CTEM Checklists: Practical Program Checklists

• The essential steps for every stage
• The evidence to capture at each step
• The handoffs between security and owner teams

Scope checklist

• Business service named and one-line purpose written
• Crown jewels identified with data owners
• Assets, identities, and third parties listed
• Scope owner and CTEM owner named
• Out-of-scope items explicitly recorded

Discovery checklist

• Every discovery input mapped to the exposure register
• Deduplication rules defined
• Unknown-asset review scheduled
• Identity and cloud posture included

Prioritization checklist

• Scoring model documented
• Top-N list published weekly
• At least one attack path considered
• Threat activity refreshed

Validation checklist

• Method chosen (lab, BAS, evidence review)
• Safety review completed for production tests
• Evidence attached to each exposure

Mobilization checklist

• Owner named on every open exposure
• Deadline set based on severity
• Blockers escalated weekly
• Closure confirmed by re-test

• Print the checklists your team will use most
• Turn each checklist into a workflow in your ticket tool
• Review checklists quarterly and prune what nobody uses

• Turning checklists into audit questionnaires nobody fills in
• Adding items with no evidence step
• Never reviewing or improving the checklist