Level 4 of 5Aligned to NIST CSF 2.0
Orchestrate
NIST CSF 2.0 Implementation Tier: Tier 4 · Adaptive The NIST CSF 2.0 Implementation Tier this level maps to. The crosswalk
Playbooks orchestrate controls across the stack as risk changes, and the program proves its lift.
-
Level 1
NIST CSF 2.0 Implementation Tier: Tier 1 · Partial
The program meets the training requirement and counts activity: training completion and simulation clicks.
-
Level 2
NIST CSF 2.0 Implementation Tier: Tier 2 · Risk Informed
The program observes behavior across several risk domains and knows who reports.
-
Level 3
NIST CSF 2.0 Implementation Tier: Tier 3 · Repeatable
Threat, access and behavior are joined per person, and the riskiest cohorts are ranked and targeted first.
-
Level 4 · You are here
NIST CSF 2.0 Implementation Tier: Tier 4 · Adaptive
Playbooks orchestrate controls across the stack as risk changes, and the program proves its lift.
-
Level 5
NIST CSF 2.0 Implementation Tier: Beyond Tier 4
AI predicts which attack sequences are forming, and the program acts before the next step, at machine speed, for people and AI agents on one risk model.
Level 4 · Orchestrate
What a level 4 program looks like.
The program orchestrates controls from risk. Signal sequences across five or more risk domains are watched daily, incident lift shows which patterns matter here, and automated playbooks change MFA, access and data controls for defined cohorts. The program reports avoided loss and the lift of its own actions.
Day to day, the program sees daily signals from five or more risk domains, detects sequences inside their windows, measures AI tool use per person, and holds an inventory of AI agents with named owners. It decides from incident lift: patterns that raise the incident rate stay, and patterns with no lift are retired. Playbooks change controls automatically (step-up MFA, access removal, DLP policy, device quarantine, agent pause) with a logged reversal path, and median time from signal to action is tracked against a target. It reports incident lift, avoided loss, training hours saved and perceived friction each quarter. The CISO owns it through an executive forum with IT, HR and Finance that holds decision rights over the controls.
- Typical owner
- CISO, with IT, HR and Finance
- What great looks like
- Median time from signal to automated action inside the target the forum set, for example 24 hours, for every active playbook.
Headline metrics to track
- 01Incident lift of top patterns
- 02Sequences interrupted before the final step
- 03Security NPS and perceived friction rate
- 04Training hours saved by targeting
Observable criteria
The six practices at level 4.
Criteria a security leader could confirm in a meeting, with the evidence to ask for and what moves each practice up.
- 01
See
Daily signals from five or more domains, sequences detected, AI use and AI agents in view.
- Signals from five or more risk domains refresh at least daily.
- Ordered signal sequences, for example real phish delivered, link clicked, new MFA device inside 72 hours, are detected inside their window.
- AI tool use per person is measured, split by corporate and personal accounts.
- AI agents and service identities are inventoried with a named human owner and their scopes.
Evidence to ask for
The sequence detection list with window and last firing date · The AI use report by team · The agent inventory with owner, scopes and last attestation date
To level 5
Put people, AI agents and vendor accounts on one subject record with the same fields. Tie vendor breaches to the people whose accounts are exposed. Report signal freshness as a key risk indicator with a target. Publish the list of signals no source measures, with a target date for each.
- 02
Understand
Incident lift validates patterns; sequences detected and routed; AI cohorts ranked with people.
- Incident lift is measured for each cohort and sequence: the incident rate inside against the rest of the workforce.
- Cohorts and sequences with no lift after two quarters are retired, and new ones are proposed from incident reviews.
- A detected sequence is routed to the SOC with the person’s context inside its window.
- AI use and AI agent cohorts are ranked alongside people cohorts.
Evidence to ask for
The lift table for the last four quarters · The sequence detection log · The list of retired and new cohorts with reasons
To level 5
Forecast next quarter’s stage 3+ population per priority breach scenario and record the forecast error. Agree a loss estimate per priority breach scenario with finance. Score AI agents on the same stages as people.
- 03
Act
Playbooks change controls automatically inside a target time; AI agents paused by playbook.
- Playbooks change controls automatically for defined cohorts: step-up MFA, access removal, DLP policy, device quarantine.
- Median time from signal to action is reported against a target the program set.
- Every automated action is logged with the subject, trigger, action and reversal path.
- An AI agent acting outside its declared scope is paused by a playbook, and its owner is notified.
Evidence to ask for
The automation log for the last month · The median time-to-action report · The reversal list with counts
To level 5
Let stage drive standing access: remove privilege at stage 3+ inside a set window and restore it when the stage drops. Interrupt the sequences for every priority breach scenario before their final step. Set a human review threshold for high-impact automated actions.
- 04
Prove
Incident lift, avoided loss and training hours saved each quarter.
- Incident lift of the top patterns is reported each quarter.
- Avoided loss is estimated with a method finance agreed to, and the method is published with the number.
- Training hours saved by targeting are reported.
- Security NPS and perceived friction rate are reported against targets.
Evidence to ask for
The quarterly executive report · The avoided-loss method sign-off from finance · The lift table
To level 5
Define board key risk indicators with a threshold tied to risk appetite. Report human risk reduction over 6, 12 and 24 months. Have internal audit review the measurement method.
- 05
Govern
An executive forum with decision rights; a risk appetite statement; privacy review on file.
- A named executive forum (CISO with IT, HR and Finance) holds decision rights over the controls that playbooks change.
- A human risk appetite statement exists and is reviewed each year.
- Each automated action has a privacy review on file, including works-council or employee notice where required.
- The AI agent lifecycle (approval, scope, attestation, retirement) is policy with a named owner.
Evidence to ask for
The forum’s terms of reference · The risk appetite statement · The privacy review file
To level 5
Name a board member or committee as owner of the human risk KRIs. Put security outcomes in executive performance reviews. Commission an annual independent review of the model and its automation.
- 06
Culture
Sentiment joined to behavior per team; policies co-created; AI guidance by role.
- Pulse results are joined to behavior results per team, so teams with high friction and low reporting are visible.
- Policies are co-created with employee feedback, and the count is tracked.
- Role-based guidance for AI use exists for developers, finance and customer-facing teams, with output checking measured in the pulse.
- Targeted people report real phishing inside the time target the program set.
Evidence to ask for
The friction-by-team view next to reporting · The co-created policy list · The role-based AI guidance pages · Median time to first report of real phishing
To level 5
Add security NPS, friction and time to report as board KRIs with thresholds. Report executives their own security behaviors each quarter. Measure AI agent owners on agent hygiene like any other behavior.
Crosswalk
NIST CSF 2.0: Tier 4 · Adaptive
SANS: Level 4 · Long Term Culture Change
The program adapts controls from its own lessons and from leading indicators, and the organization funds it as part of its risk management.
The full crosswalk is in the methodology.
"Level 4: Orchestrate", Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/maturity-model/level-4
HRM Maturity Assessment
Where does your program stand?
An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.
- Questions
- 18
- Minutes, about
- 4