# Continuous Cyber Readiness Assessment: What to Measure Every Month

> A practical continuous cyber readiness assessment: the 12 metrics to track weekly, monthly and quarterly, an exercise cadence from micro-drills to full simulations, how to prioritise fixes, and free scorecards to re-score your readiness.

Source: https://playciso.com/blog/continuous-cyber-readiness-assessment-monthly-metrics · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

A continuous cyber readiness assessment answers one question on a fixed schedule: **if a serious incident started today, would our people, plans and controls hold up?** An annual audit or pen test answers it once, and the answer goes stale within weeks. The fix is not more tools. It is a short list of measures, re-checked every month, plus regular exercises that test the human side. Two readings of “readiness” are common. This guide is about _cyber_ readiness: being able to detect, respond to and recover from incidents. If you meant _compliance audit_ readiness for SOC 2 or ISO 27001, that is continuous control monitoring; it feeds into readiness but does not replace exercises and recovery tests. ## What metrics should you track for continuous cyber readiness? Twelve metrics across six areas. Set targets that fit your organisation; the examples are starting points, not benchmarks. AreaMetricWhat it tells youCadenceExample target ExposureKnown-exploited vulnerabilities (CISA KEV) open past deadlineWhether attackers’ favourite doors are still openWeeklyZero on internet-facing systems Unknown or unowned internet-facing assetsShadow IT and forgotten servicesWeeklyEach has an owner within 7 days IdentityMFA coverage (all users / privileged / remote access)How easy account takeover isMonthly100% of privileged and remote access Privileged account count and last reviewBlast radius of one stolen adminMonthlyReviewed every 90 days RecoveryLast successful restore test per critical system vs RTOWhether backups actually restore in timeMonthlyEach critical system tested in the last quarter Immutable or offline copy presentWhether ransomware can reach the backupsMonthlyYes for all critical data Detection & responseTime to detect and time to contain (real incidents and drills)Speed of the whole response chainMonthlyTrending down quarter on quarter High-severity alerts triaged within SLAWhether the SOC or on-call keeps upWeeklySet per your SLA PeopleDrill participation and decision scoresWhether people know their partMonthlyEvery IR role drilled each quarter Suspicious-email report rate and time to reportWhether staff act as sensorsMonthlyReport rate rising PlansPlaybooks exercised in the last 90 daysWhether plans are tested or theoreticalMonthlyTop 3 incident types each quarter Open after-action items past dueWhether lessons turn into fixesMonthlyZero older than 60 days For definitions you can copy, see the [security metrics library](/security-metrics) and the role-based [KPI and SLA library](/kpi-library). To choose what goes to the board, practise in the [Board Metrics Selection Lab](/tools/board-metrics-lab). ## How do you measure cyber readiness weekly? Only track what can change in a week: KEV items past deadline, new internet-facing assets, MFA gaps on privileged accounts, failed backup jobs, and open high-severity incidents or after-action items. Five numbers, one owner each, fifteen minutes in an existing meeting. Framework scores and exercise results belong in the monthly and quarterly reviews. ## How often should you run readiness exercises? ExerciseLengthCadenceWhoWhat it tests Micro-drill (one inject, one decision)15–30 minMonthlyOn-call, SOC, IR leadFirst-hour actions: triage, escalation, containment call Scenario lab or simulation30–60 minMonthly per personAnalysts, managersDecisions with consequences across a whole incident Tabletop exercise60–120 minQuarterlyIR team, legal, comms, execsRoles, notification decisions, communications Restore testVariesQuarterly per critical systemIT, system ownersRecovery time against RTO Functional or full-scale exerciseHalf day or moreYearlyEveryone with an IR roleThe full plan end to end Free ways to run these: the [IR Playbook Lab](/tools/ir-playbook-lab) and the scenario labs in the [incident response hub](/incident-response) for monthly practice, the [Tabletop Facilitation Lab](/tools/tabletop-facilitation-lab) to rehearse a board tabletop, CISA’s free Tabletop Exercise Packages for ready-made scenarios, and the [War Room](/warroom) for a branching, scored incident (the first run is free with a free account). ## Which assessments should you re-score each quarter? - NIST CSF 2.0 self-assessment: maturity across Govern, Identify, Protect, Detect, Respond and Recover, with a red/amber/green result. - Incident Response Readiness Scorecard: 14 areas covering the master plan, 12 playbooks and supporting policies. - Ransomware Readiness Scorecard: seven weighted dimensions to a 0–100 score with prioritised gaps. - Essential Eight maturity assessment: an ML0–ML3 estimate across the eight ASD strategies. - SOC maturity assessment: the five SOC-CMM domains (Business, People, Process, Technology, Services). - Vulnerability management maturity checklist and the CSPM readiness scorecard for cloud. All run in the browser with no signup. Re-score with the same people each quarter, or the trend is noise, and keep the exported results with the date so you can show the trend to leadership and auditors. ## How do you prioritise fixes from continuous assessments? - Exploited: is it in CISA’s Known Exploited Vulnerabilities catalog, or being used against your sector now? - Exposed: is it reachable from the internet or from a likely foothold such as a phished laptop? - Impact: does it touch a crown-jewel system or the backups? - Effort: can it be fixed this week, or does it need a project? Exploited and exposed gets fixed this week. Everything else is scheduled with an owner. What you decide not to fix goes in the [risk register](/tools/risk-register) as an accepted risk, with a review date. ## Monthly readiness review checklist - Twelve metrics updated, each with an owner and a trend arrow. - One micro-drill run and scored this month. - After-action items reviewed; anything older than 60 days escalated. - Restore tests on schedule for critical systems. - New assets, vendors and privileged accounts reviewed. - Next quarter’s tabletop scenario chosen from the top risks. - One-page summary sent to leadership. ## What tools are worth paying for? Automated sources (vulnerability scanners, attack surface monitoring, cloud posture and GRC automation) save time on the exposure and control metrics. Enterprise exercise platforms such as Cyberbit and Immersive cover live-fire and crisis simulation at scale. We compare free and commercial options, with prices where vendors publish them, in [Cyber readiness assessment tools compared](/blog/cyber-readiness-assessment-tools-compared-2026). For a small team, the [90-day readiness plan](/blog/cyber-readiness-program-small-security-team-90-day-plan) shows how far free tools go. Honest limits: PlayCISO’s scorecards are self-assessments and its labs are decision simulations. They do not scan your network, validate controls technically or replace a live-fire range. Use them for the human and planning side, alongside your technical sources. ## Frequently asked questions ### What metrics should you track in continuous cyber readiness? Exposure, identity, recovery, detection and response, people and plans: twelve measures in total, each with an owner and a cadence, as in the table above. ### How do you measure cyber readiness weekly? Track only what moves in a week: KEV items past deadline, new internet-facing assets, privileged MFA gaps, failed backups and open high-severity items. ### What should a checklist for a continuous readiness program include? Metric owners, a monthly review, a monthly micro-drill, a quarterly tabletop and re-score, quarterly restore tests, an after-action log and a one-page leadership report. ### How do you prioritise fixes from continuous assessments? Exploited first, then exposed, then business impact, then effort. Record accepted risks with a review date. ### What can I use for always-on security assessment? Automated scanning and posture tools for the technical side, plus drills, tabletops and quarterly self-assessments (CISA CSET, CISA CRR, NIST CSF 2.0, PlayCISO scorecards) for the human side. ### Is continuous cyber readiness the same as continuous control monitoring? No. Control monitoring checks controls and evidence; readiness also tests whether people and plans work under pressure.