Cyber Program Assessment

The January Report Card: Five Things the First Month Told You

January is done, and it was quietly keeping score. Five readings from the first month of the year that tell you more about the plan than any forecast will.

A January calendar page on a spiral notebook beside a pen, paper clips and a laptop on a white desk.

The first month of the year is over. It did not feel like a test, but it was one: the plan met the business, the budget met the invoices, the team met the new habits, and January wrote down what happened.

Before February gets loud, it is worth reading what the first month said. Five readings, none of them complicated, all of them more honest than anything you predicted in December.

Key takeaways

  • January produces evidence about the year's plan while the year is still cheap to change.

  • What actually got done in week one and two predicts the rest of Q1 better than the plan does.

  • The first invoice month tests whether the budget conversation was honest.

  • Incidents and near-misses in January are the year's first free tabletop exercise.

  • The report card is one page, thirty minutes, and two lists: continue and adjust.

The Five Readings

What actually started

Go back to the January plan and compare it with what visibly began. Not what was discussed, what was started: meetings held, owners named, drafts that exist. The moves that started on their own momentum are healthy. The ones that did not are telling you something about size, ownership, or priority.

This is the same evidence test as the two-week checkpoint, now with a full month of data. A move that has not started after four January weeks is not late; it is mis-specified. Fix the specification now, while the year is young.

What the first real workweeks did to the calendar

Every December plan imagines a January with room in it. Look at what the actual workweeks allowed: how much of the month went to planned work versus the inbox, the urgent customer, the small fires. That ratio is the honest capacity of the business.

If January's ratio was worse than the plan assumed, the plan is over-drawn, and February will not be kinder. Trim the list to fit the capacity the month actually showed, and the remaining items start finishing.

What the invoices said about the budget

January is the first month of real bills against the year's assumptions: renewals, seat counts, the vendor price increases that arrive with the new year. Compare what the technology budget imagined with what the statements showed.

Small misses compound across twelve months. A renewal that came in high, a seat count that drifted, a tool nobody remembered budgeting for: each is a small number and a useful correction, the same second look we gave the January invoices.

What the near-misses taught

Almost every January produces one: the phishing email someone nearly clicked, the laptop that died the day before a deadline, the vendor who went quiet for a week. Small, survivable, and packed with information about where the business is thin.

Treat each near-miss like a free tabletop exercise. What did we notice, what did we not, what would have made it worse? One paragraph per event, kept somewhere. A year of those paragraphs is better preparation than most binders, the same lesson as reading the trend line in your own metrics.

What the team actually adopted

January is when new habits get their honest reading. The tool rolled out with ambition in the first week, the new agenda format, the security practice everyone agreed to in December: did any of it survive contact with the real month?

Adoption that happened without enforcement is signal; something fit. Adoption that quietly died is signal too; something did not. February's job is to reinforce the first and either fix or formally drop the second, rather than letting it linger as an agreement nobody keeps.

Frequently asked questions

Is one month really enough to judge the year?

Not to judge outcomes, but plenty to judge fit. January shows whether the plan matches the business's real capacity and habits. Adjusting in February is planning; discovering the mismatch in June is archaeology.

What if January was just an unusual month?

Then the report card takes ten minutes: mostly confirms the plan, with a note about the unusual thing. Do the exercise anyway in March. The habit matters more than any single month's reading.

Who should see the report card?

Whoever owns pieces of the plan, plus your board or ownership if they track these things. A one-page honest reading of the first month builds more confidence than twelve months of assurances.

A practical next step

Take thirty minutes this week and write January's report card on one page: what started, what the calendar allowed, what the bills said, what the near-misses taught, what the team adopted. If the page raises questions the plan cannot answer, book a Decision-Clarity Call and we will read it together.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Cyber Program Assessment

All CISO Insights
Cyber Program Assessment

Maturity Scores vs Actual Defense: Reading Both

A maturity score shows how well a program is run, not whether it stops attacks. Pair each score with test-based evidence so the board sees both views.