ORGSEC+ · Step 4 of 4
VerifyVerify
A new review after 12 or 24 months shows whether the measures worked, and whether the score has moved. That is how resilience is documented.
In ORGSEC+Reassessment in ORGSEC+ · same method, same thirty areas
Measured again, with the same method
It is hard to document resilience with plans alone, because a plan says what should happen, not whether the organisation is able to do it. That is why the work does not end when the measures have been carried out, but when they are measured again.
After twelve or twenty-four months a new ORGSEC assessment is carried out with the same method, the same thirty areas and the same scoring model. You then see which dimensions have moved, which Critical Findings have been closed, which measures had an effect, and what should be prioritised in the next round. Over time this gives a documented development that can be shown to the board, owners, supervisory authorities and partners.
Verification is a new review, not a certification. We assess, you own the result, and you decide who gets to see it.
Over time
What is documented
Each review builds on the previous one. The score shows the development, and the plan is updated according to what has been done.
- YEAR 0First review
- ORGSEC Score per dimension
- Critical Findings
- Prioritised plan for 3, 12 and 24 months
- 12 MONTHSNew review
- Change per dimension since last time
- Critical Findings closed, and new ones
- Adjusted plan for the next period
- 24 MONTHSNew review
- Documented development over two years
- A basis for the board, owners and supervisory authorities
- A new plan for the next 24 months
How the loop is closed
The same method every time, so that a change in the score is actually a change in the organisation, not in the measurement.
- Reassessment
- New ORGSEC Score
- Documented improvement
The report contains
- Score per dimension and overall, with the change since the previous review
- Which measures have been carried out, and which remain
- What has had an effect, and what has not
- Recommended priorities for the next period
What you can use it for
- Documentation towards the board, owners and supervisory authorities
- A basis for budget and prioritisation
- An overview for partners in total defence
- A measure of whether resilience is actually increasing
A new review, not a certification. You own the result and decide who gets to see it.
