What should teams do first when adopting CTEM across people, process and technology?

Start with the operating objective, not the tooling inventory

The first move in CTEM is to define what the programme is meant to change: lower exposure, improve response speed, or close the highest-value gaps. Without that explicit goal, teams tend to collect findings without changing decision-making, which makes people, process and technology feel “covered” while the operating model remains fragmented.

That objective should be concrete enough to drive scoping. If the aim is to reduce the time a known gap stays open, the programme needs ownership, triage and remediation paths; if the aim is to improve visibility, the first priority is asset and control coverage, not more scanning volume.

Map the goal to owners, communication paths and tooling gaps

Once the goal is set, teams should map it to the actual gaps that block execution across business units, teams and platforms. The most useful starting question is not “what tools do we own?” but “who must act on a finding, who must be informed, and what evidence proves the gap was closed?” That mapping exposes whether the constraint is organisational, operational or technical.

A practical early step is to identify which business units carry the most risk, then compare that with how detections, escalations and fixes currently move. Team-based distribution lists, named owners and escalation paths matter because CTEM fails when findings have nowhere to go. Tooling changes should come after that map, otherwise teams automate confusion.

• Identify the business units and asset groups most associated with risk.
• Document who receives, triages and closes exposure findings.
• Compare current tooling to the visibility and remediation workflow the goal requires.
• Confirm whether existing tools can support the process before adding new ones.

Sequence the first cycle around visibility, then coordination, then control changes

The first CTEM cycle should establish a baseline across people, process and technology before the operating model is changed. That usually means measuring how often relevant assets are detected, how quickly findings move between teams, and where existing resources already overlap. A baseline prevents teams from redesigning around assumptions instead of facts.

For many organisations, the earliest win is to reduce duplication and clarify handoffs, not to expand the stack. If multiple tools already cover the same terrain, the better question is which one has authoritative ownership, which one is used for action, and where there are blind spots that stop the programme from being operationally useful.

Risk and Threat Considerations

CTEM can create false confidence if teams treat scans, dashboards or meetings as progress without fixing ownership and response paths. The risk is that exposure stays visible but unresolved, or that multiple teams assume someone else is acting on it, which prolongs dwell time and leaves high-value gaps open.

Failure mechanism: Weak ownership mapping, poor escalation design and overlapping tools allow findings to circulate without a clear remediation path, so the same exposure reappears in every review cycle.

Impact: Organisations can accumulate unresolved findings, miss the gaps that matter most to critical business units, and spend time on operational noise instead of risk reduction.

Practitioner Guidance

What to prioritise: Establish a single programme objective, then tie it to named owners and the specific workflow that will close findings. If that cannot be done cleanly, the first problem is organisational design, not technology selection.

What to verify: Confirm that each high-risk business unit has a clear intake path for exposures, an agreed escalation route, and a defined measure of closure. If teams cannot show where a finding goes after discovery, the CTEM motion is not yet real.

Practitioner takeaway: The best first step is to make exposure management actionable, which means clarifying who acts, who communicates, and what control or process change will actually reduce the gap.

Related resources from NHI Mgmt Group

• How should healthcare organisations prepare for a HIPAA examination across people, process, and technology controls?
• What are the best practices for reducing cyber attack risk across people, process, and technology?
• How should organisations mitigate insider threats across people, process, and technology?
• What should security leaders do first when adopting CTEM across existing security programmes?