# CIRM Readiness: customize my results

You are an experienced incident response and crisis communications advisor. Below are the results of an
Cyber Incident Response Management (CIRM) Readiness assessment, scored against the BreachRx CIRM Maturity Model
(Level 1 Manual, Level 2 Orchestrated, Level 3 Proactive, Level 4 Adaptive), plus a generic 90-day plan.

Your task:
1. Ask me any clarifying questions you need about the company context below before giving advice.
2. Tailor the findings and 90-day plan to my specific situation: size, industry, regulators, existing tools,
   team structure and budget. Remove actions that do not apply and add any that are missing.
3. Assign realistic owners and dates, and flag dependencies between actions.
4. Draft a short executive summary (under 200 words) I can share with leadership.
5. Keep recommendations vendor-neutral unless I ask otherwise. Do not present this as legal advice.

## My company context (edit before sending)

- Organization: [fill in]
- Industry: Financial Services
- Employees / regions: [fill in]
- Key regulators and notification obligations: [fill in]
- Primary collaboration tools (e.g. M365, Google Workspace, Slack): [fill in]
- Incident response team structure and outside counsel/IR retainer: [fill in]
- Known constraints (budget, headcount, recent incidents, audits): [fill in]

## Assessment results

- Assessed: January 15, 2026
- Overall maturity: Level 2 (Orchestrated), average 1.80 of 4
- Dimensions on target: 0 of 5

| Dimension | Current | Target |
| --- | --- | --- |
| Incident Execution & Accountability | L2 Orchestrated | L3 |
| Cross-Functional Coordination | L1 Manual | L2 |
| Regulatory & Legal Readiness | L2 Orchestrated | L3 |
| Documentation & Continuous Improvement | L1 Manual | L2 |
| Training & Operational Readiness | L3 Proactive | L4 |

## Findings (weakest first)

### Cross-Functional Coordination (Level 1 Manual, target Level 2)
- Selected statement: "We coordinate through meetings, email, and disconnected communication channels."
- Risk: Coordinating through meetings, email, and disconnected channels slows approvals and leaves functions unsure what is expected of them.
- Next step: Write playbooks that assign repeatable actions to security, IT, legal, privacy, communications, and executives.

### Documentation & Continuous Improvement (Level 1 Manual, target Level 2)
- Selected statement: "We maintain incomplete records and reconstruct timelines after the incident."
- Risk: Incomplete records and after-the-fact timeline reconstruction leave gaps when decisions must be explained to regulators, auditors, or the board.
- Next step: Centralize incident records so facts, evidence, actions, and decisions are captured in one place.

### Incident Execution & Accountability (Level 2 Orchestrated, target Level 3)
- Selected statement: "We define incident owners, severity levels, and governance responsibilities."
- Risk: Without defined owners and severity tiers, decisions depend on whoever is available and escalations happen late or not at all.
- Next step: Introduce context-based rules so ownership and escalation adjust automatically with incident type, data involved, and impact.

### Regulatory & Legal Readiness (Level 2 Orchestrated, target Level 3)
- Selected statement: "We document thresholds and coordinate reporting through defined stakeholder workflows."
- Risk: Manual legal interpretation can miss thresholds or deadlines, increasing regulatory and contractual exposure.
- Next step: Trigger draft notices automatically from incident facts and the applicable regulatory requirements.

### Training & Operational Readiness (Level 3 Proactive, target Level 4)
- Selected statement: "We continuously test and improve playbooks through realistic cross-functional exercises."
- Risk: Static, security-only playbooks that are rarely exercised fail in ways that only surface during a real incident.
- Next step: Run realistic, on-demand exercise scenarios, including AI-generated scenarios, so teams build muscle memory.

## Current 90-day plan

### Days 1–30: Establish incident ownership, severity, and cross-functional responsibilities; set owners and measures.
- [Cross-Functional Coordination] Write playbooks that assign repeatable actions to security, IT, legal, privacy, communications, and executives. (High, owner: Incident Response Lead, due: 2026-02-14)
  - Deliverable: Cross-functional playbooks with role-based task lists for priority incident types.
- [Documentation & Continuous Improvement] Centralize incident records so facts, evidence, actions, and decisions are captured in one place. (High, owner: Incident Response Lead with Legal, due: 2026-02-14)
  - Deliverable: Incident record standard and central repository with capture templates.
- [Incident Execution & Accountability] Introduce context-based rules so ownership and escalation adjust automatically with incident type, data involved, and impact. (High, owner: CISO / Incident Response Lead, due: 2026-02-14)
  - Deliverable: Escalation rule set tied to incident context with defined escalation SLAs.

### Days 31–60: Map regulatory obligations and stand up a single system of record for the response.
- [Regulatory & Legal Readiness] Trigger draft notices automatically from incident facts and the applicable regulatory requirements. (High, owner: General Counsel / Privacy Counsel, due: 2026-03-16)
  - Deliverable: Notification decision workflow with templated draft notices per regulation.

### Days 61–90: Run a cross-functional exercise, measure outcomes, and feed findings back into playbooks.
- [Training & Operational Readiness] Run realistic, on-demand exercise scenarios, including AI-generated scenarios, so teams build muscle memory. (Medium, owner: Incident Response Lead / Exercise Coordinator, due: 2026-04-15)
  - Deliverable: On-demand scenario library with participation and outcome tracking.

## Executive asks

- Require each function to name primary and backup responders.
- Designate the authoritative incident system of record.
- Agree escalation SLAs and the leadership audience for each severity.
- Approve notification templates and the sign-off chain for disclosures.

---
Results are self-reported planning guidance, not legal advice. Review any output before sharing it.