Security
A one-page Zero Trust progress report for a council or board
Governing bodies fund what they can see. A simple format for showing security maturity over time.
Security programs compete for budget with roads, parks, and staffing. Councils and boards fund what they understand. A one-page report that shows where the agency stands and how it is moving does more for a security budget than any technical briefing.
The format
Top: one sentence. "The agency's Zero Trust maturity advanced from Initial to Advanced in two of five pillars this year; the plan for next year targets the remaining three."
Middle: five rows, one per pillar. Identity, devices, networks, applications, data. For each: current maturity stage, target for next year, the one project that moves it, and its cost.
A small chart. Maturity by pillar, this year versus last year versus target. Five bars, two colors.
Bottom: three risks in plain language. "Staff can still sign in with a password alone on two systems." "Backups for the finance system have not been restore-tested this year." Each with the fix and the date.
What to leave out
Vendor names, acronyms without definitions, vulnerability counts, and anything a member cannot act on.
Why maturity stages work
They turn an abstract program into a scale a non-specialist can follow, and they make progress visible even when no incident happened, which is the point.
Where the numbers come from
An annual assessment against a published maturity model, done consistently so that the years compare. The projects in the report are the roadmap items that move the score.
Using it
Present it once a year with the budget and once mid-year with progress. Over three years it becomes a record that shows the investment worked, which is what a governing body needs to keep funding it.
Where HQT fits
Assessment against the maturity model, the roadmap, and the report itself, written for the audience that reads it.