Skip to content

Phase 3: Optimize (Ongoing)

Duration: open-ended; this is steady-state. Goal: keep the framework honest as the technology, the workforce, the regulatory landscape, and the evidence base all move.

The core rhythm

Phase 3 is held together by four recurring cadences. They are the single most important mechanism for the framework staying fit for purpose.

Cadence Frequency Owner Output
Weekly metrics pulse Weekly CoE + DevEx Updated dashboard; flags raised to CoE lead.
Monthly incident & learning review Monthly CoE + CISO Incident log reviewed; AUP & playbooks updated as needed.
Quarterly framework review Quarterly CoE + exec sponsor + Risk/Audit Public changelog entry; policy/standards updates; evidence pack refresh.
Annual external re-validation Annual Exec sponsor + Legal + Audit Regulatory crosswalk re-attested; vendor contracts re-assessed; certification status confirmed.

Principles of optimization

  1. Evidence precedes change. Policy edits happen because of an incident, a metric movement, a regulatory change, or a published study, not because of a vendor pitch or an industry headline.
  2. Every change gets a changelog entry. Maintain an internal change log so readers and stakeholders know what moved and why.
  3. Changes respect review dates. Pages promoted to stable do not change silently; a change triggers a new last_updated and a review by a second contributor.
  4. Sunset is first-class. Retiring a tool, practice, or metric is treated as a deliberate move, not an omission. See Phase 4.

What "done well" looks like after a year in Phase 3

  • Dashboard metrics are trending monotonically in the target direction, or you have a written explanation of why not.
  • No incident is a repeat of an incident from the previous six months (repeats indicate the first mitigation didn't take).
  • The CoE is receiving, not initiating, most policy update proposals; the rest of the org has adopted the framework enough to shape it.
  • Your AUP, IR playbook, and training materials are all younger than nine months (measured by last_updated).
  • Regulatory crosswalk has been re-validated against at least one new standard in the last 12 months.

Signs you're drifting

  • "The dashboard is green" but the incident log is growing and no one is reading it.
  • Policies older than their review_by date are common.
  • The CoE is a choke point; engineers wait days for prompt-library approvals or vendor-exception answers.
  • Training attendance has fallen below 50% for new hires.
  • Internal audit findings cite the framework but nobody can produce the evidence it asks for.

If you see these, run a one-off framework health check: one day, whole-CoE. Outputs: a three-point remediation plan and a Decision Record.

When to invoke Phase 4

  • A major tool is being deprecated (vendor EOL or your own exit).
  • A practice has been superseded (e.g., retiring a framework component after a newer one is proven better).
  • A vendor contract ends and you're switching.
  • A regulation requires a control you can't implement with current tools.

See Phase 4: Sunset.

Next