Cyber Program Assessment

The Two-Question Year-End Program Review

A year-end cyber program review does not need a framework and a spreadsheet. Two honest questions, answered with evidence, carry most of the value.

A workspace with an open notebook, keyboard, coffee, mouse and office supplies on a white desk.

Year-end reviews tend to die of their own weight. Someone downloads a framework, builds a spreadsheet with forty rows, and the review becomes a project that gets abandoned by the second week of January.

For most small businesses, two questions carry most of the value: what did we say we would do this year, and what actually happened? Answer both with evidence rather than memory, and you have a review worth the hour it took.

Key takeaways

  • A small honest review beats a large abandoned one.

  • Question one: what did we say we would do? Find it in writing, not in memory.

  • Question two: what actually happened? Evidence, not impressions.

  • The gap between the two lists is next year's plan, already drafted.

  • One page of conclusions is the deliverable. Nothing more elaborate survives.

Step 1: Find what you said you would do

Pull the actual sources: last January's budget notes, the board pre-reads, the email where someone committed to the training refresh or the backup test. Write down the commitments as they were stated, not as you now remember them.

The difference between the two is usually instructive. Memory edits out the uncomfortable items; the documents do not.

Step 2: Check what actually happened, item by item

For each commitment, look for evidence rather than asking whether it feels done. The training report. The restore test log. The invoice for the thing that was supposed to be bought. Done means provable.

Three honest verdicts cover everything: done, partly done, not done. Resist the fourth verdict, "basically done," which is where unfinished work hides.

Step 3: Read the gap without flinching

The gap between the two lists is not a failure report. It is the most accurate planning document you will have all year. The items that slipped usually slipped for the same reason, and that reason is the finding.

If everything slipped for lack of time, next year's plan needs fewer items. If everything slipped on one person's desk, it needs different ownership. The pattern matters more than any single item.

Step 4: Write one page and stop

One page: what we said, what happened, what that means for next year. This is the same discipline as grading your own program before someone else does: a small honest artifact that exists beats a comprehensive one that does not.

File it where January-you will find it. That person is the real audience.

Frequently asked questions

Is two questions really enough?

For most small businesses, yes. The value of a review is honesty about the gap, and that does not require a framework. Scale up only when the two-question version runs cleanly.

Who should do this review?

Whoever owns the program day to day, with the results going to whoever oversees it. The reviewer and the reviewer-of-the-review should not be the same person.

What if there were no written commitments?

That is the finding. Next year's first commitment is to write down, in January, what the year is supposed to include.

A practical next step

Set aside one hour before the holidays: pull the commitments, check the evidence, write the page. If the gap is wider than you want it to be, a Decision-Clarity Call can help you turn it into a realistic 2026 plan.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Cyber Program Assessment

All CISO Insights
Cyber Program Assessment

Maturity Scores vs Actual Defense: Reading Both

A maturity score shows how well a program is run, not whether it stops attacks. Pair each score with test-based evidence so the board sees both views.