How to Use This Benchmark¶

This page guides practitioners through using Nexus SecOps for self-assessment, team training, or formal audit preparation.

Assessment Workflow¶

flowchart TD
    A[1. Define Scope] --> B[2. Assemble Team]
    B --> C[3. Review Maturity Model]
    C --> D[4. Complete Self-Assessment]
    D --> E[5. Gather Evidence]
    E --> F[6. Score Controls]
    F --> G[7. Calculate Domain Scores]
    G --> H[8. Document Findings]
    H --> I[9. Prioritize Gaps]
    I --> J[10. Build Remediation Roadmap]
    J --> K[11. Execute Improvements]
    K --> L{Reassess in 6-12 mo}
    L --> D

Step 1 — Define Scope¶

Step 2 — Assemble Assessment Team¶

Step 3 — Calibrate Using the Maturity Model¶

Read Maturity Model before scoring. Calibration prevents score inflation.

Step 4 — Work Through the Self-Assessment Workbook¶

Open self-assessment.md or the CSV version.

For each control:

1. Read the Control Statement — the normative requirement.
2. Evaluate Current State — what is your organization actually doing?
3. Assign Current Score (0–5).
4. Assign Target Score based on risk appetite.
5. Note Evidence Available (Yes / Partial / No).
6. Add Notes explaining your scoring rationale.

Step 5 — Gather Evidence¶

For each control scored above 0, collect the evidence listed in the control's "Evidence to Collect" field. See the Evidence Catalog.

Step 6 — Score and Calculate¶

1. Finalize scores for each control (0–5).
2. Domain score = average of all control scores in the domain.
3. Overall score = average of all domain scores.

See Scoring for detailed formulas and weighting options.

Step 7 — Document Findings¶

Use the Findings Template. Each finding includes:

• Current vs. expected state description
• Risk impact if unaddressed
• Recommended remediation action
• Priority (Critical / High / Medium / Low)

Step 8 — Prioritize¶

Priority logic: - High Impact + Low Effort = Quick Win (do first) - High Impact + High Effort = Strategic Project (plan carefully) - Low Impact + Low Effort = Batch and schedule - Low Impact + High Effort = Challenge the requirement, deprioritize

Guidance by Organization Size¶

Small Organizations (<50 in scope)¶

Medium Organizations (50–500 in scope)¶

Large Organizations (500+ in scope)¶

Using Nexus SecOps for Training¶

1. Read chapters in order (Ch 1 → Ch 15).
2. Complete the quiz at the end of each chapter.
3. Run the relevant MicroSim to reinforce concepts.
4. Complete the lab exercises for hands-on practice.
5. After all chapters, run the self-assessment to consolidate learning.

Estimated time: 40–60 hours for full curriculum.

Reassessment Cadence¶