Set optimization outcomes and guardrails
Govern and baseline the security portfolio
3 person-daysCritical
Inventory tools, services, vendors, and contracts
Govern and baseline the security portfolio
5 person-daysCritical
Map capabilities to control outcomes
Govern and baseline the security portfolio
5 person-daysCritical
Baseline adoption and operating burden
Govern and baseline the security portfolio
5 person-days
Map telemetry, integrations, and data flows
Govern and baseline the security portfolio
5 person-daysCritical
Baseline total cost and renewal sequence
Govern and baseline the security portfolio
3 person-days
Assess supplier, dependency, and concentration risk
Govern and baseline the security portfolio
5 person-daysCritical
Approve evidence-based decision criteria
Govern and baseline the security portfolio
3 person-daysCritical
Identify overlap, gaps, and optimization candidates
Design and evaluate the target portfolio
5 person-daysCritical
Design the target control architecture
Design and evaluate the target portfolio
5 person-daysCritical
Define exit, portability, and data disposition
Design and evaluate the target portfolio
3 person-daysCritical
Run structured vendor and option evaluation
Design and evaluate the target portfolio
5 person-daysCritical
Run a bounded option pilot
Design and evaluate the target portfolio
6 person-daysCritical
Validate control outcomes before selection
Design and evaluate the target portfolio
5 person-daysCritical
Plan transition, coexistence, and recovery
Transition and govern the portfolio
5 person-daysCritical
Execute phased migration against decision gates
Transition and govern the portfolio
6 person-daysCritical
Decommission legacy services completely
Transition and govern the portfolio
5 person-daysCritical
Measure outcomes and govern the portfolio
Transition and govern the portfolio
3 person-daysCritical