Federated Practice Monitoring

Why it is its own methodology

A security office that assesses every system knows those systems firsthand, and knows nothing about the ones it never reached. When the work is federated, that changes. The office does far fewer assessments itself, and it can see all of them.

Seeing is a skill of its own. The other two methodologies describe the work. This one describes what to do with the trail that work leaves behind, at every level of the organization.

A diagnostic, not a verdict

Monitoring turns a large amount of reported data into signals about where to look. A score is where an inquiry starts. A low score may be a data problem, a deliberate decision about scope, or a real gap, and telling them apart takes context that only a conversation with the team supplies.

Seeing a risk does not transfer it

Whoever can see a gap is easily mistaken for its owner. A gap still belongs to the team or the provider that owns it. What a unit or the security office owns is noticing, and offering the right help.

Monitoring is federated too

The signals and scores are the same at every level.

What changes is how much of the organization a person sees.

Who	What they see, and what they do with it
A resource team	Its own resources. It catches its own slips, such as an overdue plan, a stalled fix or a control with no evidence, without waiting to be told.
A unit	The teams within it. It sees which of its teams need help and is the first to give it.
The security office	The whole organization. It sees what no unit can: the same gap across many units, where to step in first, and which services are worth building.

Each level acts first on what it can see. A team that corrects its own course never becomes a signal for its unit, and a unit that supports its own teams leaves the security office free for the work only it can do.

Shared responsibility, not shared access

Each level sees its own scope and no further. A reviewer sees signals and scores, for teams and for resources.

Signals, and what they indicate

A signal is something the work records as a side effect.

Signals fall into four categories. Each category indicates something different about the health of the practice.

Category	Its signals, and what they indicate
Coverage	Resources documented, controls documented, and teams or units with nothing recorded yet. These indicate how far the practice has reached, and where it has not started.
Activity	Risk work carried out and how regularly, plans past due for review, work in progress that has stopped moving, and reviews bunched into one part of the year. These indicate whether the practice is being kept up or was done once.
Risk	The weaknesses found and how they rank, how much of the identified risk the controls reduce, and how much of what is reported is backed by evidence. These indicate how much risk remains where the practice has reached, and how far to believe the picture.
Remediation	Weaknesses with no risk chosen for handling, chosen risks with no decision, committed fixes that are not moving, and the time it takes to resolve a risk. These indicate whether the gap is closing.

Two scores summarize them

Coverage and activity are summarized by Resource Coverage Maturity (RCM). Risk is summarized by Human-Enabled Administrative Risk (HEAR). Both are defined, with their formulas, under measuring the practice in Federated Cyber Risk.

Independent on purpose

No category tells the whole story. A team can document everything and let it go stale. Another can keep a perfect schedule and leave known gaps untouched. The value is in reading the categories against each other.

Measured at the resource, read at every level

Every signal is recorded for a single resource. Everything above that is aggregation.

The resource is where the work is done and where something can be changed, so measurement starts there. A team's figures are built from its resources, a unit's from its teams, and the organization's from its units. That one decision is what makes the rest possible.

Roll up. The same measure can be read for a resource, a team, a unit or the whole organization. Each level of the federation looks at the same thing, at its own scope.
Drill down. Any figure can be traced to the units, teams and resources behind it. A number that cannot be traced to a resource cannot be acted on.
Systemic or isolated. Drilling down shows whether a weak figure comes from one or two resources or runs across many. The first is a matter for those resources. The second is about the team's approach, and fixing resources one at a time will not change it.
What an aggregate hides. An average can conceal a few resources that are far behind. Whatever figure a team is given, look at the spread beneath it.
Teams differ. Teams vary in size and in what they manage. Judge a team against its own earlier results before comparing it with another.

Reading the scores

A score is read against the other score, and against time.

Coverage and risk together

Result	What it means, and what to do
High RCM, low HEAR	The practice is mature and it is working.
High RCM, high HEAR	The practice has reached most of the organization, and the controls are not doing enough. Find the risks that are not being reduced.
Low RCM, low HEAR	What has been examined is in good shape, and most has not been examined. Bring in more teams.
Low RCM, high HEAR	Do both: widen coverage and deal with the risks already found.

Where to step in first

Attention goes first to where coverage is low and risk is high. The organization's HEAR can be weighted by its RCM, so the two can be read as one. An implementation can turn that combination into a ranking, adding weight for how much is at stake in a resource and for how long it has gone untouched.

Is the gap closing

The two scores were defined before remediation was tracked. The remediation signals add a third question, and they follow each weakness through four stages.

Vulnerability identified → Risk selected → Mitigation committed → Inventory updated

Where the flow drops. A large drop between identified and selected is a problem of triage. A large drop between committed and updated is a problem of follow-through.
Count and weight. A team that deals only with its minor gaps looks good by count and poor once the gaps are weighted by rank.
Position and direction. A team with high risk and strong movement is behind and catching up. A team with high risk and no movement is the one to reach.

Other patterns worth knowing

Activity bunched into one month. The practice is an annual exercise, however current each plan looks.
Regular activity, risk not moving. The process is running without driving improvement.
Well documented, thinly evidenced. Controls are reported as in place with little to show for them. This is where a checkbox habit shows first.
One control family weak across many resources. A shared cause, such as a missing capability or a deliberate deferral. It calls for a different response than scattered gaps.

Trend before action

Two teams with the same score are in different positions if one has improved for three months and the other has declined. Movement in one direction over a quarter is a better signal than a single change, which may only reflect a batch of reviews. Trend is also how you find out whether an earlier intervention worked.

How far to trust a figure

New teams. There is little data behind their figures yet. Treat them as early signals.
Old data. Monitoring is a synthesis of what teams have reported. A thorough assessment from eighteen months ago can show a position that is no longer true.
Nothing to measure against. A resource with no defined scope says nothing about its risk. Giving it one comes first.
Local settings. The thresholds that mark a figure as good or poor are set by each organization. Check them before comparing figures between organizations.

What the reading is used for

Tracking progress. Whether the practice is spreading and the risk is falling.
Directing support. Teams with low coverage need help getting started. Resources with high risk need help with specific controls.
Reporting. Leadership, boards and auditors get a consistent account of where things stand.
Setting goals. A team or a unit can aim at a figure and see itself approach it.

From signal to response

Detect

Choose the indicators to watch, starting with the few that matter most to the organization. More can be added once those are understood.
Interpret

Work out what the signal means before acting on it. Findings piling up in progress is a problem of follow-through, and a different one from findings nobody owns.
Respond

Follow the playbook for that indicator, so the response is consistent and does not depend on who happens to notice.

A weekly look and a monthly review

Monitoring pays off as a rhythm. A score seen once is a measurement. Seen regularly it becomes a signal, and a score that keeps moving one way becomes a finding.

Weekly, a light scan. This is for awareness: new critical resources and sharp changes in rank, caught before they compound.
Monthly, a review of trends. This is for judgment: telling real decline from noise and deciding where to engage.

A team that stays near the top of the priority list across several reviews needs something different from a team that spikes once and recovers.

Playbooks

When a pattern appears once, it calls for an intervention. When it keeps appearing, it calls for a playbook. A playbook is the prepared response to a recognized pattern, so nobody has to work out the diagnosis again each time. It says:

which indicator it answers, and what level sets it off
what that signal usually means, and what else it could mean
who makes contact with the team
what help is on offer
what closes it out

Playbooks make the practice faster, and they make it consistent: the same pattern gets the same quality of response whoever is reviewing that week. Over time the library of playbooks becomes a record of what the organization has learned about its own security.

Attention that follows risk

Oversight is not spread evenly. A team with a steady record runs itself. When a team starts to slip, monitoring of that team increases, and it eases again once the team is back on track.

This is how the levels of care work in practice. Most teams stay in self-care. A signal moves a team into guided care, and the serious cases reach a specialist.

Keeping the reporting honest

Every signal depends on teams answering truthfully. People report gaps honestly when a “no” is treated as information, and they stop when it is treated as a failing.

So signals are used to direct help. If they are used to rank or penalize teams, the answers turn optimistic and everyone ends up managing risk they cannot see.

The yearly view

A year of monitoring answers a different kind of question. It shows whether responses are working: whether an intervention produced lasting improvement or a temporary change in a score. A unit can ask that of its own teams, and the security office of the whole organization.

For the security office, the year also shows what teams need, often before they know it themselves. A division that keeps stalling between assessment and remediation may need structured guidance or dedicated support. A group of teams with an unsteady cadence may need a different kind of engagement. These are planning and resourcing questions, and the answers let the security office design its services around demonstrated patterns instead of around whoever asks.

The same evidence is worth sharing upward. It tells leadership where the organization is improving and where it is not, in a form that can guide staffing, training and investment.

Getting started

Monitoring needs something to read, so it follows Federated Cyber Risk.

Turn on monitoring

Coverage and activity signals appear from the first day. Risk and remediation fill in as plans are approved and teams begin working their gaps.
Decide who sees what

The security office sees the whole. Give each unit a view of its own teams, and each team a view of itself.
Choose the indicators that matter most

A few, tied to what the organization is trying to achieve this year.
Write a playbook for each

Before the indicator moves, not after.
Set the rhythm

Agree who looks weekly, who reviews monthly, and where the yearly findings go, at each level.

The principles at work

All five principles of participation apply. Three do most of the work here:

Knowledge at the point of decision. A signal reaches whoever can act on it, whether the team, its unit or the security office, while there is still time. It arrives with its likely cause and a recommended response.
Psychological safety. Signals direct help. They are not used to rank or penalize, because that is what keeps the answers honest.
Gamification. A team sees the same figures about itself that its unit and the security office see, so its progress is its own to watch.

How it connects

Federated Cyber Risk. Plans, compliance checkups and remediation produce the signals, and its two scores are defined there.
Federated Third-Party Risk. Vendor assessments and compensating controls leave the same kind of trail, and are read alongside the rest.
Federated Cybersecurity. The levels of care decide where help goes, and psychological safety is what keeps the signals honest.