Learn & prepare
A practical readiness roadmap.
Make progress through a sequence of decisions, implementation, and honest review.
Practitioner guidance · adapt this sequence to your organization and applicable requirements.
Define the scope
Trace information from receipt through storage, use, sharing, and disposal. Draw the boundary, inventory assets, and document external service dependencies. Validate the boundary with technical and business owners.
Working result: a boundary diagram, inventory, and information-flow description.
Establish the requirements
Review contracts and flowdowns. Record the required level, source publications, revision, and relevant guidance. Use the official scoping and assessment guides alongside the standard.
Working result: a requirements register with source links and applicability decisions.
Assess the gaps
Compare the system as it operates with each applicable objective. Use interviews, documents, and demonstrations. Record uncertainty as a gap to investigate, rather than assuming a policy proves implementation.
Working result: findings tied to requirements, assets, and observed evidence.
Assign ownership and do the work
Give each action an accountable owner, priority, resources, and target date. Address architecture, configuration, staffing, training, and procedures together. Keep the SSP aligned with real changes.
Working result: a funded improvement plan and controlled evidence register.
Review readiness
Have the team explain and demonstrate the safeguards. Sample evidence, test whether processes work, and resolve inconsistencies before making an assessment or affirmation claim. Confirm the required assessment route with current official guidance.
Working result: an evidence-based readiness decision with remaining issues visible.
Keep it operating
Review access, changes, incidents, service providers, and evidence on an ongoing schedule. Assign responsibility for required submissions and affirmations. Revisit scope when information flows or services change.
Working result: a program that can explain its current state throughout the year.