Set exposure program ownership
Govern exposure scope
On critical path
Define critical services and exposure scope
Govern exposure scope
On critical path
Establish the asset and owner inventory
Establish exposure coverage and evidence
On critical path
Discover the external attack surface
Establish exposure coverage and evidence
Map assessment coverage
Establish exposure coverage and evidence
On critical path
Designate systems of record and evidence contracts
Establish exposure coverage and evidence
On critical path
Enrich findings with exploitation evidence
Establish exposure coverage and evidence
On critical path
Approve risk-based prioritization
Prioritize and reduce material exposure
On critical path
Set remediation deadlines and escalation
Prioritize and reduce material exposure
On critical path
Govern exceptions and compensating controls
Prioritize and reduce material exposure
On critical path
Connect findings to accountable remediation
Prioritize and reduce material exposure
On critical path
Burn down urgent exploitable exposure
Prioritize and reduce material exposure
Identify material exposure chains
Prioritize and reduce material exposure
Retest and verify closure
Prioritize and reduce material exposure
On critical path
Measure coverage, age, and verified reduction
Measure and report exposure reduction
On critical path
Report exposure decisions to leaders
Measure and report exposure reduction
On critical path
Exercise critical-exposure escalation
Prioritize and reduce material exposure
Establish the operating review cadence
Prioritize and reduce material exposure
On critical path