Business outcomes
- NIST CSF–aligned baseline and plan
- Documented roles and control ownership
- Prioritized improvements
Process overview
- Baseline current state against NIST CSF
- Draft policy starter set and role responsibilities
- Create control inventory and improvement plan
What we’ll do
- Right‑size policies and standards
- Map controls to systems and teams
- Identify quick wins and risk‑based priorities
- Organize evidence locations and owners
Team roles
- Sponsor/CISO (or delegate), IT/Sec leads
- Process owners for key controls
Timeline & format
- Kickoff + working reviews by function
- Light tabletop to test roles and handoffs
Handover & sustainment
- Policy starter set and role map
- Control inventory with owners
- Improvement plan and evidence register