How do I record my starting position so I can show progress at the end of the first year?

Start

In a year you will need to show what changed

Without a record of where you started, nobody can show in a year what changed. The pack asks for a snapshot in counts and levels in words, taken once. The result is a baseline and a plan. It is never one score.

• Then: Write down the scope, then take the 12 measures as defined

Step

Write down the scope, then take the 12 measures as defined

Say which entities, sites and systems the baseline covers. Then take the pack's 12 measures and the 14 maturity domains as they stand. Each measure keeps the definition the catalogue of measures gives it, because a changed definition cannot be compared next year. Judgement: the pack fixes the set, so add a measure of your own only after it has a catalogue definition.

• Then: Are you within 60 days of your start date?

Decision

Are you within 60 days of your start date?

The pack's default is to record the baseline within 60 days of day 1 of the role, which falls in week 6 of its weekly plan. The date is a house default, so use your own if you have one. If you are not sure of your start date, take the later branch.

• Yes: For each value, how do you know it?
• No, or not known: Record it now, with the true as-at date

Step

Record it now, with the true as-at date

Judgement: the pack does not say what to do after day 60. A late baseline with its real date is more useful than none, and a baseline dated earlier than the day you took it is not honest. Note the days since your start, and tell your sponsor that it is late.

• Then: For each value, how do you know it?

Decision

For each value, how do you know it?

Take the values one at a time. Seen means a document, record or system view that you looked at. Tested means you took a sample and checked each record against the practice. Told means someone described it and showed nothing. Ask for the record before you accept Told, and leave alone anything you have only been told until you have checked it.

• Seen or tested: Record the count or level, marked Seen or Tested
• Only told: Record it as Told, and note which record would show it
• Not known: Record Unknown, with a reason and a plan item

Step

Record the count or level, marked Seen or Tested

A count is a whole number, or n of m where you counted against a whole, such as 5 of 8 Tier 1 suppliers assessed. A level is one of four words: Not in place, Informal, Defined or Managed. Enter the evidence word beside each value.

• Then: Does the evidence support the level you gave?

Step

Record it as Told, and note which record would show it

A value you were told is a statement, not a finding. Count it and mark it Told, and say so when you report it. Told supports a level no higher than Informal. Put the request for the record into your plan, so the value can move to Seen.

• Then: Does the evidence support the level you gave?

Step

Record Unknown, with a reason and a plan item

Leave the value blank and do not estimate. Choose one reason: Not measured here, Data not available, Not yet asked or Owner disputes the data. Name the plan item that will find it out. An honest Unknown is more useful next year than a guess, and it is never counted as good or bad.

• Then: Date every value and keep the first copy unchanged

Decision

Does the evidence support the level you gave?

Answer yes where the value is a count with no level. For a level, Told supports up to Informal, Seen up to Defined, and Managed needs Tested. If you cannot say what the evidence is, take the cautious branch.

• Yes: Date every value and keep the first copy unchanged
• No, or not known: Lower the level to what the evidence supports

Step

Lower the level to what the evidence supports

Your level is a first view from what you saw. A formal maturity assessment sets levels by its own rules, from a sample of records, and may change yours. Record the lower level now. Do not edit it later. When you have the evidence, enter the new level beside it in the later columns, with its own date.

• Then: Date every value and keep the first copy unchanged

Step

Date every value and keep the first copy unchanged

The baseline is a snapshot as at a date. Do not update it as you learn more. Later values go beside it in new columns, with their own evidence and date. Save the first copy where nobody edits it, for the records period your organisation uses.

• Then: Is anyone asking for one number?

Decision

Is anyone asking for one number?

Management often wants a single figure. The pack gives none: no total, score, share, weighting or colour total. A radar chart joined into one shape counts as a score. Answer yes, or not known, if you expect the request.

• Yes, or not known: Offer counts, levels in words and the unknowns
• No: Sign it, and show it to your executive sponsor

Step

Offer counts, levels in words and the unknowns

Give the counts the baseline sheet gives, such as 9 of 12 measures recorded, 3 Unknown, and 6 of 14 domains given a level, 8 Unknown. Show levels by word, evidence by word, and the unknowns with their reasons. Count the Told values in the briefing and say so. Measures and domains are never added together.

• Then: Sign it, and show it to your executive sponsor

Step

Sign it, and show it to your executive sponsor

You record it and the sponsor sees it, so nobody signs off what they own. It is a starting position as at one date. It is not an audit, a certification or a statement of compliance with NIS2 or any standard, and the page says so. Use the baseline line in your first executive briefing.

• Then: Put each Unknown into your plan, and book the repeat

Step

Put each Unknown into your plan, and book the repeat

Each Unknown needs a plan item that will find it out, so the gaps shrink and are not forgotten. Book the repeat in your own calendar for the end of month 12, ready for the first anniversary. The pack's first-year calendar lists it as an annual item.

• Then: At month 12, repeat the same measures and scope

Step

At month 12, repeat the same measures and scope

Enter later values beside the baseline, with their evidence and date. Use the same measures, the same definitions and the same scope. Do not overwrite the first copy. Where a value was Unknown, say whether you can now give it.

• Then: Are the definition and the scope unchanged for this value?

Decision

Are the definition and the scope unchanged for this value?

A change to a definition, a scope, an out-of count or the evidence criteria breaks the series. If you cannot show that nothing changed, take the cautious branch, because a comparison across a break misleads.

• Yes: Compare it, and report the change in words
• No, or not known: Mark a break in series and draw no trend across it

Outcome

Compare it, and report the change in words

Say whether each measure moved the way it should, and whether each level went up, down or stayed. Report counts beside counts. A level that falls with no break in series is a finding, so ask what changed. Judgement: report the Told values you moved to Seen as progress in evidence, because the pack asks only that evidence is recorded, not how to report it.

Outcome

Mark a break in series and draw no trend across it

Show both values with the reason the definition or scope changed, and do not say better or worse. Judgement: where you can restate the earlier value on the new basis, do so and say so. Where you cannot, start a new series from this value.