Where this offering fits
Exposure management relates asset context to weaknesses that need attention. It should help the organisation prioritise work rather than add another unowned list of scores. Define the sources, risk questions and remediation teams that will make the findings actionable.
Architecture and rollout decisions
Reconcile supported inputs and verify attribution of representative assets. Review how the proposed configuration combines technical findings with business context. Test assignment, exceptions and closure evidence. A successful pilot should make the reason for priority explainable to the system owner and preserve uncertainty where data is incomplete.
An evaluation scenario for this offering
Create a review exercise around three known findings: a verified externally relevant exposure, a similar issue on a constrained internal asset and an uncertain association. Provide business criticality and named owners. Ask reviewers to explain the proposed order of action from the evidence, then route one accepted item into remediation. Close it only after the agreed verification, while leaving the uncertain case visibly awaiting investigation. The outcome should show how the selected system helps prioritise and track work. A change in an aggregate score alone should not count as proof that the affected business service has become safer.
Evidence to request for this scope
- Confirm supported exposure inputs and update frequency.
- Validate priority against known business context.
- Define evidence for closure or accepted risk.