# How to Run a Cyber Readiness Program for a Small Security Team (90-Day Plan)

> A 90-day cyber readiness plan for a security team of one to five people: baseline, fix and rehearse, then measure and report. With a week-by-week table, who does what, free tools at each step and a quarterly cadence after day 90.

Source: https://playciso.com/blog/cyber-readiness-program-small-security-team-90-day-plan · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

Most readiness advice is written for organisations with a SOC, a GRC team and a budget line for exercises. A security team of one to five people has none of that and the same attackers. The good news: the parts of readiness that matter most (tested backups, MFA where it counts, a practised plan and clear escalation) cost time, not money. This is a 90-day plan that fits alongside a day job, using free tools at every step. ## The 90-day cyber readiness plan PhaseWeeksGoalsDeliverablesFree tools **1. Baseline** (days 1–30)1–2Know where you standNIST CSF 2.0 score; IR readiness score; top-10 gap list[NIST CSF 2.0 assessment](/tools/nist-csf), [IR readiness scorecard](/tools/incident-response-readiness-scorecard), or CISA CSET 3–4Know what matters and who to callCrown-jewel list with owners; one-page IR plan; contact tree including legal, insurer and key vendors[IR Plan Builder](/tools/incident-response-plan-builder), [master IR plan checklist](/tools/master-incident-response-plan-checklist) **2. Fix and rehearse** (days 31–60)5–7Close the five biggest gapsMFA on privileged and remote access; known-exploited vulnerabilities patched; logging on crown jewels; escalation path agreed[Essential Eight assessment](/tools/essential-eight), [cloud logging gap checker](/tools/cloud-logging-gap-checker) 8–9Prove recovery and practise onceRestore test for one critical system; first 60-minute tabletop (ransomware or business email compromise)[restore test policy builder](/tools/backup-restore-test-policy-builder), CISA Tabletop Exercise Packages, [IR Playbook Lab](/tools/ir-playbook-lab) **3. Measure and report** (days 61–90)10–11Make it repeatableMonthly metrics sheet (6–8 metrics); after-action log; second drill[KPI library](/kpi-library), [risk register](/tools/risk-register) 12–13Show progress and ask for what you needRe-score; one-page leadership report; next quarter’s plan[Board Metrics Selection Lab](/tools/board-metrics-lab), [board and governance templates](/templates) ## Days 1–30: how do you baseline readiness quickly? Do not start with a 300-question audit. Spend an hour on two browser self-assessments: the [NIST CSF 2.0 assessment](/tools/nist-csf) for breadth and the [IR readiness scorecard](/tools/incident-response-readiness-scorecard) for depth on response. If you need a government-issued baseline for an insurer or board, CISA’s free CSET or Cyber Resilience Review self-assessment take longer but carry more weight. Then write down the five to ten systems the business cannot run without, who owns each one, and how you would reach them at 2 a.m. That list, plus a one-page plan saying who leads, how severity is set and who decides on notification, is more useful in a real incident than a 60-page plan nobody has read. ## Days 31–60: which gaps should a small team fix first? In most small environments the same five come up, in this order: - MFA on privileged and remote access (admin accounts, VPN, email admin, cloud consoles). - Known-exploited vulnerabilities on internet-facing systems, using CISA’s KEV catalog as the priority list. - Backups that have never been restored. Run one real restore and time it against what the business expects. - Missing logs on the crown-jewel systems, so you can answer “what did they touch?” - Unclear escalation: who can take a system offline, who calls legal and the insurer. Then run your first tabletop. Sixty minutes, one scenario (ransomware or business email compromise are the most likely for small organisations), the people who would really be in the room, and three after-action items with owners. CISA’s free Tabletop Exercise Packages give you a ready scenario; the [Tabletop Facilitation Lab](/tools/tabletop-facilitation-lab) lets you rehearse running one first. ## Days 61–90: what should you measure and report? Pick six to eight metrics you can update in under an hour a month: privileged MFA coverage, KEV items past deadline, last successful restore per critical system, playbooks exercised in 90 days, open after-action items, time to contain in the last drill, and the framework score. Our [monthly readiness metrics guide](/blog/continuous-cyber-readiness-assessment-monthly-metrics) has the full list with cadences. Report on one page: score and trend, top three risks with owners and dates, what the exercise showed and what changed, and one thing you need from leadership. ## Who does what in a three-person team? RoleOwnsTime per week (first 90 days) Security leadThe plan, the metrics, the leadership report, tabletop facilitation3–4 hours Infrastructure / ITMFA, patching, backups and restore tests, logging2–4 hours Analyst or second engineerSelf-assessments, drills, after-action log, risk register2–3 hours Outside the teamLegal, communications and an executive sponsor join each tabletop1 hour per quarter ## What happens after day 90? - Monthly: metrics review (30 minutes) and one 15–30 minute drill, rotating who leads it. - Quarterly: one tabletop, one restore test per critical system, one re-score, one leadership page. - Yearly: a longer exercise with leadership, and a review of the crown-jewel list and plan. For individual practice between drills, the scenario labs in the [incident response hub](/incident-response) and the [War Room](/warroom) give each person a scored incident to work through (the War Room’s first run is free with a free account; Pro is US$5/month or US$40/year as of October 2026). ## What is different from an enterprise readiness program? The steps are the same; the scale is not. Enterprises buy exercise platforms such as Cyberbit or Immersive for team live-fire exercises and benchmarking, and GRC automation for evidence. A small team gets most of the value from free assessments, short exercises and a few well-chosen fixes. When you do need to buy, our [readiness tools comparison](/blog/cyber-readiness-assessment-tools-compared-2026) sets out the options and prices. Honest limits: PlayCISO’s scorecards are self-assessments and its labs are decision simulations. They will not scan your network or validate your controls technically, and there are no VM-based attack ranges. Pair them with your own scanning and the restore tests above. ## What are the common mistakes? - Buying a tool before the baseline. You will buy for the wrong gap. - A 60-page plan nobody has read. One page that people have rehearsed beats it. - Tabletops with only the security team. Legal, communications and an executive make the hardest calls; they need the practice most. - Too many metrics. Twenty numbers with no owners get updated once. - After-action items with no due date. The same gap turns up in the next exercise. ## Small-team readiness checklist - NIST CSF 2.0 and IR readiness baselines recorded with dates. - Crown-jewel list with owners and out-of-hours contacts. - One-page IR plan and contact tree, stored where you can reach it if email is down. - MFA on all privileged and remote access. - KEV-listed vulnerabilities on internet-facing systems patched. - At least one timed restore test per critical system. - One tabletop done, three after-action items owned. - Monthly metrics sheet and quarterly leadership page in place. ## Frequently asked questions ### How do you run a cyber readiness program for a small team? Three 30-day phases (baseline, fix and rehearse, measure and report), then a lighter quarterly cycle, with six to eight metrics and one owner per gap. ### What is a checklist for a continuous readiness program? Metric owners, a monthly review and drill, a quarterly tabletop, re-score and restore tests, an after-action log and a quarterly leadership page. ### What is the difference between enterprise and SMB cyber readiness? Same process, different scale: enterprises add commercial exercise platforms and benchmarking; SMBs rely on free assessments, short exercises and focused fixes. ### How much time does a small-team readiness program take? About two to four hours a week per person for 90 days, then roughly a day a month and a day a quarter. ### What free tools does a small security team need for readiness? A framework self-assessment, an IR readiness scorecard, CISA’s tabletop packages or a scenario lab, a risk register and a metrics sheet. ### How do you report cyber readiness to the board? One page: score and trend, top three risks with owners, what the last exercise changed, and one decision you need.