Defensibility Management
I work with business owners, MSPs, brokers, and advisors to independently assess whether a security program can support the statements being made about it, most often for confidence that a cyber insurance claim will be paid.
The goal is to reduce friction, identify opportunities for improvement, and improve confidence that the business can continue and recover when disruption occurs.
I call this defensibility: the ability to explain, demonstrate, and support organizational claims when they matter most.
What is Defensibility Management?
Information Security Defensibility Management is a practical governance and management system designed to create clarity, maintain alignment, improve recovery readiness, and help organizations demonstrate that reasonable measures for each control has been taken to protect what matters. It directly informs if your cyber insurance will pay if you make a claim.
The Problem
Organizations make commitments to customers, insurers, regulators, partners, and staff. Defensibility Management provides the clarity needed to understand those commitments, align controls and activities, and demonstrate support for them. The result is greater confidence, reduced friction, and improved readiness for disruption and recovery.
What is Defensibility?
Defensibility is the ability to demonstrate:
- What the organization is protecting and why it matters.
- That reasonable measures have been taken.
- That organizational claims can be supported with evidence.
- That responsibilities and decisions are understood.
- That commitments made to stakeholders are accurate and supportable.
- That governance, controls, evidence, and recovery capabilities remain aligned with business objectives.
Defensibility means being able to say, in good faith, “We did our best to protect what matters, and we can demonstrate it.”
What is Defensibility Management?
Defensibility Management is a practical management system for identifying, documenting, demonstrating, monitoring, reporting, and managing defensibility.
It is not a one-time assessment. It is an ongoing discipline that informs internal staff, prevents program drift, maintains clarity, and keeps organizational commitments aligned with evidence, controls, ownership, and recovery capability.
The Defensibility Chain
Mission → Assets → Risks → Controls → Evidence → Demonstration → Recovery
The chain connects business objectives to protection, proof, and recovery. It provides evidence that the organization protects its assets and can respond effectively when disruption occurs.