Practice 03 of 6Scored 1 to 53 questions in the assessment
Act
What changes when risk is found, how fast, and who or what makes the change?
Act is the practice of responding to measured risk: nudges, targeted campaigns, coaching, and playbooks that change controls such as MFA, access, data loss prevention and device trust, for people and for AI agents.
Why it matters
Act, in practice.
Measurement without action is reporting. The program reduces risk when a risky signal changes something: a person learns in the moment, a cohort gets a focused campaign, or a control closes the path an attacker would take. Speed decides the result, because sequences complete in hours.
The five levels
The five levels of Act.
Each level with its criteria, the evidence to ask for and what moves the practice to the next one.
-
Level 1
Comply
The same training and simulations for everyone; no response changes a control.
- Every person completes the same annual training and the same simulation schedule.
- A simulation click triggers a remedial module at most.
- No response changes a control such as MFA, access or data loss prevention.
- There is no agreed time from a risky signal to an action.
Evidence to ask for
The training calendar · The simulation schedule · The rule that runs after a click
What moves you to level 2
- Send a nudge inside 24 hours of a risky action.
- Pick two behaviors that trigger follow-up content.
- Agree a manual MFA reset path with the identity team for confirmed compromise.
-
Level 2
Observe
Nudges and follow-up content after risky actions; control changes by manual request.
- A risky action (a click, weak MFA, an unsanctioned app) triggers a nudge or follow-up content inside a set number of days.
- Control changes such as an MFA reset or an access review are made by manual request, case by case.
- Behavior-triggered content is a measured share of all content delivered.
- Each nudge is logged per person with a timestamp.
Evidence to ask for
The nudge log for the last quarter · The share of behavior-triggered content · The list of manual control requests and their outcome
What moves you to level 3
- Target campaigns at named cohorts and cut the whole-workforce schedule.
- Write the first three playbooks: trigger, audience, action, owner, time limit.
- Agree with the identity team which cohort gets step-up MFA.
-
Level 3
Prioritize
Campaigns target the riskiest cohorts; written playbooks with owners and time limits.
- Campaigns and simulations target named cohorts, and the whole-workforce schedule is smaller than a year ago.
- Playbooks exist as written documents with trigger, audience, action, owner and time limit.
- Time from signal to action is measured per playbook.
- At least one playbook changes a control (step-up MFA, access review, DLP policy) through a manual request.
Evidence to ask for
The playbook documents · The time-to-action report per playbook · The targeting list of the last campaign
What moves you to level 4
- Automate the two highest-volume playbooks end to end.
- Add a playbook that interrupts a sequence with step-up MFA at a named step.
- Add a playbook for sensitive data in AI prompts.
-
Level 4
Orchestrate
Playbooks change controls automatically inside a target time; AI agents paused by playbook.
- Playbooks change controls automatically for defined cohorts: step-up MFA, access removal, DLP policy, device quarantine.
- Median time from signal to action is reported against a target the program set.
- Every automated action is logged with the subject, trigger, action and reversal path.
- An AI agent acting outside its declared scope is paused by a playbook, and its owner is notified.
Evidence to ask for
The automation log for the last month · The median time-to-action report · The reversal list with counts
What moves you to level 5
- Let stage drive standing access: remove privilege at stage 3+ inside a set window and restore it when the stage drops.
- Interrupt the sequences for every priority breach scenario before their final step.
- Set a human review threshold for high-impact automated actions.
-
Level 5
Preempt
Access follows stage; sequences interrupted before the final step; agent lifecycle enforced.
- Standing access rises and falls with a subject’s stage, and stage 3+ people lose standing privilege inside the window the program set.
- Sequences for every priority breach scenario are interrupted before their final step, and the count is reported.
- AI agents follow an approval-to-retirement lifecycle enforced by automation, with owner attestation on a schedule.
- Every automated action has a reversal rule and a human review threshold.
Evidence to ask for
The sequence interruption log · The agent lifecycle report (approved, attested, retired) · The access change audit for stage-driven changes
How to hold level 5
- Review reversal and false-positive rates per playbook each quarter.
- Re-test every playbook in a tabletop exercise each year.
Playbooks
Playbooks for Act (13).
The assessment picks from these for your 90-day roadmap, by your current level. Each playbook is Easy, Medium or Hard; a quick win is an Easy playbook.
Scroll sideways to see every column.
| From level | Playbook | Owner | Weeks | Difficulty | Measure |
|---|---|---|---|---|---|
| 1 | Send a nudge inside 24 hours of a simulation click Replace the remedial module with a short nudge delivered the same day. Timing changes behavior more than length does. | Security awareness lead | 1–3 | Easy | Median hours from click to nudge |
| 1 | Agree a manual MFA reset path with the identity team Write the steps the program follows when a person is confirmed compromised: who requests, who resets, inside what time. The first control change starts as a documented manual request. | Identity team | 5–8 | Medium | Confirmed compromises with MFA reset inside the agreed time |
| 2 | Write the first three playbooks Document trigger, audience, action, owner and time limit for repeat clickers, weak-MFA privileged users and leavers. A written playbook is what gets automated later. | Security awareness lead | 1–4 | Easy | Playbooks written with an owner and a time limit |
| 2 | Target repeat clickers and the Critical cohort Aim simulations and coaching at people who are targeted, click and hold sensitive access, and shrink the whole-workforce schedule. Effort goes where risk concentrates. | Security awareness lead | 5–9 | Medium | Critical cohort as a share of the workforce |
| 2 | Add voice, SMS and QR lures to the simulation mix Run simulations on the channels attackers use beyond email. Per-channel results show where people are untested. | Security awareness lead | 6–11 | Medium | Click rate per channel |
| 3 | Measure time from signal to action per playbook Timestamp each trigger and each completed action, and publish the median per playbook. The median is the number that proves playbooks run. | Security awareness lead | 1–3 | Easy | Median time from signal to action |
| 3 | Automate the two highest-volume playbooks Connect trigger to action for the two playbooks with the most runs, for example step-up MFA for stage 3 people and an access review for leavers. Automation removes the queue between signal and action. | Identity team | 5–13 | Hard | Share of playbook runs completed with no manual step |
| 3 | Add a playbook for sensitive data in AI prompts Trigger coaching and a policy reminder when inspection finds sensitive data in a prompt, and route repeats to the manager. AI use needs a response path like any other risky behavior. | GRC lead | 6–10 | Medium | Sensitive-prompt incidents per 100 people per quarter |
| 4 | Write a reversal rule for every automated action State who can reverse each automated action, how, and inside what time. Reversal is what makes automation acceptable to IT and HR. | CISO | 1–3 | Easy | Automated actions with a documented reversal |
| 4 | Interrupt the phish-to-takeover sequence at step three Trigger step-up MFA and session revocation when a sequence reaches the unusual sign-in step. The sequence ends before persistence. | Identity team | 5–13 | Hard | Sequences interrupted before the final step |
| 4 | Pause out-of-scope AI agents by playbook Alert on agent actions outside the declared scope, pause the agent and notify its owner. A runaway agent needs the same response speed as a compromised account. | SOC | 6–11 | Medium | Out-of-scope agent actions paused inside the target window |
| 5 | Review reversal and false-positive rates each quarter Count reversed actions and complaints per playbook and tune the thresholds. Automation that annoys people loses its mandate. | CISO | 1–4 | Easy | Reversal rate per playbook |
| 5 | Tie standing access to stage Let stage drive entitlement: stage 3+ people lose standing privilege inside the window set, and regain it when the stage drops. Access that follows risk closes the insider and takeover sequences. | Identity team | 5–13 | Hard | Stage 3+ people with standing privilege removed inside the window |
"Act: the practice", Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/maturity-model/act
HRM Maturity Assessment
Where does your program stand?
An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.
- Questions
- 18
- Minutes, about
- 4