Chapter 4 — Prioritising gaps
Lesson map
Lesson 04 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Listing gaps"]
N2["4.2 Scoring"]
N3["Lab — Ranking the gaps"]
N4["4.3 Discussion"]
N5["4.4 Agreement"]
N6["Using and revisiting the ranking"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Listing gaps"]
N2["4.2 Scoring"]
N3["Lab — Ranking the gaps"]
N4["4.3 Discussion"]
N5["4.4 Agreement"]
N6["Using and revisiting the ranking"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]
[Learning outcomes]
|
v
[4.1 Listing gaps]
|
v
[4.2 Scoring]
|
v
[Lab — Ranking the gaps]
|
v
[4.3 Discussion]
|
v
[4.4 Agreement]
|
v
[Using and revisiting the ranking]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) score gaps by risk; (2) consider effort; (3) agree priorities.
4.1 Listing gaps
From the coverage table and interviews, Seun lists six gaps: server admin access without MFA, warehouse PCs without the detection agent, Linux servers off the standard, a patching tail on laptops, shared warehouse logons and unencrypted warehouse PCs. The interviews add gaps that a coverage table cannot show, such as shared logons, which only appear when people describe how they work. Seun writes each gap as a short statement with the affected devices and the evidence behind it, so the operations director can see where each one came from before agreeing priorities. The list deliberately stops at six, so that each gap can be discussed properly.
4.2 Scoring
He scores each for likelihood and impact from 1 to 5 and multiplies them, breaking ties by effort. This is a simple method, not a precise calculation; its value is in making reasoning visible and discussable. Seun scores each gap with the infrastructure team and a warehouse manager, so the numbers reflect more than his own view. Disagreements are noted beside the score, and where the team cannot agree, the higher score is used until evidence changes it. Effort is estimated in rough days, which helps the director choose between gaps that score similarly. The scored list is filed with the evidence pack, and rescored at each checkpoint.
Lab — Ranking the gaps
"""Rank hardening gaps by a simple likelihood x impact score (1-5 each), ties by effort (synthetic, stdlib only)."""
gaps = [("warehouse PCs unencrypted", 3, 3, 2), ("warehouse PCs no EDR", 4, 4, 1), ("Linux servers off baseline", 3, 5, 3),
("laptops patch tail", 3, 4, 2), ("shared warehouse logons", 4, 3, 2), ("server admin without MFA", 4, 5, 2)]
for name, l, i, e in sorted(gaps, key=lambda g: (-g[1] * g[2], g[3])):
print(f"{l*i:2d} effort {e} {name}")
Run with python3 lab_rank.py. Verified output:
20 effort 2 server admin without MFA
16 effort 1 warehouse PCs no EDR
15 effort 3 Linux servers off baseline
12 effort 2 laptops patch tail
12 effort 2 shared warehouse logons
9 effort 2 warehouse PCs unencrypted
4.3 Discussion
Server admin without MFA ranks highest at 20, since compromised admin credentials would reach every system. The missing detection agent on warehouse PCs is next and is cheap to fix. Unencrypted warehouse PCs rank lowest, because they stay in a secured building and hold little data, so encryption there waits for hardware replacement. The ranking turns the gap list into a work order the director can understand. Keeping encryption last is a deliberate decision with reasons, not a gap left unnoticed, and it is recorded so auditors can see why.
4.4 Agreement
The operations director agrees the order, adding that the shared warehouse logons matter for accountability after a stock discrepancy last year. The director's addition shows why business owners should review risk rankings: the scores reflected technical risk, but the stock discrepancy made accountability more urgent than its score suggested. Seun records the director's reasoning beside the ranking and moves shared logons into the month-two work alongside the detection agents. The agreed order becomes the plan, and any later change to it is recorded with the reason and the director's approval.
Using and revisiting the ranking
The ranking becomes the programme plan. Seun shares it with every owner, so each knows when their group's work happens and why; when a warehouse manager asks why encryption waits, the agreed reasoning answers. The ranking is not fixed. At each checkpoint Seun re-scores the list, because closing one gap changes the others. By month four the warehouse agent gap is closed and the Linux baseline score falls as compliance rises, which moves the laptop patch tail to the top. Re-scoring openly shows leaders that priorities follow evidence rather than whoever complained most recently.
Worked example
The agreed plan tackles MFA for admins in month two, warehouse agents in month two, Linux baseline in months three and four, and the rest by month six.
Synthetic case. Scores are synthetic.
Errors and limits
Scores give a false sense of precision if presented without the reasoning.
Exercises
- EX016 — Top gap. Why is admin access without MFA the top gap? Rubric: 3 = high likelihood and impact reaching all systems;; 2 = high score;; 1 = vague;; 0 = none.
- EX017 — Low rank. Why are unencrypted warehouse PCs ranked low? Rubric: 3 = secured building, little data;; 2 = low impact;; 1 = vague;; 0 = none.
- EX018 — Tie breaking. How are equal scores ordered? Rubric: 3 = lower effort first;; 2 = effort;; 1 = vague;; 0 = none.
- EX019 — Precision caution. What caution applies to these scores? Rubric: 3 = judgement, not precise, show reasoning;; 2 = approximate;; 1 = vague;; 0 = none.
- EX020 — Business input. What did the director add and why? Rubric: 3 = shared logons, accountability after discrepancy;; 2 = shared logons;; 1 = vague;; 0 = none.
Synthesis
Simple, visible scoring helps leaders agree priorities.
Continue studying — chapter 04 of 12
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →