Set exposure program ownership
Govern exposure scope
1 person-dayCritical
Define critical services and exposure scope
Govern exposure scope
2 person-daysCritical
Establish the asset and owner inventory
Establish exposure coverage and evidence
3 person-daysCritical
Discover the external attack surface
Establish exposure coverage and evidence
3 person-days
Map assessment coverage
Establish exposure coverage and evidence
3 person-daysCritical
Designate systems of record and evidence contracts
Establish exposure coverage and evidence
2 person-daysCritical
Enrich findings with exploitation evidence
Establish exposure coverage and evidence
2 person-daysCritical
Approve risk-based prioritization
Prioritize and reduce material exposure
2 person-daysCritical
Set remediation deadlines and escalation
Prioritize and reduce material exposure
2 person-daysCritical
Govern exceptions and compensating controls
Prioritize and reduce material exposure
2 person-daysCritical
Connect findings to accountable remediation
Prioritize and reduce material exposure
3 person-daysCritical
Burn down urgent exploitable exposure
Prioritize and reduce material exposure
4 person-days
Identify material exposure chains
Prioritize and reduce material exposure
3 person-days
Retest and verify closure
Prioritize and reduce material exposure
2 person-daysCritical
Measure coverage, age, and verified reduction
Measure and report exposure reduction
2 person-daysCritical
Report exposure decisions to leaders
Measure and report exposure reduction
2 person-daysCritical
Exercise critical-exposure escalation
Prioritize and reduce material exposure
2 person-days
Establish the operating review cadence
Prioritize and reduce material exposure
1 person-dayCritical