a result. It also puts protection where the organization's largest risks are, before the program has grown.
After the minimum
Reaching the operational minimum ends the first phase. The second is growing the practice into a capability of the whole organization, which Scaling in Waves describes.