90-Day Improvement Roadmap Template

Brilliant at the Basics Resource Center · brilliantatthebasics.us · published by inDirectIT, Inc.

Independent educational material. Not affiliated with, sponsored by, approved by, or endorsed by the U.S. Department of War. Does not establish compliance, certification, or contractual standing.

Purpose

A quarter-length roadmap organized by the six-stage sequence, with a current-and-target maturity column so progress is stated as a movement between defined levels rather than as a percentage nobody can audit.

How to use it

Set a target level per practice for the end of the quarter, not an aspiration for the year. Moving five practices from Configured to Deployed is a better quarter than moving twenty from Absent to Documented.

The maturity ladder

Score each practice against this ladder. The distinction that matters most is between having a tool, deploying it to the correct scope, and operating it consistently.

Level	Name	What it means	The question that separates it from the level below
0	Absent	The capability does not exist in any form.	Is there anything at all — a tool, a document, a person who owns it?
1	Documented	Intent exists on paper. Deployment has not happened or is incomplete.	Is the intent written down, with a named owner and a scope?
2	Configured	The technology or process is configured, but not yet applied to the intended scope.	Is it switched on and set up somewhere — even if only in part of the estate?
3	Deployed	It is applied across the scope it was meant to cover.	Does it cover everything in scope, with the exceptions written down?
4	Operating	It functions consistently during normal operations, not only when someone is watching.	Does it keep working through a normal month without manual rescue?
5	Measured	Coverage and effectiveness are measured, monitored, and exception-handled.	Can you state a number for coverage or effectiveness, and show the trend?
6	Governed	Ownership, scheduled review, continuous improvement, and evidence retention are established.	Is there an accountable owner, a review cadence, and retained evidence?

Stage 1 — Know and control

See every identity and asset you defend.

Practice	Depends on	Current level	Target level	Owner	By when
IT-01 — Phishing-resistant MFA	IT-02
IT-02 — Asset inventory	—
OT-01 — OT identity and access control	OT-02
OT-02 — Validated OT asset inventory	—

Stage 2 — Contain compromise

Keep one breached device from becoming ten.

Practice	Depends on	Current level	Target level	Owner	By when
IT-05 — Logical segmentation	IT-02
OT-03 — OT network segmentation	OT-02
OT-06 — OT remote access pathways	OT-03, OT-01

Stage 3 — Reduce exposure

Close the gaps attackers reach first.

Practice	Depends on	Current level	Target level	Owner	By when
IT-03 — Technical debt reduction	IT-02
IT-06 — Risk-based vulnerability management	IT-02, IT-03
OT-05 — OT vulnerability management	OT-02, OT-03

Stage 4 — Recover operations

Prove you can restore before you need to.

Practice	Depends on	Current level	Target level	Owner	By when
IT-09 — Backup and disaster recovery	IT-02, IT-01
OT-04 — OT incident response and recovery	OT-02, OT-08
OT-08 — OT system resiliency	OT-02

Stage 5 — Engineer securely

Build new capability without new risk.

Practice	Depends on	Current level	Target level	Owner	By when
IT-04 — Flexible technology stack	IT-02, IT-03
IT-07 — Security in the development lifecycle	IT-02
IT-08 — Secure AI adoption	IT-02
OT-09 — OT supply chain security	OT-02, OT-06
OT-10 — OT change review	—

Stage 6 — Sustain performance

Keep your people and monitoring sharp.

Practice	Depends on	Current level	Target level	Owner	By when
IT-10 — Technical workforce readiness	—
OT-07 — OT continuous monitoring	OT-02, OT-03

Quarterly review

Which practices moved a level, and what is the evidence for the move?
Which targets were missed, and was the cause capacity, funding, or dependency?
Which dependencies blocked work that we did not anticipate?
What did we learn that changes next quarter's targets?

Reviewed by

Name	Role	Date

Limitations

What this asset is and is not

This is independent educational material. It supports planning and evidence collection; it does not establish compliance with NIST SP 800-171, DFARS 252.204-7012, CMMC, export-control obligations, or any contract requirement, and it is not an assessment. Tailor every item to your own technical, operational, contractual, regulatory, and safety requirements.

All downloads

Printing produces a paginated document. Choose “Save as PDF” in the print dialog and name it batb-90-day-improvement-roadmap-template to keep filenames consistent across your team.