Grade Your Own Program Before Someone Else Does

Every security program gets graded eventually: by an insurer's questionnaire, a customer's security review, an assessor, or an incident. The only choice is whether the first honest grade is one you gave yourself.

A self-assessment is not a formal audit. It is a structured afternoon of comparing what the program claims to what it can show, domain by domain, before someone with a contract or a clipboard does it for you.

Key takeaways

• The first honest grade should come from you, not from an insurer, a customer or an incident.

• Grade against claims and evidence, not effort and intention.

• A simple scale, honestly applied, beats a sophisticated framework gamed.

• The gaps found on your own terms are the cheap ones.

• The output is next year's program plan, already prioritized.

Step 1: Pick the handful of domains that define your program

You do not need a hundred-line framework for the first pass. Six to ten domains cover most small and mid-sized programs: knowing what you have, controlling access, keeping systems current, backing up and recovering, watching for trouble, responding, training people, managing vendors.

The point is coverage of what matters, not completeness of a standard. A framework like NIST's Cybersecurity Framework can supply the headings if you want structure; the grading is what counts.

Step 2: For each domain, write the claim and the evidence

Two columns do the work. The claim: what the program says is true. The evidence: what you could show a skeptic today. "Departing staff lose access same day" meets the timestamps from the last three departures. "Backups are tested" meets the record of the last restore.

Where the evidence column is empty, the grade is already decided. The only question left is admitting it.

Step 3: Grade plainly and in writing

Use three grades: solid, partial, missing. Solid means evidence exists and someone looked at it recently. Partial means something exists with known gaps. Missing means the claim runs on hope.

This fictional example shows the shape. It is an illustration, not a prescription.

The first-fix column turns the grade into a plan before the meeting ends.

Step 4: Decide what the grades mean for next year

The partials and missings, ranked by what their failure would cost, are next year's program plan with the priorities already attached. This is also the fastest way to build the budget case: not fear, but a graded list of specific gaps with specific fixes.

Turning findings into a funded plan takes the next step from here.

Step 5: Set the date to do it again

A self-assessment earns its keep as an annual ritual with the grades kept year over year. The trend in the grades is the program's report card, and it is the version of the story you want to be telling.

Frequently asked questions

Is a self-assessment worth anything if we grade ourselves?

Worth plenty, if the grading is honest, because it finds the gaps while fixing them is still cheap. The discipline is grading against evidence, not intentions. If you want a check on honesty, have someone outside the team review the grades.

Should we use a formal framework?

Use one for headings if it helps, but do not let the framework become the project. The NIST Cybersecurity Framework and CIS Controls both work as checklists. The value is in the claim-versus-evidence exercise, not in the label.

Who should be in the room?

The person who runs the program, the executive who owns it, and ideally one skeptic. Two hours, one pass, no homework assigned to avoid the meeting.

What do we do with a domain that is missing entirely?

Write it down, rank it, and put a first fix on it. A known missing domain with a dated fix is a plan. An unknown one is the kind of surprise that arrives through an insurer's question or worse.

A Defensible Next Step

Book the two hours before the holidays. Bring the claims, demand the evidence, grade plainly. The gaps you find on your own terms are the last cheap ones you will ever get. Book a Decision-Clarity Call if you want a facilitator and a skeptic in the room.