Compliance Status Is Not a Readiness Report
Why the metrics that prove compliance say almost nothing about operational cyber readiness.
By Ar-Raheem Ellis, Senior Program Manager of Strategic Accounts, SteelCloud. 25.5 years in Navy cybersecurity and IT, ending as an Operations Branch Chief of the Fleet Cyber Command Office of Compliance and Assessments.
When organizations assess their overall cyber readiness, discussions with senior leadership often focus on a few common questions:
- Are we compliant with a specific cybersecurity framework?
- Are we meeting the requirements of applicable laws, regulations, and policies?
- What is our current cybersecurity posture?
These are important questions and should absolutely be part of the conversation. I have asked them and I have answered them, at every level from a ship’s IT shop up to being a part of a team that oversaw cybersecurity compliance and assessments for the entire Navy.
But the answers do not always provide a complete picture of an organization’s cybersecurity health or operational readiness. Too often, organizations equate compliance with security, focusing primarily on whether documentation, policies, and procedures satisfy prescribed requirements.
What Frameworks Actually Measure
Frameworks and regulations such as NIST, GDPR, HIPAA, and others establish important standards and provide guidance on what organizations should implement to achieve compliance at a specific point in time. That last phrase is the one that gets lost; At a specific point in time.
These frameworks help establish a strong security baseline. They do not necessarily measure an organization’s ability to detect, respond to, recover from, and operate through a real-world cyber incident. Those are different capabilities, and a document review does not test them.
So why does compliance dominate the conversation? In my experience, many organizations prioritize meeting compliance requirements because those requirements are measurable and auditable. You can put a number on them. You can put the number in a brief. Nobody has ever been asked to produce a slide showing how well their team would perform at two in the morning during an actual intrusion.
The Metrics That Mattered
While I was in uniform, leadership would base the health of your network on a few things. One of them was your Vulnerability Remediation Asset Management numbers, known as VRAM. For those who may not know, VRAM is a cybersecurity tool that system administrators use to scan network assets for vulnerabilities and to identify what patches need to be uploaded.
If your systems scanned in the high 90s, you were in good shape. That was the standard, and it was not a bad one. It gave leadership a consistent way to compare commands and to spot a network that was falling behind.
The other metric that received a great deal of focus was checklist completion for mandatory cyber documentation. System access request forms. Applicable publications. Cyber training documentation. All of it necessary, all of it auditable, all of it countable.
Here is the honest limitation of both. A high VRAM percentage tells you what your scanner found on the day it ran. A completed checklist tells you a form was filled out. Neither one tells you whether your people know what to do when something goes wrong, whether your processes hold under pressure, or whether the mission can continue while you are responding.
What Readiness Actually Requires
True cyber readiness extends beyond checking regulatory boxes. It requires continuous assessment of people, processes, technology, and mission resilience to ensure the organization can effectively defend against evolving threats while maintaining critical operations.
Notice that all four of those are ongoing conditions, not deliverables. People change. Processes decay if nobody maintains them. Technology drifts. Mission requirements shift. A readiness posture is something you hold, and holding it is work that never produces a finished artifact you can hand to an inspector.
That is uncomfortable, because it does not brief well. It is much easier to report that you are in the high 90s than to report that your team is genuinely prepared. But the organizations I have seen withstand real incidents were not the ones with the best documentation. They were the ones that had been sustaining the standard every day, whether or not anyone was checking.
Over the next series of blog posts, I want to walk through why that gap exists, what it costs, and what actually closes it. I will use examples from my own career, including a warship where the configuration management program had to be built from nothing, and a deployment where an executive order arrived in the middle of the night.
The through line is simple. Compliance is a snapshot. Readiness is a condition.
READ THE ENTIRE SERIES
Enjoyed this blog? Click on the links below to read other blogs in this series written by Ar-Raheem Ellis.
Featured Resources