What's newFramework 2.0
What's new in 2.0
How the Human Risk Management Framework 2.0 differs from 1.0.
| Area | 1.0 | 2.0 |
|---|---|---|
| Structure | 16 categories and 481 indicators | Nine risk domains on top, with the 481 indicators as the library beneath them |
| Dimensions | Behavior risk, threat exposure and inherent risk | Threat, Access and Behavior, with every behavior marked risky or vigilant |
| Evidence | Indicators | Four levels: 137 signals, 24 cohorts, 11 sequences and 10 breach scenarios |
| Stages | None | Six stages a person moves through, from Clear to Confirmed |
| Maturity levels | Initial, Managed, Defined, Optimized, Innovating | Comply, Observe, Prioritize, Orchestrate, Preempt, scored over six practices |
| Assessment | No published scoring method | An 18-question assessment, scored practice by practice, with a 90-day plan |
Also new in 2.0
- AI agents and service identities measured as workforce members, each with an owner.
- Breach scenarios tied to Verizon DBIR and VERIS patterns and FBI IC3 categories.
- Mappings to NIST CSF 2.0, MITRE ATT&CK, CIS Controls v8.1, ISO/IEC 27001:2022 and CMMC 2.0.
- The data sources each signal comes from, and what it takes to collect it.
- Playbooks rated Easy, Medium or Hard, so a program can start with quick wins.
- The HRM Benchmark: compare a result with peers by role, company size, industry and region.
See where your program stands on the 2.0 maturity model.
Start the assessment