How to Run a Cyber Readiness Program for a Small Security Team (90-Day Plan)
A security team of one to five people can run a real cyber readiness program in 90 days with free tools and about two to four hours a week per person. Days 1–30, baseline: score yourself against NIST CSF 2.0 and your incident response readiness, list your crown-jewel systems and their owners, and write a one-page incident plan with a contact tree. Days 31–60, fix and rehearse: close the five biggest gaps (usually MFA on privileged and remote access, known-exploited vulnerabilities, untested backups, missing logs and unclear escalation), run a restore test and a first 60-minute tabletop on ransomware or business email compromise. Days 61–90, measure and report: start a monthly metrics sheet, run a second drill, re-score, and send leadership a one-page readiness report. After that, repeat quarterly: one tabletop, one re-score and one restore test per quarter, and a short drill every month. Free resources that cover most of it: CISA’s CSET and tabletop exercise packages, NIST CSF 2.0 quick-start guides, and PlayCISO’s browser scorecards and scenario labs.
Most readiness advice is written for organisations with a SOC, a GRC team and a budget line for exercises. A security team of one to five people has none of that and the same attackers. The good news: the parts of readiness that matter most (tested backups, MFA where it counts, a practised plan and clear escalation) cost time, not money. This is a 90-day plan that fits alongside a day job, using free tools at every step.
The 90-day cyber readiness plan
| Phase | Weeks | Goals | Deliverables | Free tools |
|---|---|---|---|---|
| 1. Baseline (days 1–30) | 1–2 | Know where you stand | NIST CSF 2.0 score; IR readiness score; top-10 gap list | NIST CSF 2.0 assessment, IR readiness scorecard, or CISA CSET |
| 3–4 | Know what matters and who to call | Crown-jewel list with owners; one-page IR plan; contact tree including legal, insurer and key vendors | IR Plan Builder, master IR plan checklist | |
| 2. Fix and rehearse (days 31–60) | 5–7 | Close the five biggest gaps | MFA on privileged and remote access; known-exploited vulnerabilities patched; logging on crown jewels; escalation path agreed | Essential Eight assessment, cloud logging gap checker |
| 8–9 | Prove recovery and practise once | Restore test for one critical system; first 60-minute tabletop (ransomware or business email compromise) | restore test policy builder, CISA Tabletop Exercise Packages, IR Playbook Lab | |
| 3. Measure and report (days 61–90) | 10–11 | Make it repeatable | Monthly metrics sheet (6–8 metrics); after-action log; second drill | KPI library, risk register |
| 12–13 | Show progress and ask for what you need | Re-score; one-page leadership report; next quarter’s plan | Board Metrics Selection Lab, board and governance templates |
Days 1–30: how do you baseline readiness quickly?
Do not start with a 300-question audit. Spend an hour on two browser self-assessments: the NIST CSF 2.0 assessment for breadth and the IR readiness scorecard for depth on response. If you need a government-issued baseline for an insurer or board, CISA’s free CSET or Cyber Resilience Review self-assessment take longer but carry more weight.
Then write down the five to ten systems the business cannot run without, who owns each one, and how you would reach them at 2 a.m. That list, plus a one-page plan saying who leads, how severity is set and who decides on notification, is more useful in a real incident than a 60-page plan nobody has read.
Days 31–60: which gaps should a small team fix first?
In most small environments the same five come up, in this order:
- MFA on privileged and remote access (admin accounts, VPN, email admin, cloud consoles).
- Known-exploited vulnerabilities on internet-facing systems, using CISA’s KEV catalog as the priority list.
- Backups that have never been restored. Run one real restore and time it against what the business expects.
- Missing logs on the crown-jewel systems, so you can answer “what did they touch?”
- Unclear escalation: who can take a system offline, who calls legal and the insurer.
Then run your first tabletop. Sixty minutes, one scenario (ransomware or business email compromise are the most likely for small organisations), the people who would really be in the room, and three after-action items with owners. CISA’s free Tabletop Exercise Packages give you a ready scenario; the Tabletop Facilitation Lab lets you rehearse running one first.
Days 61–90: what should you measure and report?
Pick six to eight metrics you can update in under an hour a month: privileged MFA coverage, KEV items past deadline, last successful restore per critical system, playbooks exercised in 90 days, open after-action items, time to contain in the last drill, and the framework score. Our monthly readiness metrics guide has the full list with cadences.
Report on one page: score and trend, top three risks with owners and dates, what the exercise showed and what changed, and one thing you need from leadership.
Who does what in a three-person team?
| Role | Owns | Time per week (first 90 days) |
|---|---|---|
| Security lead | The plan, the metrics, the leadership report, tabletop facilitation | 3–4 hours |
| Infrastructure / IT | MFA, patching, backups and restore tests, logging | 2–4 hours |
| Analyst or second engineer | Self-assessments, drills, after-action log, risk register | 2–3 hours |
| Outside the team | Legal, communications and an executive sponsor join each tabletop | 1 hour per quarter |
What happens after day 90?
- Monthly: metrics review (30 minutes) and one 15–30 minute drill, rotating who leads it.
- Quarterly: one tabletop, one restore test per critical system, one re-score, one leadership page.
- Yearly: a longer exercise with leadership, and a review of the crown-jewel list and plan.
For individual practice between drills, the scenario labs in the incident response hub and the War Room give each person a scored incident to work through (the War Room’s first run is free with a free account; Pro is US$5/month or US$40/year as of October 2026).
What is different from an enterprise readiness program?
The steps are the same; the scale is not. Enterprises buy exercise platforms such as Cyberbit or Immersive for team live-fire exercises and benchmarking, and GRC automation for evidence. A small team gets most of the value from free assessments, short exercises and a few well-chosen fixes. When you do need to buy, our readiness tools comparison sets out the options and prices.
Honest limits: PlayCISO’s scorecards are self-assessments and its labs are decision simulations. They will not scan your network or validate your controls technically, and there are no VM-based attack ranges. Pair them with your own scanning and the restore tests above.
What are the common mistakes?
- Buying a tool before the baseline. You will buy for the wrong gap.
- A 60-page plan nobody has read. One page that people have rehearsed beats it.
- Tabletops with only the security team. Legal, communications and an executive make the hardest calls; they need the practice most.
- Too many metrics. Twenty numbers with no owners get updated once.
- After-action items with no due date. The same gap turns up in the next exercise.
Small-team readiness checklist
- NIST CSF 2.0 and IR readiness baselines recorded with dates.
- Crown-jewel list with owners and out-of-hours contacts.
- One-page IR plan and contact tree, stored where you can reach it if email is down.
- MFA on all privileged and remote access.
- KEV-listed vulnerabilities on internet-facing systems patched.
- At least one timed restore test per critical system.
- One tabletop done, three after-action items owned.
- Monthly metrics sheet and quarterly leadership page in place.
Frequently asked questions
How do you run a cyber readiness program for a small team?
Three 30-day phases (baseline, fix and rehearse, measure and report), then a lighter quarterly cycle, with six to eight metrics and one owner per gap.
What is a checklist for a continuous readiness program?
Metric owners, a monthly review and drill, a quarterly tabletop, re-score and restore tests, an after-action log and a quarterly leadership page.
What is the difference between enterprise and SMB cyber readiness?
Same process, different scale: enterprises add commercial exercise platforms and benchmarking; SMBs rely on free assessments, short exercises and focused fixes.
How much time does a small-team readiness program take?
About two to four hours a week per person for 90 days, then roughly a day a month and a day a quarter.
What free tools does a small security team need for readiness?
A framework self-assessment, an IR readiness scorecard, CISA’s tabletop packages or a scenario lab, a risk register and a metrics sheet.
How do you report cyber readiness to the board?
One page: score and trend, top three risks with owners, what the last exercise changed, and one decision you need.
Ready to practise the decisions these articles describe?
Run your first War Room free →One run free with a free account · more runs with Pro