Dave M. Brown

Try it

Six tools that show how I think

Everything runs in your browser. Nothing you click is stored or sent anywhere.

Readiness check Framework finder Scoping exercise AI tool triage Risk assessment Incident tabletops

Compliance readiness check

Ten questions I ask when I take over a security program. Answer honestly; it takes about a minute.

What this shows: How I assess a security program in my first week.

Answer the questions to see where you stand

Your score and the gaps worth closing first will appear here.

    Which framework do I need?

    Four questions about your customers, data, and contracts. Recommendations update as you click.

    What this shows: How I match frameworks to customers, data, and contracts before anyone pays for an audit.

    Scope it: draw the SOC 2 boundary

    A Series B healthtech SaaS company sells one platform to hospital customers. Which of these belong inside the audited boundary?

    What this shows: How I draw an audit boundary from the business, not from the framework.

    0 of 10 answeredEvery framework still has a baseline you cannot exclude.

    AI tool risk triage

    Someone wants to roll out a new AI tool. Describe it in five clicks and get a risk tier plus the controls I would require.

    What this shows: How I say yes to a new AI tool, with conditions.

    Risk assessment calculator

    Score a risk the way I do: inherent risk before controls, residual risk after them, then a treatment decision with the right person signing off.

    What this shows: How I score a risk and decide who has to sign off on it.

    How the calculation works

    1. Inherent risk: the risk with no controls

    Score likelihood from 1 (rare, less than once in five years) to 5 (almost certain, monthly or more). Score impact from 1 (minimal) to 5 (severe: a multi day outage, regulatory action, or lost customers). Multiply them for a score from 1 to 25.

    Inherent risk tells you how much the controls matter. Two risks with the same residual score aren't equal if one is a 20 held down by controls and the other was a 6 to begin with. The first one needs its controls watched closely.

    2. Controls: what lowers which number

    Preventive controls, like MFA or a mantrap, lower likelihood. Detective and recovery controls, like 24x7 response or tested backups, lower impact. Most risks need both, and a control that only lowers one axis can leave the other at 5.

    Only count controls that are in place and tested today. A control on the roadmap is a plan, not a reduction. If it isn't tested, an auditor won't count it either.

    3. Residual risk: what's left

    Rescore likelihood and impact with the controls in place. That residual score drives the decision. The bands: 1 to 4 is Low, 5 to 9 is Medium, 10 to 16 is High, and 20 to 25 is Critical.

    4. Treatment: who decides, and what happens
    • Low: the risk owner accepts it and it's recorded in the register.
    • Medium: as the security leader I can accept it with a written rationale and a review date, or plan an improvement.
    • High: an executive, the COO or CEO, either accepts it in writing or funds a fix with a deadline. It stays on the monthly risk report.
    • Critical: not acceptable. Mitigate it, transfer part of it, or avoid it by stopping the activity.

    The four options are mitigate (add controls), transfer (insurance or contract terms move part of the cost), avoid (stop doing the risky thing), and accept (a named person owns it, with a date to look again). Every accepted risk has an owner and a review date. A risk nobody owns isn't accepted; it's ignored.

    5. Mistakes I look for in a risk register
    • Scoring the controls you plan to build instead of the ones you have.
    • Lowering impact because of a control that only lowers likelihood.
    • Counting insurance as a control. It pays part of the bill; it doesn't shorten the outage.
    • Accepted risks with no owner, no rationale, and no review date.
    • A register that only changes once a year, right before the audit.

    Incident and change tabletop exercises

    You make the calls. Six scenarios: business email compromise, ransomware, a data center intruder, a hijacked vendor session, an AI data leak, and a risky change at the Change Advisory Board.

    What this shows: How I make calls under pressure, during an incident or at the Change Advisory Board.

    Like how I think?

    These tools reflect how I lead security programs. If you're hiring for a security leadership role, let's talk.

    Get in touch Read how I approach scoping
    NextSee my experience →