Sample report | BreachRx OOB Readiness

Overall maturity: L2 Standby; Average 1.83 of 4
Priority gaps: 5; Dimensions at Level 1–2
Strengths: 1; Dimensions at Level 3–4
Planned actions: 6; 5 high priority
On target: 0/6; Dimensions at target level
Lowest dimension: L1; Activation & Access

Sample Organization (illustrative) · Assessed January 15, 2026 · Next reassessment April 15, 2026

PDF report PowerPoint Plan CSV AI prompt

Current → target by dimension

Filled segments show your current level; dashed segments show the target the plan works toward.

Dimension

1 · Improvised2 · Standby3 · Integrated4 · Assured

Score → target

Independence from Affected Systems23

Activation & Access12

Privileged Collaboration23

Executive Command34

Record Continuity12

Rehearsal & Readiness23

Strength (Level 3–4)
Gap (Level 1–2)
Target level

Findings — weakest first

Risk of staying at the current level, and the next step toward the target.

Dimension	Current	Risk	Next step
Activation & Access “We’d track people down and invite them as we go.”	L1 · Improvised	Delays in reaching legal, communications, executives, and partners slow every downstream decision.	Create and maintain a role-owned contact roster and a documented fallback activation procedure. How BreachRx can help (optional): Participants and access are configured in advance, not figured out mid-crisis.
Record Continuity “We rebuild the timeline from inboxes and text threads afterward.”	L1 · Improvised	Reconstructing the timeline from inboxes and texts after the fact risks gaps when decisions must be explained later.	Agree an authoritative incident record and a decision capture process for out-of-band work. How BreachRx can help (optional): Scratch Pad captures findings, handoffs, and draft comms in one shared workspace.
Independence from Affected Systems “We have a backup tool, but it relies on our corporate identity.”	L2 · Standby	If email, chat, or corporate identity are compromised, the response team may lose its primary means of coordinating.	Separate response mail, chat, and meetings from corporate systems and validate that access does not depend on corporate identity. How BreachRx can help (optional): Mail, Chat, Meetings, and Scratch Pad replace corporate tools for the incident.
Privileged Collaboration “Legal has its own channel, separate from the wider response.”	L2 · Standby	Counsel working in personal or consumer channels can expose sensitive findings and complicate privilege handling.	Define protected, role-based legal workstreams connected to the broader response, with documented boundaries. How BreachRx can help (optional): Work product, investigations, and draft filings run in protected workstreams.
Rehearsal & Readiness “Security tests the backup channel occasionally, on its own.”	L2 · Standby	An untested fallback plan may fail in ways that only surface during a real incident.	Make the exercise cross-functional and validate external access, executive updates, and response handoffs in the out-of-band environment. How BreachRx can help (optional): Cross-functional exercises run in the same Rex environment used for real incidents.
Executive Command “Leaders see live status and decisions on protected mobile access.”	L3 · Integrated	Leaders relying on personal texts or ad hoc calls may decide without current, trusted information.	Deliver decision-ready context to executives as material facts change, without requiring them to follow every thread. How BreachRx can help (optional): Decision-ready context reaches executives without pulling them into every thread.

Your position on the maturity model

Highlighted cells are your selected answers.

Independence from Affected Systems
1. L1We’d fall back to personal phones, texts, and whatever works.
2. L2Current level: We have a backup tool, but it relies on our corporate identity.
3. L3We run separate mail, chat, and meetings outside corporate systems.
4. L4Our environment is prevalidated and decoupled from corporate identity.
Activation & Access
1. L1Current level: We’d track people down and invite them as we go.
2. L2We keep a contact list; accounts get created during the incident.
3. L3Every function and key partner is provisioned before an incident.
4. L4Role-based access activates on demand for internal and external teams.
Privileged Collaboration
1. L1Counsel uses personal email and consumer messaging apps.
2. L2Current level: Legal has its own channel, separate from the wider response.
3. L3Privileged work runs in protected, role-based workstreams.
4. L4Privilege boundaries are preset, and counsel keeps full context.
Executive Command
1. L1Leaders get personal texts and join ad hoc calls.
2. L2Leaders join scheduled bridge calls for status updates.
3. L3Current level: Leaders see live status and decisions on protected mobile access.
4. L4Leaders get decision-ready context as material facts change.
Record Continuity
1. L1Current level: We rebuild the timeline from inboxes and text threads afterward.
2. L2We export backup-channel notes and merge them by hand.
3. L3Out-of-band facts and decisions stay in our incident record.
4. L4One governed record is always ready for legal and regulatory review.
Rehearsal & Readiness
1. L1We haven’t; our fallback plan has never been tested.
2. L2Current level: Security tests the backup channel occasionally, on its own.
3. L3Cross-functional teams exercise in the out-of-band environment.
4. L4Regular exercises prove failover and update our plans and access.

Out-of-band communications maturity model: six dimensions across four levels
Dimension	Level 1 · Improvised	Level 2 · Standby	Level 3 · Integrated	Level 4 · Assured
Independence from Affected Systems	We’d fall back to personal phones, texts, and whatever works.	Current level: We have a backup tool, but it relies on our corporate identity.	We run separate mail, chat, and meetings outside corporate systems.	Our environment is prevalidated and decoupled from corporate identity.
Activation & Access	Current level: We’d track people down and invite them as we go.	We keep a contact list; accounts get created during the incident.	Every function and key partner is provisioned before an incident.	Role-based access activates on demand for internal and external teams.
Privileged Collaboration	Counsel uses personal email and consumer messaging apps.	Current level: Legal has its own channel, separate from the wider response.	Privileged work runs in protected, role-based workstreams.	Privilege boundaries are preset, and counsel keeps full context.
Executive Command	Leaders get personal texts and join ad hoc calls.	Leaders join scheduled bridge calls for status updates.	Current level: Leaders see live status and decisions on protected mobile access.	Leaders get decision-ready context as material facts change.
Record Continuity	Current level: We rebuild the timeline from inboxes and text threads afterward.	We export backup-channel notes and merge them by hand.	Out-of-band facts and decisions stay in our incident record.	One governed record is always ready for legal and regulatory review.
Rehearsal & Readiness	We haven’t; our fallback plan has never been tested.	Current level: Security tests the backup channel occasionally, on its own.	Cross-functional teams exercise in the out-of-band environment.	Regular exercises prove failover and update our plans and access.