The principle behind the scores
What an organization doesn't know about its cyber risks can hurt it more than what it knows and prepares for. A measure of risk that only counts what has been documented will flatter any organization that has documented little.
So the methodology uses two scores and reads them together. One measures how much of the organization is under management. The other measures how well the managed risk is being reduced.
Resource Coverage Maturity
Resource Coverage Maturity (RCM) measures the extent and depth of the practice. It grows with three counts: the resources documented (R), the controls documented for them (C), and the risk management activities carried out (A).
RCM = 1 - e^(-k * (R + C + A))
The result falls between 0 and 1. The curve rises quickly at first and then flattens, because early effort yields the largest gains in maturity. The scaling factor k adjusts for the size and complexity of the organization.
The same formula is applied to each team, using that team's counts and a k suited to its scale.
The table below is an example of how RCM ranges might be read, and nothing more.
| RCM | Example reading |
|---|---|
| 0.0 to 0.3 | Initial: limited documentation of resources, few controls recorded, little activity |
| 0.3 to 0.6 | Developing: coverage of resources, controls and assessments is expanding |
| 0.6 to 0.8 | Established: comprehensive documentation, extensive controls and regular activity |
| 0.8 to 1.0 | Advanced: nearly complete coverage and frequent assessment |
Human-Enabled Administrative Risk
Human-Enabled Administrative Risk (HEAR) measures risk posture. It is built from the bottom up, starting with each resource.
HEAR (resource) = sum of mitigated risk scores / sum of unmitigated risk scores
The unmitigated score of a risk reflects its inherent impact and likelihood. The mitigated score takes the controls in place into account. A lower HEAR is better, because it means the controls are removing more of the risk.
The table below is an example of how HEAR ranges might be read, and nothing more.
| HEAR | Example reading |
|---|---|
| 0.0 to 0.2 | Excellent: a high proportion of identified risk is mitigated |
| 0.2 to 0.4 | Good: most identified risk is mitigated, with some areas to improve |
| 0.4 to 0.6 | Moderate exposure: significant room for improvement |
| 0.6 to 0.8 | High exposure: needs urgent attention |
| 0.8 to 1.0 | Critical: a high proportion of risk is unmitigated |
Reading them together
The two scores are read side by side at a single level, such as one team. At that level, each combination points to a different focus.
| Coverage | Risk | What it indicates | Where to focus |
|---|---|---|---|
| High | Low | A mature practice with a favorable posture | Sustain it |
| High | High | Wide coverage, with controls that are not mitigating enough | Find and address the specific risks that are not being reduced |
| Low | Low | A favorable posture across a limited scope | Extend coverage and bring more teams in |
| Low | High | Limited practice and high exposure | Do both: extend coverage and implement effective controls |
Rolling up
Both scores are built up from resources, and they roll up from there to the team and then to the organization.
Coverage rolls up through its counts. A team's RCM uses the team's resources, controls and activities. The organization's RCM uses the totals.
Risk rolls up through the resource scores. A team's HEAR is drawn from the scores of its resources. For the organization, the resource scores are averaged and then adjusted for coverage:
HEAR (organization) = average resource HEAR * (1 - RCM)
The adjustment means the organizational figure carries coverage inside it. It is a summary of the whole practice. The side by side reading above belongs to a single level, where the two scores stay separate.
Comparing teams
Teams differ in size and in what they manage. Adjust k for each team's scale, and judge each team mainly by its own progress over time.
What the scores are used for
- Tracking progress in adopting the practice and in reducing exposure.
- Deciding where support is needed: a team with low coverage may need training, and a resource with high risk may need targeted help.
- Reporting to leadership in terms that show change over time.
- Setting goals for coverage and risk reduction, and measuring against them.