Sample report | Incident Response Readiness Assessment

Overall maturity: L2 Orchestrated; Average 1.80 of 4
Priority gaps: 4; Dimensions at Level 1–2
Strengths: 1; Dimensions at Level 3–4
Planned actions: 5; 4 high priority
On target: 0/5; Dimensions at target level
Lowest dimension: L1; Cross-Functional Coordination

Sample Organization (illustrative) · Assessed January 15, 2026 · Next reassessment April 15, 2026

PDF report PowerPoint Plan CSV Download to AI

Current → target by dimension

Filled segments show your current level; dashed segments show the target the plan works toward.

Dimension

1 · Manual2 · Orchestrated3 · Proactive4 · Adaptive

Score → target

Incident Execution & Accountability23

Cross-Functional Coordination12

Regulatory & Legal Readiness23

Documentation & Continuous Improvement12

Training & Operational Readiness34

Strength (Level 3–4)
Gap (Level 1–2)
Target level

Findings — weakest first

Risk of staying at the current level, and the next step toward the target.

Dimension	Current	Risk	Next step
Cross-Functional Coordination “We coordinate through meetings, email, and disconnected communication channels.”	L1 · Manual	Coordinating through meetings, email, and disconnected channels slows approvals and leaves functions unsure what is expected of them.	Write playbooks that assign repeatable actions to security, IT, legal, privacy, communications, and executives. How BreachRx can help (optional): Role-based tasks give every function (legal, privacy, IT, comms, and execs) a defined part in a repeatable response.
Documentation & Continuous Improvement “We maintain incomplete records and reconstruct timelines after the incident.”	L1 · Manual	Incomplete records and after-the-fact timeline reconstruction leave gaps when decisions must be explained to regulators, auditors, or the board.	Centralize incident records so facts, evidence, actions, and decisions are captured in one place. How BreachRx can help (optional): A centralized system of record supports reporting, reviews, exercises, and control improvements.
Incident Execution & Accountability “We define incident owners, severity levels, and governance responsibilities.”	L2 · Orchestrated	Without defined owners and severity tiers, decisions depend on whoever is available and escalations happen late or not at all.	Introduce context-based rules so ownership and escalation adjust automatically with incident type, data involved, and impact. How BreachRx can help (optional): Context-based rules drive ownership and escalation, giving leadership live visibility and control.
Regulatory & Legal Readiness “We document thresholds and coordinate reporting through defined stakeholder workflows.”	L2 · Orchestrated	Manual legal interpretation can miss thresholds or deadlines, increasing regulatory and contractual exposure.	Trigger draft notices automatically from incident facts and the applicable regulatory requirements. How BreachRx can help (optional): Applicable regulatory requirements surface automatically from the incident’s facts, with tailored guidance on what to do next.
Training & Operational Readiness “We continuously test and improve playbooks through realistic cross-functional exercises.”	L3 · Proactive	Static, security-only playbooks that are rarely exercised fail in ways that only surface during a real incident.	Run realistic, on-demand exercise scenarios, including AI-generated scenarios, so teams build muscle memory. How BreachRx can help (optional): Rex AI builds realistic, on-demand exercise scenarios so teams train like they fight and build muscle memory.

Your position on the maturity model

Highlighted cells are your selected answers.

Incident Execution & Accountability
1. L1Security owns the response, with decisions dependent on individual experience.
2. L2Current level: We define incident owners, severity levels, and governance responsibilities.
3. L3We adjust ownership and governance as the incident context changes.
4. L4We use AI to streamline our execution and surface real-time status, decisions, and escalations as the incident evolves.
Cross-Functional Coordination
1. L1Current level: We coordinate through meetings, email, and disconnected communication channels.
2. L2We use playbooks to coordinate repeatable actions across functions.
3. L3We synchronize stakeholders, tasks, approvals, and communications in one system.
4. L4We use AI to orchestrate our response, keeping tasks, actions, approvals, and comms in sync.
Regulatory & Legal Readiness
1. L1We rely on manual legal interpretation and notification processes.
2. L2Current level: We document thresholds and coordinate reporting through defined stakeholder workflows.
3. L3We automatically trigger draft notices from incident facts and regulatory requirements.
4. L4We use AI to map changing facts to obligations and dynamically tailor disclosures.
Documentation & Continuous Improvement
1. L1Current level: We maintain incomplete records and reconstruct timelines after the incident.
2. L2We centralize records to support reviews, exercises, and process improvements.
3. L3We automatically generate timelines, reports, evidence, and decision records.
4. L4We use AI to generate our reports, timelines, and evidence on demand from a living record.
Training & Operational Readiness
1. L1We create static playbooks primarily for the incident response team.
2. L2We create cross-functional playbooks that define responsibilities across the organization.
3. L3Current level: We continuously test and improve playbooks through realistic cross-functional exercises.
4. L4We use AI-generated scenarios to run realistic exercises and build muscle memory.

Cyber incident response management maturity model: five dimensions across four levels
Dimension	Level 1 · Manual	Level 2 · Orchestrated	Level 3 · Proactive	Level 4 · Adaptive
Incident Execution & Accountability	Security owns the response, with decisions dependent on individual experience.	Current level: We define incident owners, severity levels, and governance responsibilities.	We adjust ownership and governance as the incident context changes.	We use AI to streamline our execution and surface real-time status, decisions, and escalations as the incident evolves.
Cross-Functional Coordination	Current level: We coordinate through meetings, email, and disconnected communication channels.	We use playbooks to coordinate repeatable actions across functions.	We synchronize stakeholders, tasks, approvals, and communications in one system.	We use AI to orchestrate our response, keeping tasks, actions, approvals, and comms in sync.
Regulatory & Legal Readiness	We rely on manual legal interpretation and notification processes.	Current level: We document thresholds and coordinate reporting through defined stakeholder workflows.	We automatically trigger draft notices from incident facts and regulatory requirements.	We use AI to map changing facts to obligations and dynamically tailor disclosures.
Documentation & Continuous Improvement	Current level: We maintain incomplete records and reconstruct timelines after the incident.	We centralize records to support reviews, exercises, and process improvements.	We automatically generate timelines, reports, evidence, and decision records.	We use AI to generate our reports, timelines, and evidence on demand from a living record.
Training & Operational Readiness	We create static playbooks primarily for the incident response team.	We create cross-functional playbooks that define responsibilities across the organization.	Current level: We continuously test and improve playbooks through realistic cross-functional exercises.	We use AI-generated scenarios to run realistic exercises and build muscle memory.