What a breach would cost
The board wants a number. It gets a scored scenario, a modelled loss range and a treatment on the same record.
The situation
A competitor was hit by ransomware last week. The board wants your number at the next meeting.
What you do
- Score the scenario in the register, on the likelihood and impact scale the methodology already fixes.Risk register
- Model the loss as a currency range — minimum, most likely, maximum — an estimate, never a forecast.Risk quantification
- Open the Bow-Tie for the top-scoring risks that already carry a treatment plan.Risk analytics
- Record the treatment against that risk, so one entry holds the score, the range and the plan.Treatment plans
Where it ends
The board hears a modelled range with its assumptions attached — from the register, not a slide.
Risk registerRisk quantificationBow-Tie analysisTreatment plans
Close the gap phishing exposed
A click rate is not a finding until the people behind it are enrolled by name, trained, then tested again.
The situation
Your insurer asks how you know staff can spot a phish. Everyone sat a video once, in March.
What you do
- Read the last round by name in the Security Awareness add-on: who clicked, who reported it.Security awareness
- Add the names that clicked to a training campaign, individually or by whole department.Campaign detail
- Deliver the module through an emailed link that needs no login at all.Training portal
- Seed the next simulation from the high-risk names the last round produced.Phishing wizard
Where it ends
Nineteen clickers finish a module apiece; the next round reads Phish-Prone % against the same names.
Phishing simulationsTraining campaignsTraining portal
Your first certification audit
The first certification is mostly sequencing, because the cycle has to exist before a single finding can hang on it.
The situation
Nine weeks to a Stage 2 audit nobody here has sat before. The gap list is a spreadsheet. The proof is in mailboxes.
What you do
- Adopt the framework from the catalogue, then map its controls onto the ones you already run.Compliance standards
- Open the cycle for the certification, hang the document set on it, upload the certificate at the end.Audit cycles
- Raise each gap against that cycle as a finding — owner, plan, target date.Findings
- Wire the controls the auditor will sample to tests that answer without a screenshot.Continuous compliance
Where it ends
The certificate lands on the cycle record, every sampled control answering from a test rather than an inbox.
Multi-framework mappingAudit cyclesFinding remediationContinuous control testing
A critical vendor, before signing
The supplier answers before the contract does — scored answers, tasked gaps, a review date already on the calendar.
The situation
Procurement has a payroll provider ready to sign. It will hold every employee record you have; nobody has asked it one question.
What you do
- Create the vendor record in the TPRM add-on: contract, contacts, the payroll data it will hold.Vendors
- Question the provider over a link — no account at their end, nothing to chase at yours.Vendor questionnaire
- Chase each weak answer as a task with an owner and a due date.Tasks
- Set the clock for the next review now, while procurement is still paying attention.Reassessment policy
Where it ends
You sign against a scored questionnaire and a dated next review, not against a sales call.
Vendor registerVendor questionnairesReassessment policy
The record Monday needs
The fire went out on Saturday. What was never written down is who owned it, who took it over, how it closed.
The situation
It happened over the weekend. By Monday somebody wants to know what broke, who fixed it, whether it can recur.
What you do
- Open the incident, name an owner, start the timeline while the detail is fresh.Incident journal
- Assign a named analyst in the SOC add-on, where the board shows who is already loaded.Analyst workload
- Push the open case across the shift boundary in writing, acknowledged at both ends.Shift handover
- End the incident on a dated write-up that says whether it can happen again.Incident detail
Where it ends
Monday's question answers itself from the record — a dated write-up, not somebody's recollection.
Incident journalCase managementShift handoverLessons learned
A deal stalls on a questionnaire
180 questions between you and a signature. Answer from the library, check the pass rate, publish what answers the next one.
The situation
Sales promised an answer by Friday. The prospect sent 180 questions, half of them answered for somebody else last quarter.
What you do
- Open the request in the TPRM add-on: 180 questions, most of them answered for somebody already.Assessment responses
- Reuse the stored answer from the answer library, edited where this customer's wording differs.Assessment responses
- Read the pass rate for the controls the answer leans on.Control Assurance
- Publish the standards, policies and controls behind an NDA gate for whoever asks next.Trust Center
Where it ends
The next prospect reads the NDA-gated page unaided. The deal waits on procurement, not on your Friday.
Inbound TPRMControl AssuranceTrust Center
Prove the continuity plan was tested
Refresh the impact data first, so the test proves recovery targets the business actually needs this year.
The situation
A customer's procurement team asks when you last tested recovery. The honest answer is a tabletop nobody wrote down.
What you do
- Refresh the impact answers from process owners in the BCDRP add-on, on this year's numbers.BIA campaigns
- Walk the plan's validation checklist before a test assumes anything is in place.Disaster recovery plans
- Start the test on the schedule you set, then log every finding on the run itself.Plan tests
- Answer the next procurement email from the readiness score, with the last run dated underneath.Command Center
Where it ends
The answer is a dated test run with findings attached, not a plan approved two years ago.
BIA campaignsContinuity plansPlan testsCommand Center
The auditors arrive with a list
When the request list lands, the account, the evidence and the findings already have somewhere to live.
The situation
The audit firm wants a login and a request list of forty items, three days before fieldwork starts.
What you do
- Have an administrator issue the audit firm its own read-only account for the engagement.Roles and permissions
- Point the firm at the cycle, where each requirement carries the evidence that answers it.Audit cycles
- Log each request as a task with an owner, visible where the team already works.Tasks
- Sign a finding off only after the verification step passes.Findings
Where it ends
Forty requests close inside the cycle record — the last thing to schedule is the closing meeting.
Read-only accessAudit cyclesPBC requestsFindings review
Next year's plan and budget
Every number that reaches Finance traces back to a graded gap, a costed initiative and an approved budget line.
The situation
Planning starts in October. Last year's asks came from whoever argued hardest in the room. Finance has not forgotten.
What you do
- Rate the programme on one of five maturity frameworks — indicative levels, not a formal audit.Maturity frameworks
- Turn the gap into pillars and objectives with KPIs, then cost the initiatives that deliver them.Security strategy
- Raise the year's budget lines and walk each one through its own approval.Security budget
- Take the one-page summary into the meeting where the number gets defended.Executive summary
Where it ends
One framework graded against five available, every initiative costed, every budget line approved by a named approver.
Maturity frameworksSecurity strategyBudget approvalsExecutive summary