Quantified Current State
The full sample names concrete severity, not just general gaps, so leaders can see where current practice falls short of PBMM expectations.
- A fictional 12% baseline to show how control-family scoring is communicated
- Shared accounts in sensitive systems
- Unconfirmed backup and recovery responsibilities
- Missing incident response and breach notification procedures