CALIBRATION CHECKLIST

Consolidated Preliminary Default Register

Table of Contents

1. Purpose and Scope
2. Using This Checklist
3. Risk Appetite and Impact Calibration (RMF-001)
4. Service Level Commitment Calibration (SLC-001)
5. Metric Threshold Calibration (MTR-001)
6. Crown Jewel Scenario Calibration (CJ-001)
7. Risk Acceptance Duration Calibration (RMF-001)
8. Calibration Governance
9. Document Control

1. Purpose and Scope

The CERG framework embeds preliminary defaults requiring organizational calibration across multiple documents. These defaults are educated starting points for a mid-market organization; they are not approved values until calibrated against the organization’s specific risk profile, staffing, and financial context. A program that operates on uncalibrated defaults makes decisions against thresholds that do not reflect its actual exposure.

This document consolidates every preliminary default in the CERG corpus into a single register. It identifies each parameter, its default value, the calibration inputs required, the calibration method, the owning role, and the review cadence.

It is the authoritative reference for the organization’s calibration status. Adopting teams use this checklist during adoption (IMP-001 §5) and maintain it as the calibration maturity tracker.

Calibration Is Not Optional

Risk acceptance decisions made against uncalibrated values are opinions, not risk management. SLA commitments made against uncalibrated values are promises the organization may not be able to keep. Every preliminary default in this register must have either a calibrated value or a documented plan for calibration, with a target date, before the CISO signs the adoption gate.

2. Using This Checklist

2.1 Register Structure

Each calibration item records:

2.2 Calibration Priority

• Gate 2 (Operating) — Risk appetite bands and impact thresholds must be calibrated before operating risk acceptance.
• Gate 3 (Governed) — SLA commitments and metric thresholds must be calibrated before publishing SLAs.
• Gate 4 (Adaptive) — All remaining defaults should be calibrated, including scenario-specific figures.

2.3 Verification

At each adoption gate review, the Governance Pillar Leader (Policy & Standards) presents the calibration register with current status for each item. Items that remain uncalibrated must be accompanied by a documented plan and target date.

3. Risk Appetite and Impact Calibration (RMF-001)

3.1 Loss Magnitude (Impact) Bands

3.2 Annualized Loss Exposure (ALE) Tolerance Bands

3.3 Single-Risk ALE Mandatory CISO Review Threshold

4. Service Level Commitment Calibration (SLC-001)

4.1 Architecture Review Turnaround

4.2 Continuous Service Coverage SLA

4.3 Advisory Response Time

4.4 New SaaS/Cloud Service Review

4.5 Exception/Risk-Acceptance Request Intake

5. Metric Threshold Calibration (MTR-001)

5.1 Service Responsiveness Metric Thresholds

5.2 Other Metric Thresholds

All discipline metrics (EM-001 through EM-010, RM-001 through RM-008, GV-001 through GV-006) carry preliminary green/amber/red thresholds defined in MTR-001 §3. These thresholds follow the same calibration rules (MTR-001 §10): tighten on green drift, escalate on red stall, adjust on risk appetite change. The initial preliminary values remain in effect until either triggered by the calibration rules or reviewed at the annual metrics program review.

6. Crown Jewel Scenario Calibration (CJ-001)

6.1 Scenario Financial Impact Figures

7. Risk Acceptance Duration Calibration (RMF-001)

7.1 Default Risk Acceptance Durations

8. Calibration Governance

8.1 Calibration Status Register

The Governance Pillar Leader (Policy & Standards) maintains the calibration status of each item in this document. The register records, for each item:

• Status: Uncalibrated / In Progress / Calibrated / Reviewed — No Change Needed
• Calibrated Value: The organization-approved value
• Date: When calibration was completed or last reviewed
• Next Review: Scheduled review date based on cadence
• Approver: CISO or designee (per RMF-001 §9.7 delegation rules)

8.2 Calibration Cadence

8.3 Calibration Documentation

Every calibration decision is documented in the organization’s Decision Log (IMP-002 §4) with:

• Parameter being calibrated
• Previous value (default or last calibrated)
• New calibrated value
• Rationale and data sources
• Approver name and date
• Next review date

8.4 Integration with Other CERG Instruments

• Adoption gates (IMP-005): Calibration status is a Gate 2→3 transition criterion. At least risk appetite and impact bands must be calibrated before exiting Gate 2.
• Risk acceptance (RMF-001): Risk acceptance decisions made against uncalibrated values use qualitative judgment until calibration occurs. Document this in the risk acceptance record.
• Metrics (MTR-001): Metric thresholds that reference SLC-001 commitment values remain as preliminary defaults until SLC-001 is calibrated.
• Improvement register (IMPREG-001): Calibration actions are recorded as improvement register entries of type “Metric or threshold change” when they improve program precision.

9. Document Control

Revision History

Review Triggers

• Material change to organizational revenue or risk appetite
• Change to cyber insurance coverage or retention
• Regulatory change affecting impact thresholds
• Metric that is red-stalled for 3+ consecutive months (indicates unrealistic threshold)
• Feedback from adoption gate reviews indicating calibration gaps
• Direction from the CISO

Related Documents

Governance owns this document. The Governance Pillar Leader (Policy & Standards) is responsible for initiating reviews, managing the revision cycle, and obtaining CISO endorsement for all changes.

Source: governance/CERG-GOV-CAL-002_Calibration_Checklist.md · Download .md · View on GitHub