ORGSEC+ · Step 2 of 4
PrioritizePrioritize
The findings become a plan with prioritised measures for the next 3, 12 and 24 months – anchored in management and measured against the assets you want to protect.
In ORGSEC+Report and plan in ORGSEC+ · responsibilities and status followed up there
From findings to a management tool for top leadership
An assessment is only useful if it leads to decisions. The report therefore does not end with a long list of recommendations, but with a plan where the measures are sorted by how much they matter for the assets you want to protect, and by how quickly they can be carried out. Top management gets a management tool, not just a consultancy report.
Prioritisation starts with the most serious findings. Critical Findings are marked regardless of the total score and placed in the risk picture together with the key dependencies, before the measures are placed in one of three horizons.
The plan is yours. You decide what is implemented, in which order, and by whom. The ORGSEC assessment recommends; it does not decide.
3 / 12 / 24
What is urgent, what builds capability, and what makes resilience last
Each measure is placed in one of three horizons, so that management sees what must happen now, what is to be built over the next year, and what is to last.
- NEXT 3 MONTHSImmediate prioritiesMeasures that quickly reduce significant exposure.
- Clarify responsibilities and roles
- Close the largest gaps in the plans
- Decide what does not require budget
- NEXT 12 MONTHSBuild capabilitySystems, competence, plans, training and organisational measures.
- Competence programmes adapted to roles
- Training for teams and key personnel
- Exercises for the leadership team
- NEXT 24 MONTHSBuild resilienceMaturity, culture, technology, cooperation, continuous testing and improvement.
- Governance and routines that hold
- A culture that carries the security work
- A new review that shows the development
From findings to plan
Prioritisation follows a fixed sequence, so that it is traceable why a measure sits where it does.
- Critical Findings
- Risk picture
- Key dependencies
- Prioritisation 3 / 12 / 24
The plan contains
- A prioritised list of measures per dimension
- Responsibilities and deadlines for each measure
- Anchoring in management and, where relevant, the board
- Measurement against the assets you want to protect
- A basis for budget and resources
How we work with it
- We present the findings to management
- Management chooses and prioritises
- We write the plan so that it can be followed up
- The plan becomes the starting point for the next review
The plan is yours. You decide what is implemented, and by whom.
