The organization has basic accountability for offensive security outcomes. Roles are defined, remediation is tracked, and leadership reviews results on a set cadence. Governance is still reactive, responding to findings rather than shaping the program, but it is consistent enough to build on.
Outcomes
- ·Roles and responsibilities for offensive security are defined and documented
- ·Remediation is tracked with assigned ownership and target timelines
- ·Security or IT management reviews results on a set cadence
- ·Testing schedule, ownership, and documentation requirements are captured in policy or SOPs
- ·Leadership acknowledges outcomes and their operational implications
Actions
- 01Document roles and responsibilities for offensive security
- 02Run a remediation tracking process with owners, priorities, and target closure dates
- 03Set a leadership review cadence on a defined schedule, not on demand
- 04Capture testing cadence, ownership, and documentation requirements in policy or SOPs
Sustainment Criteria
All criteria must be met to hold this level. If any criterion is unmet at reassessment, consider yourself at the previous level.
Roles and responsibilities are documented and current
Every finding has an owner and a tracked remediation status
Leadership reviews results on a set cadence and can speak to trends over time
Testing cadence and ownership are captured in policy or SOP
Remediation progress is reported to management on a set schedule
Practitioner note
G2 governance is process-driven but not yet strategically integrated. What separates G1 from G2 is the review cadence, not just the tracking process. Results that are accessible but never reviewed on a schedule give weaker accountability than results reviewed on a defined cycle.
Moving to G3
Write an offensive security strategy tied to existing risk practices, engage a genuine executive sponsor, define SLAs with escalation, and document how findings inform risk decisions.
Corresponding Technical Practice level
T2 Repeatable
Organizations often develop these axes at different rates. Compare your position on both.