Continuous Cyber Readiness Assessment: What to Measure Every Month
Continuous cyber readiness assessment means re-measuring on a fixed schedule whether your people, plans and controls would hold up in a real incident, instead of relying on one annual audit or pen test. Track a short list every month: exposure (critical vulnerabilities past their fix deadline, especially those in CISA’s Known Exploited Vulnerabilities catalog), identity (MFA coverage, number of privileged accounts), recovery (date of the last successful restore test against your recovery time objective), detection and response (time to detect and contain, from real incidents and drills), people (drill participation and decision scores, suspicious-email report rate) and plans (playbooks exercised in the last 90 days). Run a 15–30 minute micro-drill every month, a tabletop every quarter and a larger exercise once a year, and re-score a framework self-assessment such as NIST CSF 2.0 or the Essential Eight each quarter. If you meant compliance audit readiness for SOC 2 or ISO 27001, that is continuous control monitoring, usually done with GRC automation tools; it is one input, not the whole picture.
A continuous cyber readiness assessment answers one question on a fixed schedule: if a serious incident started today, would our people, plans and controls hold up? An annual audit or pen test answers it once, and the answer goes stale within weeks. The fix is not more tools. It is a short list of measures, re-checked every month, plus regular exercises that test the human side.
Two readings of “readiness” are common. This guide is about cyber readiness: being able to detect, respond to and recover from incidents. If you meant compliance audit readiness for SOC 2 or ISO 27001, that is continuous control monitoring; it feeds into readiness but does not replace exercises and recovery tests.
What metrics should you track for continuous cyber readiness?
Twelve metrics across six areas. Set targets that fit your organisation; the examples are starting points, not benchmarks.
| Area | Metric | What it tells you | Cadence | Example target |
|---|---|---|---|---|
| Exposure | Known-exploited vulnerabilities (CISA KEV) open past deadline | Whether attackers’ favourite doors are still open | Weekly | Zero on internet-facing systems |
| Unknown or unowned internet-facing assets | Shadow IT and forgotten services | Weekly | Each has an owner within 7 days | |
| Identity | MFA coverage (all users / privileged / remote access) | How easy account takeover is | Monthly | 100% of privileged and remote access |
| Privileged account count and last review | Blast radius of one stolen admin | Monthly | Reviewed every 90 days | |
| Recovery | Last successful restore test per critical system vs RTO | Whether backups actually restore in time | Monthly | Each critical system tested in the last quarter |
| Immutable or offline copy present | Whether ransomware can reach the backups | Monthly | Yes for all critical data | |
| Detection & response | Time to detect and time to contain (real incidents and drills) | Speed of the whole response chain | Monthly | Trending down quarter on quarter |
| High-severity alerts triaged within SLA | Whether the SOC or on-call keeps up | Weekly | Set per your SLA | |
| People | Drill participation and decision scores | Whether people know their part | Monthly | Every IR role drilled each quarter |
| Suspicious-email report rate and time to report | Whether staff act as sensors | Monthly | Report rate rising | |
| Plans | Playbooks exercised in the last 90 days | Whether plans are tested or theoretical | Monthly | Top 3 incident types each quarter |
| Open after-action items past due | Whether lessons turn into fixes | Monthly | Zero older than 60 days |
For definitions you can copy, see the security metrics library and the role-based KPI and SLA library. To choose what goes to the board, practise in the Board Metrics Selection Lab.
How do you measure cyber readiness weekly?
Only track what can change in a week: KEV items past deadline, new internet-facing assets, MFA gaps on privileged accounts, failed backup jobs, and open high-severity incidents or after-action items. Five numbers, one owner each, fifteen minutes in an existing meeting. Framework scores and exercise results belong in the monthly and quarterly reviews.
How often should you run readiness exercises?
| Exercise | Length | Cadence | Who | What it tests |
|---|---|---|---|---|
| Micro-drill (one inject, one decision) | 15–30 min | Monthly | On-call, SOC, IR lead | First-hour actions: triage, escalation, containment call |
| Scenario lab or simulation | 30–60 min | Monthly per person | Analysts, managers | Decisions with consequences across a whole incident |
| Tabletop exercise | 60–120 min | Quarterly | IR team, legal, comms, execs | Roles, notification decisions, communications |
| Restore test | Varies | Quarterly per critical system | IT, system owners | Recovery time against RTO |
| Functional or full-scale exercise | Half day or more | Yearly | Everyone with an IR role | The full plan end to end |
Free ways to run these: the IR Playbook Lab and the scenario labs in the incident response hub for monthly practice, the Tabletop Facilitation Lab to rehearse a board tabletop, CISA’s free Tabletop Exercise Packages for ready-made scenarios, and the War Room for a branching, scored incident (the first run is free with a free account).
Which assessments should you re-score each quarter?
- NIST CSF 2.0 self-assessment: maturity across Govern, Identify, Protect, Detect, Respond and Recover, with a red/amber/green result.
- Incident Response Readiness Scorecard: 14 areas covering the master plan, 12 playbooks and supporting policies.
- Ransomware Readiness Scorecard: seven weighted dimensions to a 0–100 score with prioritised gaps.
- Essential Eight maturity assessment: an ML0–ML3 estimate across the eight ASD strategies.
- SOC maturity assessment: the five SOC-CMM domains (Business, People, Process, Technology, Services).
- Vulnerability management maturity checklist and the CSPM readiness scorecard for cloud.
All run in the browser with no signup. Re-score with the same people each quarter, or the trend is noise, and keep the exported results with the date so you can show the trend to leadership and auditors.
How do you prioritise fixes from continuous assessments?
- Exploited: is it in CISA’s Known Exploited Vulnerabilities catalog, or being used against your sector now?
- Exposed: is it reachable from the internet or from a likely foothold such as a phished laptop?
- Impact: does it touch a crown-jewel system or the backups?
- Effort: can it be fixed this week, or does it need a project?
Exploited and exposed gets fixed this week. Everything else is scheduled with an owner. What you decide not to fix goes in the risk register as an accepted risk, with a review date.
Monthly readiness review checklist
- Twelve metrics updated, each with an owner and a trend arrow.
- One micro-drill run and scored this month.
- After-action items reviewed; anything older than 60 days escalated.
- Restore tests on schedule for critical systems.
- New assets, vendors and privileged accounts reviewed.
- Next quarter’s tabletop scenario chosen from the top risks.
- One-page summary sent to leadership.
What tools are worth paying for?
Automated sources (vulnerability scanners, attack surface monitoring, cloud posture and GRC automation) save time on the exposure and control metrics. Enterprise exercise platforms such as Cyberbit and Immersive cover live-fire and crisis simulation at scale. We compare free and commercial options, with prices where vendors publish them, in Cyber readiness assessment tools compared. For a small team, the 90-day readiness plan shows how far free tools go.
Honest limits: PlayCISO’s scorecards are self-assessments and its labs are decision simulations. They do not scan your network, validate controls technically or replace a live-fire range. Use them for the human and planning side, alongside your technical sources.
Frequently asked questions
What metrics should you track in continuous cyber readiness?
Exposure, identity, recovery, detection and response, people and plans: twelve measures in total, each with an owner and a cadence, as in the table above.
How do you measure cyber readiness weekly?
Track only what moves in a week: KEV items past deadline, new internet-facing assets, privileged MFA gaps, failed backups and open high-severity items.
What should a checklist for a continuous readiness program include?
Metric owners, a monthly review, a monthly micro-drill, a quarterly tabletop and re-score, quarterly restore tests, an after-action log and a one-page leadership report.
How do you prioritise fixes from continuous assessments?
Exploited first, then exposed, then business impact, then effort. Record accepted risks with a review date.
What can I use for always-on security assessment?
Automated scanning and posture tools for the technical side, plus drills, tabletops and quarterly self-assessments (CISA CSET, CISA CRR, NIST CSF 2.0, PlayCISO scorecards) for the human side.
Is continuous cyber readiness the same as continuous control monitoring?
No. Control monitoring checks controls and evidence; readiness also tests whether people and plans work under pressure.
Ready to practise the decisions these articles describe?
Run your first War Room free →One run free with a free account · more runs with Pro