A cybersecurity risk assessment here scores five dimensions, from threat model currency to security KPI integration, on a 0 to 5 scale. Each dimension carries an equal weight of 0.20, so the composite is a 0 to 5 weighted score. A red dimension proposes its owning remediation playbook, and safety routes act on the first reading.
What an Unready Security Posture Looks Like
The lowest written anchors of this cybersecurity risk assessment describe what an unready posture looks like in practice. One anchor shows a static founding-era threat assessment that ignores new vectors like AI phishing, supply chain, and API exposure. Another shows no classification matrix, with data handling left ad hoc across the firm. A third shows no response plan or an untested plan, so the first incident becomes the first rehearsal.
The privacy anchor describes privacy impact assessments that never happen and deployments that go live unassessed. The metrics anchor describes security metrics buried in IT reports or missing altogether.
A theory of constraints lens suggests that an owner look for the single control gap that limits the whole posture. A unit economics lens offers a second outside view, comparing what each control costs with the exposure it covers. Neither lens forms part of the diagnostic, but either can help an owner frame the discussion before scoring.
How the Cybersecurity Risk Assessment Is Built
The Cyber, Data Privacy, and Security Diagnostic is the cybersecurity risk assessment inside the VWCG OS operating system. It scores five dimensions on a 0 to 5 scale against written anchors. Each of the five dimensions carries an equal weight of 0.20. The composite is the weighted sum, so it also lands on a 0 to 5 weighted score.
The five dimensions are Threat Model Currency, Data Classification Enforcement, Incident Response Readiness, PIA Gating, and Security KPI Integration. Each dimension carries its own written anchors at the low, middle, and high ends of the scale. Four published metric groups carry the page rules for the module as a whole.
Detection, response, and recovery means are tracked, and red MTTD triggers the Variance Alert Engine of the KPI Precision Grid module to the CISO and COO. Prevention covers patch compliance within SLA and the phishing simulation click rate. Every new system, collection, integration, or AI model completes a PIA before go-live. The method also sets a regulatory notification window, which tightens on a compliance-baseline red in the Intelligent Foundations module, and legal counsel should confirm the obligations that apply.
What Each Dimension Actually Measures
Within the cybersecurity risk assessment, Threat Model Currency asks whether the Threat Model Canvas is current and owned. The canvas covers actors, vectors, asset inventory from the Integrated Tech Stack module, vulnerabilities including human factors, and impact scoring. Quarterly full reviews sit alongside real-time updates on new intelligence. A prioritized risk register carries owners and timelines, and the Agile Capital Allocation Forum reviews it when security spend is on the agenda.
Data Classification Enforcement tiers every data asset as Public, Internal, Confidential, or Restricted, with handling rules for each tier. Classification happens at creation through automated tagging, with an approval workflow for overrides. Owners who want broader context on data practice can read this data management guide alongside the diagnostic. A compliance red in the Intelligent Foundations module escalates customer personal data to the Restricted tier automatically.
Incident Response Readiness checks a three-tier response plan that starts with triage from 0 to 1 hour. Investigation runs from 1 to 24 hours, and recovery runs from 24 hours to 2 weeks, with windows that compress on a red in the Intelligent Foundations module. Quarterly tabletop exercises across the tiers use the Change Enablement Sprint framework, with results scored back into the dimension.
PIA Gating routes four trigger events through a privacy impact assessment before go-live. Those triggers are a new system, a new collection, a third-party integration, and a new AI model. Security KPI Integration puts detection, response, prevention, and compliance KPIs on the KPI Precision Grid dashboard with traffic-light thresholds. A balanced scorecard lens suggests that an owner read those security measures beside sales, capital, and people results.
Scoring Bands and What They Route To
The composite score lands in one of three bands on the 0 to 5 weighted score. Red runs from 0.0 up to but not including 2.0, while amber runs from 2.0 to 3.5 inclusive. Green runs from above 3.5 up to and including 5.0, with no gaps or overlaps.
A red band proposes the owning remediation playbook for that specific dimension. Safety routes act on the first reading, and in this module they cover the PIA rule, classification, and response windows. Every amber dimension routes to Security Posture Monitoring with 30-day pulse checks. Green dimensions hold and are monitored quarterly through the Core Execution module, and event-driven for the PIA status signal.
A color changes only when a score clears the band edge by a margin, or holds for two consecutive scorings. That margin is 0.25 points on a 0 to 5 scale and 5 points on the AERI 0 to 100 scale. Safety routes tighten on the first reading and loosen only after an independent re-score clears the edge.
A route that fires from a scored dimension remains a proposal until leadership confirms it. Leadership confirms it at the next monthly governance review or the Core Execution Phase 3 review, whichever comes first. The stated duration of the playbook starts at that confirmation. Routes that fire from measured values and logged events act on the reading instead.
The Three-Tier Incident Response Plan
Incident Response Readiness red proposes the Incident Runbook and Tabletop Program. That playbook writes the three-tier response plan, with Tier 1 triage within the first hour. Tier 2 investigation and response run through 24 hours, and Tier 3 recovery runs through 2 weeks. The playbook also sets the regulatory notification window, and legal counsel should confirm the notification duties that apply to the business.
The playbook publishes the escalation matrix as a coded SOP in the SOP Codex module with a 90-day review. It runs the first quarterly tabletop per tier using the Change Enablement Sprint framework. Results are recorded against Incident Response Readiness, and every gap is logged into the response plan the same week. The CISO owns this playbook with an incident commander designate, over 4 weeks.
Because the method lists this playbook among its safety playbooks, it never queues behind other reds. The same red also routes to the SOP Codex module, which maintains the escalation matrix as a coded SOP.
Privacy Impact Assessment Gating
PIA Gating red and Data Classification Enforcement red both propose Classification and PIA Activation. That playbook publishes the four-tier classification matrix with handling rules and classifies the estate from the Integrated Tech Stack inventory. Customer personal data comes first, and automated tagging at creation goes live with an override workflow. The CISO owns it with a Data Protection lead, over 5 weeks.
Each assessment uses the five-part framework of data and purpose, legal basis, flow mapping, risks, and mitigations. Completed PIAs are stored audit-ready for the Exit and Acquisition Layer module, and the top anchor allows no go-live without a completed PIA. A PIA Gating red also leads the Exit and Acquisition Layer module to mark privacy evidence stale in the diligence assembly. A jobs to be done lens can help an owner describe the purpose of each data flow before that review.
Any new integration in the Integrated Tech Stack module requires a PIA before connect, with CFO plus CISO signoff evidence. Owners who weigh supply chain management consulting can note that the low threat anchor lists supply chain vectors among those left unreflected. A Data Classification Enforcement red also leads the AI Deployment Canvas module to hold new deployments that touch unclassified data.
The People Side of Security
The diagnostic includes people directly in the threat picture of the firm. The threat canvas lists vulnerabilities that include human factors, and the prevention metrics include the phishing simulation click rate. When Incident Response Readiness reads red, the Change Enablement Sprint module runs security-awareness retraining for teams involved in human-factor incidents.
The module also keeps a person in the loop under one specific Intelligent Foundations condition. When the overall AERI score in the Intelligent Foundations module falls below its set threshold on the 0 to 100 scale, automated threat detection keeps running. A person then reviews every alert that the automated detection raises.
Dashboard and Privacy Tiering red in the People and Culture Analytics module also fires a route into this module. The Cyber, Data Privacy, and Security module then reclassifies people data to Confidential or Restricted and verifies the dashboard access tiers.
Building Security Into the Operating Rhythm
Threat Model Currency red and Security KPI Integration red both propose the Threat Model and KPI Standup. That playbook builds the canvas with the Integrated Tech Stack System Inventory and stands up the four KPI categories on the KPI Precision Grid. Red MTTD routes to the CISO and COO, with monthly reporting to both and quarterly reporting to the board. The CISO or security lead owns it with the COO, over 4 weeks.
Each owner runs at most three red playbooks at once, and further reds queue. The queue ranks them by how many modules the red dimension routes into. Safety playbooks, including Classification and PIA Activation and the Incident Runbook and Tabletop Program, never queue.
An outcome met, with an independent re-score at amber or better, closes the run. Someone other than the owner re-scores the dimension.
A missed outcome at the end of its stated duration escalates to the manager of the owner. It also goes onto the next Core Execution quarter planning agenda.
Security Posture Monitoring reviews security KPIs monthly with the COO and investigates any two-month negative trend before it hits red. It also audits PIA gating by sampling go-lives across the Integrated Tech Stack and AI Deployment Canvas modules. A RACI lens can help an owner keep the runner, the re-scorer, and the approver of each playbook distinct.
Frequently Asked Questions
- What five dimensions does the Cyber, Data Privacy, and Security Diagnostic score?
- The diagnostic scores Threat Model Currency, Data Classification Enforcement, Incident Response Readiness, PIA Gating, and Security KPI Integration. Each dimension carries written anchors that describe what a low, middle, or high score looks like in practice. Scorers rate each dimension on a 0 to 5 scale against those anchors.
- What is the weight of each dimension in the composite score?
- Each of the five dimensions carries an equal weight of 0.20 in the composite. The weighted sum produces a 0 to 5 score. That composite score then lands in a red, amber, or green band. A red dimension proposes its owning remediation playbook, and amber routes to monitoring.
- What are the three scoring bands and their ranges?
- Red covers 0.0 up to but not including 2.0. Amber covers 2.0 to 3.5 inclusive. Green covers above 3.5 up to and including 5.0. Red proposes a remediation playbook, amber routes to monitoring with 30-day pulse checks, and green holds under quarterly monitoring.
- What happens when a dimension scores in the red band?
- A red dimension proposes the owning remediation playbook for that control area. Safety routes act on the first reading without waiting for confirmation. Other proposals start once leadership confirms them at the next monthly governance review or Core Execution Phase 3 review. A missed outcome escalates to the manager of the owner and the next Core Execution quarter planning agenda.
- How often are module instruments scored?
- Module instruments are scored quarterly, in weeks 11 to 12 of the Core Execution cycle. Measured signals are reviewed at their own cadence. An amber dimension also receives a 30-day pulse check. A color changes only when a score clears the band edge by a margin or holds for two consecutive scorings.
- How does World Consulting Group help an owner take the next step?
- World Consulting Group implements the Cyber, Data Privacy, and Security Diagnostic as part of the VWCG OS, with its four playbooks. The first step of the engagement is a scoring pass of the five dimensions against the written anchors. Red dimensions then propose their owning playbooks, and amber dimensions route to Security Posture Monitoring.
