How do we turn maturity gaps into an improvement plan the budget can carry?

Start

The assessment shows gaps against the approved targets

A gap is a domain's target minus its level, counted in levels: never a score, a percentage or an average. Start from the decided results, after validation, and from the targets exactly as the sponsor approved them. Never change a target to make the plan look better. The plan is an improvement plan; it is not an audit or a compliance plan.

• Then: Were the targets approved before any evidence was scored?

Decision

Were the targets approved before any evidence was scored?

Each domain needs a target and a reason: an obligation that rests on it, a risk outside appetite, or a business need. Defined is the default target; Managed needs one of those reasons. Targets set after seeing the results tend to be set to fit them. If you cannot show a dated approval from before scoring, take the cautious branch.

• Yes: Give every practice below target one action
• No, or not known: Agree the targets and their reasons before you plan

Outcome

Agree the targets and their reasons before you plan

Without an approved target there is no gap to plan against. The pack has fieldwork wait until the sponsor approves the targets, and treats a target changed after scoring has started as a target for the next assessment. Where targets were never approved, the way forward is your judgement: one route is to have the sponsor approve them with their reasons now, and say plainly in the report that they were set after the results were known.

Step

Give every practice below target one action

Every practice below its domain's target is a finding and gets an action. Each action names an owner, a due date and the evidence that will show it is done, taken from what the next level needs. A domain at or above its target needs no action, and the sponsor may lower the effort spent on it.

• Then: Is any practice more than one level below its target?

Decision

Is any practice more than one level below its target?

A practice moves up one level per action. A practice at Not in place with a target of Defined is two levels short, and a Managed target adds a step after Defined. Planning two levels as one action hides the risk that the first step does not take hold.

• Yes: Plan one step per level, each after the one before
• No: Order the actions: pressing first, then lower levels, larger gaps

Step

Plan one step per level, each after the one before

The second step starts where the first ends and falls due on or after it. Managed is planned no sooner than six months after the practice reaches Defined, with records, in the pack's default. A roadmap never plans a jump of two levels in one step.

• Then: Order the actions: pressing first, then lower levels, larger gaps

Step

Order the actions: pressing first, then lower levels, larger gaps

A practice is pressing when a risk recorded as outside appetite in the risk register, or an obligation recorded as not met by the body that owns it, rests on it. A practice the assessor merely thinks important is not pressing. After the pressing ones come the practices at the lower level, then the domains with the larger gap, then domain and practice order.

• Then: Give up to five priority, with the earliest dates owners can meet

Step

Give up to five priority, with the earliest dates owners can meet

Up to five actions take priority in one cycle in the pack's default: the first five in the order above. Give them the earliest dates their owners can meet. The Head of Information Security proposes them and the approver approves them, and an overdue priority action is named to the sponsor in the quarterly report. The rest stay in the plan with later dates.

• Then: Name what each action waits for, inside or outside the plan

Step

Name what each action waits for, inside or outside the plan

An action falls due on or after the one it waits for. Some wait for work outside the plan, such as a risk treatment action funded through the risk treatment plan. Name it, and do not cost it twice. A recovery test, for example, may wait for the rebuild a treatment action pays for.

• Then: Estimate staff effort and outside spend separately

Step

Estimate staff effort and outside spend separately

Put each action in an effort band, in person-days: the pack's defaults are Small up to 5, Medium 6 to 20 and Large 21 to 60. Enter money spent outside, such as licences, services and contractors, as a one-off cost. Staff time is effort, not cost. Adding up the bands' upper bounds gives a ceiling, not an estimate.

• Then: Does any action need money spent outside?

Decision

Does any action need money spent outside?

If no action needs outside spend, the current budget carries the whole plan, and the approver's decision is about the plan, its dates and the staff effort it takes. If any action needs spend, the approver needs to see what the plan buys with and without it.

• Yes: Build options: current budget, recommended, and faster
• No: Can the owners carry the effort in the quarters planned?

Step

Build options: current budget, recommended, and faster

The first option keeps to the current budget: only items with no outside cost, and nothing that waits for an item it drops. The second is the plan you recommend. Add a faster or fuller one only if it is worth asking. Give each its one-off and yearly cost and say what it leaves below target.

• Then: Can the owners carry the effort in the quarters planned?

Decision

Can the owners carry the effort in the quarters planned?

In a small organisation one person may own most items. The pack's answer is to spread the due dates so each quarter's work is possible. Checking each owner's load before the plan goes for approval is your own step. If you have not checked it, take the cautious branch.

• Yes: Take the report, plan and options to the approver
• No, or not known: Spread the due dates so each quarter's work is possible

Step

Spread the due dates so each quarter's work is possible

Keep the priority actions early and move the rest. Fewer, larger steps are fine in a small organisation, but keep one level per step and a named owner for each. Moving a date never moves a target.

• Then: Take the report, plan and options to the approver

Step

Take the report, plan and options to the approver

The sponsor takes them to the approver your governance sets: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. Ask for three decisions: the targets, the plan and the investment. Present levels in words, and say the result is not an audit or a statement of compliance.

• Then: Does the option chosen leave any practice below target?

Decision

Does the option chosen leave any practice below target?

An option within the current budget can leave some practices below target, and a risk outside appetite without the work that would reduce it. The pack asks each option to say what it leaves below target, and the risk that stays, so the approver chooses knowingly. If you cannot tell what the chosen option leaves, take the cautious branch.

• Yes, or not known: Minute what the option leaves below target, and weigh its risk
• No: Track the actions monthly; re-plan items that slip each quarter

Outcome

Minute what the option leaves below target, and weigh its risk

Record the option approved, and what it leaves below target, with the approver's minute and the roadmap. The pack passes the results to the risk register after approval. Whether a gap left unfunded needs its own risk entry, or a word with the owner of a risk outside appetite that rests on it, is your judgement through your own risk process. The practices left below target come back as findings at the next assessment.

Outcome

Track the actions monthly; re-plan items that slip each quarter

Expected levels are a plan. A level moves only when someone other than the action's owner re-assesses the practice. Each quarter, compare re-assessed levels with the expected ones and report progress to the sponsor.