Level 3 of 5Aligned to NIST CSF 2.0
Prioritize
NIST CSF 2.0 Implementation Tier: Tier 3 · Repeatable The NIST CSF 2.0 Implementation Tier this level maps to. The crosswalk
Threat, access and behavior are joined per person, and the riskiest cohorts are ranked and targeted first.
-
Level 1
NIST CSF 2.0 Implementation Tier: Tier 1 · Partial
The program meets the training requirement and counts activity: training completion and simulation clicks.
-
Level 2
NIST CSF 2.0 Implementation Tier: Tier 2 · Risk Informed
The program observes behavior across several risk domains and knows who reports.
-
Level 3 · You are here
NIST CSF 2.0 Implementation Tier: Tier 3 · Repeatable
Threat, access and behavior are joined per person, and the riskiest cohorts are ranked and targeted first.
-
Level 4
NIST CSF 2.0 Implementation Tier: Tier 4 · Adaptive
Playbooks orchestrate controls across the stack as risk changes, and the program proves its lift.
-
Level 5
NIST CSF 2.0 Implementation Tier: Beyond Tier 4
AI predicts which attack sequences are forming, and the program acts before the next step, at machine speed, for people and AI agents on one risk model.
Level 3 · Prioritize
What a level 3 program looks like.
The program prioritizes: it joins what reaches a person, what they could expose and what they do, on one record per person. Cohorts that combine the three dimensions are counted and trended, breach scenarios are ranked by the organization’s own incidents, and campaigns target the riskiest cohorts first.
Day to day, the program sees threat, access and behavior signals joined per person on the HR identifier, from four or more risk domains, each signal with a dwell window and a staleness flag. It decides from named cohorts (targeted people who click, risky people with sensitive access, and the Critical cohort that has all three) and from a stage per person, with breach scenarios ranked by the SOC’s own incident counts. It runs targeted campaigns, written playbooks with owners and time limits, and the first control changes by manual request. It reports stage 3+ people per priority breach scenario and cohort sizes against targets to the CISO each quarter. CISO staff own it, with the SOC as a standing partner and a monthly review with IT and HR.
- Typical owner
- CISO staff, with the SOC as partner
- What great looks like
- The Critical cohort (targeted, clicks, holds sensitive access) below the share of the workforce the CISO set as the target, for example 2%.
Headline metrics to track
- 01People at stage 3 or above per priority breach scenario
- 02Critical cohort size
- 03Real-phishing report rate among targeted people
- 04Time from signal to action
Observable criteria
The six practices at level 3.
Criteria a security leader could confirm in a meeting, with the evidence to ask for and what moves each practice up.
- 01
See
Threat, access and behavior joined per person across four or more domains.
- Threat, access and behavior signals are joined per person on one identifier from the HR system.
- Phishing simulation results are joined to real-phishing targeting data per person.
- Signals cover at least four risk domains, including social engineering and identity and access.
- Each signal has a dwell window, and a source silent for more than seven days marks its signals unknown.
Evidence to ask for
A per-person record that shows threat, access and behavior fields side by side · The signal list with source and dwell window per signal · The staleness report for the last 30 days
To level 4
Connect endpoint, web and SaaS, and data sources to reach five or more domains. Move the top sources from monthly extracts to daily feeds. Add breach-exposure data so leaked credentials are known per person. Measure AI tool use per person, including personal-account logins.
- 02
Understand
Cohorts across threat, access and behavior; breach scenarios ranked by own incidents; a stage per person.
- Cohorts that combine threat, access and behavior, for example targeted people who click and hold payment authority, are named, counted and trended.
- Breach scenarios are ranked by the organization’s own incident counts from the last 12 months.
- Each person has a stage from Clear to Confirmed, computed from their active signals.
- The riskiest cohorts are reviewed with the SOC on a fixed cadence.
Evidence to ask for
The cohort list with current size and trend · The breach scenario ranking with SOC incident counts · The stage distribution for the workforce
To level 4
Define sequences (ordered signals inside a window) for the top three breach scenarios. Measure incident lift: the incident rate inside a cohort against the rest of the workforce. Add AI use and AI agent cohorts next to people cohorts.
- 03
Act
Campaigns target the riskiest cohorts; written playbooks with owners and time limits.
- Campaigns and simulations target named cohorts, and the whole-workforce schedule is smaller than a year ago.
- Playbooks exist as written documents with trigger, audience, action, owner and time limit.
- Time from signal to action is measured per playbook.
- At least one playbook changes a control (step-up MFA, access review, DLP policy) through a manual request.
Evidence to ask for
The playbook documents · The time-to-action report per playbook · The targeting list of the last campaign
To level 4
Automate the two highest-volume playbooks end to end. Add a playbook that interrupts a sequence with step-up MFA at a named step. Add a playbook for sensitive data in AI prompts.
- 04
Prove
Stage 3+ per breach scenario and cohort sizes against targets, mapped to the control framework.
- Stage 3+ people per priority breach scenario are reported with a trend.
- Cohort sizes are reported against targets the CISO set.
- Time from signal to action is reported per playbook.
- Program metrics are mapped to NIST CSF 2.0 outcomes or to another framework the organization follows.
Evidence to ask for
The quarterly report with stage and cohort pages · The crosswalk from metrics to framework outcomes
To level 4
Measure incident lift and count avoided incidents. Compute training hours saved by targeting. Add security NPS and perceived friction to the report. Build a one-page executive summary.
- 05
Govern
CISO staff own it; monthly review with SOC, IT and HR; targets; agents have owners.
- Human risk is owned by CISO staff with the SOC as a standing partner.
- A monthly review includes IT, HR and the SOC, and its decisions are recorded.
- Each priority cohort has a target approved by the CISO.
- Policy requires a named human owner for every AI agent and service identity.
Evidence to ask for
Minutes of the last three reviews · The target list · The agent ownership policy
To level 4
Give the review written decision rights over the controls playbooks change. Add Finance and Legal to the forum. Draft the human risk appetite statement.
- 06
Culture
Quarterly pulse; champions in each unit; report rate above click rate; help requests counted.
- A quarterly pulse measures security NPS, perceived friction and confidence, with a participation target.
- Report rate exceeds click rate across the workforce.
- Each business unit has a named security champion with a monthly brief.
- Requests to security before a team builds something are counted per quarter.
Evidence to ask for
The pulse results by team · The champion roster · The request count by quarter
To level 4
Join pulse results to behavior results per team. Measure the gap between self-rated ability and simulation results. Co-create the next policy with employee feedback. Publish role-based AI guidance for developers, finance and customer-facing teams.
Crosswalk
NIST CSF 2.0: Tier 3 · Repeatable
SANS: Level 3 · Promoting Awareness and Behavior Change
Practices are written, repeated on a cadence and reviewed with the SOC, and the organization adjusts when its own incidents change.
The full crosswalk is in the methodology.
"Level 3: Prioritize", Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/maturity-model/level-3
HRM Maturity Assessment
Where does your program stand?
An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.
- Questions
- 18
- Minutes, about
- 4