Security Posture Baseline Scorecard
Records the starting position across key measures so progress can be shown at the first anniversary.
Available soon
- Format
- Excel
- Size
- 67 KB
- Length
- 11 sheets
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Complete this workbook with the First 90 Days Security Leader Checklist, which sets the baseline as requirement TR-12. Record the baseline within [[60]] days of your start date. Enter the details on the Baseline Summary sheet first. |
| 2 | On the Measures sheet, take each of the 12 measures in turn. Each is defined by the catalogue of measures (P11-A03 Security KPI & KRI Catalogue) and the definition is not changed (BL-05). Enter the count in Value. If the measure is written n of m, enter m in Out of. |
| 3 | Say how each value was evidenced: Told, Seen or Tested (BL-02). Date it (BL-04). A value you were told is a statement. Count it as one, and look for the record that would show it. |
| 4 | Where you do not know a value, leave Value blank. Choose one reason for Unknown, and name the plan item that will find it out (BL-03). Do not estimate. |
| 5 | On the Domain Levels sheet, choose a level in words for each domain you can judge: Not in place, Informal, Defined, Managed. The levels and the evidence words are those of P19-A02 Security Maturity Model & Scoring Method. A level above Informal needs at least Seen, and Managed needs Tested. The Check column says when evidence supports less than the level you chose (BL-02). |
| 6 | Read the Check column on each sheet. OK means the row follows the rules. Anything else says what is missing. Row by row, the Baseline Summary sheet counts the rows still to fix. |
| 7 | Read the Baseline Summary sheet: measures and domains recorded and Unknown, the levels by word, the evidence words and the Unknown reasons. These are counts. They are never added up into one figure (BL-01). Sign the baseline there. |
| 8 | Keep the first copy unchanged (BL-04). At the first anniversary, enter the later values in the Later columns of each row, with their evidence and date, and say whether the definition and the scope are the same. The sheet compares only where they are (BL-06). |
| 9 | To clear the EXAMPLE, follow the last note below. Use the Rules and Words sheet for the rules, the levels, the evidence words and the reasons. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps a new head of security, and the one who is leaving, to hand over and take over a security function. It is not legal advice and not advice on employment. It does not say that you comply with NIS2 or any standard. What liability means for a member of a management body, what an outgoing leader may be asked to hand over under their contract, and whether your organisation is an essential or an important entity are for counsel to confirm.
BL-01: Record each starting position as a count (a number, or n of m) or as a level in words: Not in place, Informal, Defined or Managed. Never a total, a score, a share, a weighting or a colour total.
EXAMPLE: Kestrel Components B.V. (EXAMPLE), a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants, treated as an important entity under NIS2 (manufacturing), on its own scope assessment, which counsel has not yet re-checked. The baseline is as at 30 Sep 2026, day 17 of the new security leader's role (week 3). The leader was told of some values, saw others, and has not yet asked for the rest. The 8 Unknown domains each name the plan item that will find them out.
Adapting this template.
Small organisation: one person may hold every role in this baseline. Record fewer Told values by asking each owner for a record or a system view, and accept Unknown with a plan item where the data does not exist. A short baseline with honest unknowns is better than a long one with guesses.
Regulated organisation: add columns to the right of the calculated ones for what your regulator or your auditor asks you to record. Do not insert columns between the existing ones, because the formulas read them by position. Counsel confirms any statement made to a regulator.
Service provider or outsourced IT: where a supplier holds the data for a measure, ask it for the record and say in the note that the supplier gave it. If it cannot give one, record Unknown with the reason Data not available, and name the plan item that will change that.
Replace the [[placeholders]]. To clear the EXAMPLE, delete the contents of the Row column and of every yellow column on the Measures and Domain Levels sheets, and the details on the Baseline Summary sheet. The measures, the domains and the formulas stay.
The baseline is a snapshot. Keep the first copy unchanged. At the first anniversary, enter the later values in the Later columns, or save a copy and repeat the measures with the same definitions and scope (BL-06).
Baseline Summary
Baseline summary: the starting position, in counts and levels in words
The details and dates of the baseline, the time check, and the counts of what the Measures and Domain Levels sheets hold. Counts only: nothing here is added up (BL-01).
EXAMPLE: the baseline of Kestrel, as at 30 Sep 2026. Clear the EXAMPLE values and details to use your own.
The baseline
| Detail | Value | Notes |
|---|---|---|
| Organisation | Kestrel Components B.V. (EXAMPLE) | The organisation the baseline describes. |
| New security leader | Sam Okafor | Records the baseline. |
| Executive sponsor | Ines Moreau | Sees the baseline and agrees the plan it feeds. |
| Start date (day 1 of the role) | 14 Sep 2026 | Day 1 is the start date (TR-12 counts from it). |
| Baseline taken as at | 30 Sep 2026 | A snapshot as at one date (BL-04). It is not updated. |
| Days allowed to record the baseline (TR-12) | 60 | A house default. Set your own. |
| Day of the role on the as-at date | 17 | Calculated. |
| Latest date to record the baseline | 12 Nov 2026 | Calculated: the start date plus the days allowed, less one. |
| Recorded in time? | Yes: day 17 of the 60 allowed | Calculated. |
| First anniversary: repeat the baseline | 14 Sep 2027 | Calculated. The First-Year Security Operating Calendar schedules the repeat as item CA-23. |
Counts
| Count | Result | What it counts |
|---|---|---|
| The baseline in one line | 9 of 12 measures recorded, 3 Unknown; 6 of 14 domains given a level, 8 Unknown | Baseline values recorded (TM-06): Baseline measures and domain levels recorded with their evidence, out of all, with the Unknown values counted beside them. Measures and domains are counted apart and never added together. The first executive briefing uses this line. |
| Not yet entered | 0 measures, 0 domains | Rows with neither a value nor a reason for Unknown. They are not counted as recorded or as Unknown. |
| Levels, by word | Not in place 0, Informal 4, Defined 2, Managed 0 | Domains given a level, by the four words of the maturity assessment. No average is taken. |
| How it was evidenced | Told 2, Seen 13, Tested 0 | Recorded values, measures and domains together, by the three evidence words (BL-02). Count Told values in the briefing and say so. |
| Why it is Unknown | Not measured here 1, Data not available 1, Not yet asked 9, Owner disputes the data 0 | Unknown values, measures and domains together, by reason (BL-03). |
| Rows still to fix | 0 measures, 0 domains | Rows with a value or a reason where the Check column does not say OK. |
| To fix: which | None | The IDs of the rows to fix. |
| Measures compared at the first anniversary | No later values yet | Only where the definition and the scope are the same (BL-06). Better and Worse follow each measure's Better when column. These are counts of rows, never a score. |
| Domains compared at the first anniversary | No later levels yet | Only where the definition and the scope are the same (BL-06). |
No total, no score, no share, no weighting and no colour total appears in this workbook (BL-01).
Sign-off
| Role | Name and date | Reference |
|---|---|---|
| Recorded by (New security leader) | [[Name, YYYY-MM-DD]] | [[Reference]] |
| Seen by (Executive sponsor) | [[Name, YYYY-MM-DD]] | [[Reference]] |
What this baseline does not say
• It is a starting position as at one date. It is not an audit, a certification or a statement of compliance with NIS2 or any standard.
• A value that was Told is a statement and not a finding. A level is a first view from what you saw. A maturity assessment under P19-A02 Security Maturity Model & Scoring Method sets levels by its own rules, from a sample of records.
• An Unknown value is recorded as Unknown. It is never estimated, and never counted as a good or a bad value.
• A later value is compared with the baseline only where the definition and the scope have not changed (BL-06).
Measures
One row for each of the 12 measures, with its definition from the catalogue of measures, unchanged (BL-05). Yellow columns are yours; the rest calculate. A count is never added to another.
| Row | Measure ID | Measure | Catalogue ID | Definition (the catalogue's, unchanged) | Better when | Value (count) | Out of (n of m) | Evidence | Reason if Unknown | Plan item that will find it out | Taken on | Note | Status | Value as written | Check | Later value (first anniversary) | Later out of | Later evidence | Later taken on | Same definition and scope? | Compared |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | BS-01 | Documents past review date | MC-09 | Approved documents whose next review date has passed. | lower | 7 | Seen | 30 Sep 2026 | Recorded | 7 | OK | ||||||||||
| EXAMPLE | BS-02 | Open exceptions by band | MC-05 | Live approved exceptions at month end, by Low, Medium, High and Critical. | lower | 11 | Seen | 30 Sep 2026 | Low 5, Medium 4, High 2, Critical 0 | Recorded | 11 | OK | |||||||||
| EXAMPLE | BS-03 | Chronic exceptions | MC-07 | Exceptions renewed more than their band allows (EX-08), so the gap has outlived every renewal the Standard permits. | lower | 1 | Seen | 30 Sep 2026 | Recorded | 1 | OK | ||||||||||
| EXAMPLE | BS-04 | Acceptances past review | MC-15 | Accepted risks whose acceptance review date has passed. | lower | 0 | 3 | Seen | 30 Sep 2026 | Recorded | 0 of 3 | OK | |||||||||
| EXAMPLE | BS-05 | Risks outside appetite and past tolerance | MC-13 | Top risks whose residual band is above their category's appetite; and of those, above its tolerance. | lower | Not measured here | PI-07 | 30 Sep 2026 | Unknown | Unknown | OK | ||||||||||
| EXAMPLE | BS-06 | Treatment actions overdue | MC-14 | Open treatment actions past their due date. | lower | 6 | 19 | Seen | 30 Sep 2026 | Recorded | 6 of 19 | OK | |||||||||
| EXAMPLE | BS-07 | Tier 1 suppliers assessed | MC-17 | Tier 1 suppliers with an assessment within the last 12 months, out of all Tier 1 suppliers. | higher | 5 | 8 | Seen | 30 Sep 2026 | Recorded | 5 of 8 | OK | |||||||||
| EXAMPLE | BS-08 | Reassessments overdue | MC-18 | Suppliers past their tier's reassessment interval. | lower | 3 | Seen | 30 Sep 2026 | Recorded | 3 | OK | ||||||||||
| EXAMPLE | BS-09 | Significant incidents and time to contain | MC-25 | Incidents reported to an authority as significant (NIS2) or major (DORA) in the quarter, and for each the hours from detection to containment. | lower | 0 | Told | 30 Sep 2026 | Recorded | 0 | OK | ||||||||||
| EXAMPLE | BS-10 | Review actions overdue | MC-27 | Open post-incident review actions past their due date. | lower | Data not available | PI-06 | 30 Sep 2026 | Unknown | Unknown | OK | ||||||||||
| EXAMPLE | BS-11 | Critical systems without a checked restore | MC-35 | Systems that support a critical service with no backup restored and checked for integrity in the last [[3]] months, out of all such systems. | lower | Not yet asked | PI-08 | 30 Sep 2026 | Unknown | Unknown | OK | ||||||||||
| EXAMPLE | BS-12 | Access that should not have existed | MC-23 | Leaver, dormant and orphan accounts found in the campaign. | lower | 11 | Seen | 30 Sep 2026 | Recorded | 11 | OK |
Domain Levels
One row for each of the 14 domains of the maturity assessment. Choose a level in words, or a reason for Unknown. The Check column applies the cap of evidence on level (BL-02). The levels and the evidence words are the maturity assessment's.
| Row | Domain ID | Domain | Discovery area that feeds it (A03) | Level | Evidence | Reason if Unknown | Plan item that will find it out | Taken on | Note | Status | Check | Later level (first anniversary) | Later evidence | Later taken on | Same definition and scope? | Compared |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | DM-01 | Governance and accountability | DS-01 Governance | Informal | Seen | 30 Sep 2026 | Recorded | OK | ||||||||
| EXAMPLE | DM-02 | Policy | DS-03 Policy | Defined | Seen | 30 Sep 2026 | Recorded | OK | ||||||||
| EXAMPLE | DM-03 | Risk management and exceptions | DS-02 Risk | Informal | Seen | 30 Sep 2026 | Recorded | OK | ||||||||
| EXAMPLE | DM-04 | Third-party security | DS-07 Suppliers | Informal | Told | 30 Sep 2026 | Recorded | OK | ||||||||
| EXAMPLE | DM-05 | Legal and regulatory obligations | None: learn it from the interviews and the plan | Not yet asked | PI-04 | 30 Sep 2026 | Unknown | OK | ||||||||
| EXAMPLE | DM-06 | Measurement and assessment | DS-10 Assurance | Not yet asked | PI-11 | 30 Sep 2026 | Unknown | OK | ||||||||
| EXAMPLE | DM-07 | Assets and information | None: learn it from the interviews and the plan | Not yet asked | PI-11 | 30 Sep 2026 | Unknown | OK | ||||||||
| EXAMPLE | DM-08 | Vulnerabilities and patching | DS-05 Vulnerabilities | Not yet asked | PI-11 | 30 Sep 2026 | Unknown | OK | ||||||||
| EXAMPLE | DM-09 | Identity and access | DS-04 Access | Informal | Seen | 30 Sep 2026 | Recorded | OK | ||||||||
| EXAMPLE | DM-10 | Awareness and training | DS-09 Awareness | Not yet asked | PI-11 | 30 Sep 2026 | Unknown | OK | ||||||||
| EXAMPLE | DM-11 | Protection of systems and data | None: learn it from the interviews and the plan | Not yet asked | PI-11 | 30 Sep 2026 | Unknown | OK | ||||||||
| EXAMPLE | DM-12 | Detection and monitoring | None: learn it from the interviews and the plan | Not yet asked | PI-11 | 30 Sep 2026 | Unknown | OK | ||||||||
| EXAMPLE | DM-13 | Incident response and notification | DS-06 Incidents | Defined | Seen | 30 Sep 2026 | Recorded | OK | ||||||||
| EXAMPLE | DM-14 | Recovery and continuity | DS-08 Resilience | Not yet asked | PI-08 | 30 Sep 2026 | Unknown | OK |
Rules and Words
The rules and the words
The rules of the baseline, and the levels, evidence words and reasons it uses. The levels and the evidence words are those of P19-A02 Security Maturity Model & Scoring Method.
The rules this workbook applies
| Rule | What it says | |
|---|---|---|
| BL-01 | Record each starting position as a count (a number, or n of m) or as a level in words: Not in place, Informal, Defined or Managed. Never a total, a score, a share, a weighting or a colour total. | |
| BL-02 | Every value says how it was evidenced: Told, Seen or Tested (P19 MA-13). A level above Informal needs at least Seen, and Managed needs Tested. | |
| BL-03 | Where a value is not known, record Unknown, with one reason from the list and the plan item that will find it out. Do not estimate. | |
| BL-04 | Date every value. The baseline is a snapshot as at a date and is not updated. Later values go beside it, in a new column. | |
| BL-05 | Take each measure's definition from P11's catalogue, unchanged (P11 MR-04), and each level from P19's four levels. | |
| BL-06 | In month 12, ready for the first anniversary, repeat the same measures with the same definitions and scope. Compare them only where the definition and the scope have not changed (P19 MA-15). | |
| TR-12 | Record the baseline within [[60]] days of the start, in counts and in levels in words. Record an unknown value as Unknown, with a reason and the plan item that will find it out. Repeat the baseline in month 12, so that the comparison is ready at the first anniversary. | |
The four levels
| Level | What it means | What the evidence must support |
|---|---|---|
| Not in place | The practice does not exist, or happens only by chance. | Told supports up to Informal. |
| Informal | It happens, but depends on particular people and is not written down or not done consistently. | Told supports up to Informal. |
| Defined | It is written down, agreed and done routinely, and leaves a record. | Seen supports up to Defined. |
| Managed | As Defined, and it is also measured, checked by someone else and improved. | Managed needs Tested. |
How a value was evidenced (BL-02)
| Evidence | What it means | Supports a level up to |
|---|---|---|
| Told | Described in an interview, with nothing shown. | Informal |
| Seen | A document or record was shown, and it says what the practice needs. | Defined |
| Tested | The assessor chose a sample of records and checked each one against the practice. | Managed |
Why a value is Unknown (BL-03)
| Reason | Use it when |
|---|---|
| Not measured here | Nobody in the organisation measures this today. |
| Data not available | Someone measures it, but the data cannot be had yet. |
| Not yet asked | You have not yet asked for it. |
| Owner disputes the data | The owner of the data does not accept the figure. |
What the Compared columns say (BL-06)
| Word | What it means |
|---|---|
| Better | The later value moved in the direction that the measure's Better when column names. |
| Worse | The later value moved the other way. |
| Unchanged | The later value equals the baseline. |
| Level up | The later level is higher than the baseline level, on the four levels. |
| Level down | The later level is lower. |
| Level unchanged | The later level equals the baseline level. |
| Not comparable (BL-06) | The definition or the scope changed, or the out-of count changed. Do not compare (BL-06). |
What to put in each column
| Column | What to enter |
|---|---|
| Value | A count: a whole number, 0 or more. Leave it blank if the value is Unknown. |
| Out of | Only for a measure written as n of m. The m is the whole you counted against. Leave it blank for a plain count. |
| Evidence | Told: you were told. Seen: you saw a document or record. Tested: you took a sample and checked each one. A level above Informal needs at least Seen, and Managed needs Tested (BL-02). |
| Reason if Unknown | Choose one reason from the list when you do not know the value. Leave Value blank. Do not estimate (BL-03). |
| Plan item | The ID of the item in the plan that will find the value out. An Unknown value needs one (BL-03). |
| Taken on | The date you took the value. The baseline is a snapshot, and it is not updated (BL-04). |
| Later value, Later level | At the first anniversary, enter the new value in the same row, with its own evidence and date. Do not overwrite the baseline (BL-04). |
| Same definition and scope? | Yes only if the definition and the scope have not changed since the baseline. Otherwise No, and the later value is not compared (BL-06). |
Lists
| Level | Evidence | EvidenceCap | EvidenceUpTo | UnknownReason | YesNo |
|---|---|---|---|---|---|
| Not in place | Told | 2 | Informal | Not measured here | Yes |
| Informal | Seen | 3 | Defined | Data not available | No |
| Defined | Tested | 4 | Managed | Not yet asked | |
| Managed | Owner disputes the data |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Baseline | The starting position, recorded as counts and as levels in words, with a reason wherever a value is unknown. It is never one score. |
| Measure | One of the 12 measures BS-01 to BS-12. Each is a measure of the catalogue of measures (P11-A03 Security KPI & KRI Catalogue), with its definition unchanged. |
| Domain | One of the 14 domains of the maturity assessment (P19-A02 Security Maturity Model & Scoring Method). |
| Level | One of four words: Not in place, Informal, Defined, Managed. A level is not a number to add up. |
| Evidence | How a value was evidenced: Told (you were told), Seen (you saw a document or record) or Tested (you checked a sample). |
| Unknown | A value you do not know. It is recorded as Unknown, with one reason from the list and the plan item that will find it out. It is never estimated. |
| Better when | Whether a lower or a higher count is the direction of improvement for the measure. It decides the words Better and Worse in the later comparison. It is not a target. |
| Taken on | The date the value was taken. The baseline is a snapshot as at that date. |
| Compared | The words that say which way a later value moved against the baseline, only where the definition and the scope are the same. |
| First anniversary | One year after the start date. The baseline is repeated, with the same measures, definitions and scope. |
| Check | What is still missing on a row. OK means the row follows the rules. |
| BL-nn, TR-12 | The rules of the baseline BL-01 to BL-06 and the requirement TR-12 of the First 90 Days Security Leader Checklist. |
| BS-nn, MC-nn, DM-nn | The measure IDs of this workbook, the catalogue IDs of the same measures, and the domain IDs of the maturity assessment. |
| EXAMPLE | A worked example: a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants, as at 30 Sep 2026. Every name and value is made up. Clear the EXAMPLE values before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | Baseline Summary sheet: what is measured and how, and the first results, kept so that monitoring and measurement can be repeated |
| NIST CSF 2.0 | ID.IM-01 — “Improvements are identified from evaluations” | Measures and Domain Levels sheets: the evaluation that the baseline records, and the later values that show improvement |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | Baseline Summary, Measures and Domain Levels sheets: a starting position recorded in the same measures and levels, so that the effectiveness of the measures can be assessed again at the first anniversary |
Editions referenced: Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026
Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.
This pack does not say which document, record or practice meets a requirement of NIS2. Each reference says what its source asks of the management body or the organisation and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.
A reference says what its source asks of the management body or the organisation, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement of NIS2.
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.