WEBVTT

1
00:00:00.000 --> 00:00:30.400
Speaker 1: Welcome to the remediation roadmap workshop—the moment where all that red-team adrenaline turns into a plan people will actually follow.
Speaker 2: Exactly, and we’re keeping it grounded in Sarah’s startup so you can see how each idea plays out in a real company, not a textbook fantasy.
Speaker 1: By the end you’ll have a reusable template, plus a few jokes to disarm tense stakeholders when the topic turns to breaches before breakfast.

2
00:00:30.400 --> 00:01:00.800
Speaker 1: Let’s kick off with the “why.” Without a roadmap, all those red sticky notes become that gym membership you bought in January—great intentions, zero follow-through.
Speaker 2: And Sarah’s investors don’t care about sticky notes; they want to know who’s fixing the unlogged database access and when it’ll be safe to brag about it in board meetings.
Speaker 1: Stick with us and we’ll turn the chaos into sequenced, funded work everyone can champion.

3
00:01:00.800 --> 00:01:30.000
Speaker 1: Before we rush into solutions, consolidate every artifact from the drill—risk rankings, quotes from the red team, that horrifying clip where customer support browsed production.
Speaker 2: Right, the richer the inputs, the easier it is to answer executives later without scrambling for context.
Speaker 1: Take a minute now to flag unanswered questions for the MSP, SOC or legal folks so nothing slips between cracks once we leave the room.

4
00:01:30.000 --> 00:01:55.200
Speaker 1: Let’s carve the backlog into Stabilise, Reinforce and Scale so the urgent fixes don’t drown out the long-term bets.
Speaker 2: For Sarah that means Stabilise covers MFA and database access, Reinforce adds automated backup testing, and Scale explores a SIEM pilot.
Speaker 1: Capture owners, collaborators and success metrics while you go—it saves so many “who’s on this?” messages later.

5
00:01:55.200 --> 00:02:21.200
Speaker 1: Scoring time. Rank impact, regulatory exposure, customer promises and effort—don’t just default to “critical” for everything.
Speaker 2: Yeah, when everything is critical, nothing gets done. Ask what your most skeptical investor would grill you on and let that sharpen the order.
Speaker 1: Capture the due diligence questions right beside the work so the finance or legal follow-ups have a clear home.

6
00:02:21.200 --> 00:02:49.600
Speaker 1: Let’s layer in time horizons—what lands in the first 30 days versus 60 or 90 so the plan feels achievable.
Speaker 2: In Sarah’s case the “30” bucket is the production database fix and MFA clean-up, while the “60” bucket covers runbook refreshes and due diligence trackers.
Speaker 1: Exactly, and anything needing contracts or new tools probably lives in the 90-day lane so leaders see budget bumps coming.

7
00:02:49.600 --> 00:03:16.000
Speaker 1: Ownership time—every item needs an executive sponsor, a delivery lead and supporting squad, plus a ritual where status gets checked.
Speaker 2: Otherwise we’ve just made someone captain of a ship without handing them the steering wheel, and Sarah’s team doesn’t have time for that.
Speaker 1: Build the communication plan now—think quick Loom updates, investor-ready bullets and which customer advocates should preview changes.

8
00:03:16.000 --> 00:03:44.799
Speaker 1: Now let’s talk risk communication—executives need a one-page story that connects technical jargon to customer impact, cost and compliance.
Speaker 2: So for Sarah we highlight that the database exposure risks GDPR fines and investor confidence, then pair it with the mitigation plan and price tag.
Speaker 1: Practice saying “We eliminated X risk this month; Y is next in line” so you can answer “Are we safe?” without bluffing.

9
00:03:44.799 --> 00:04:10.399
Speaker 1: Change management is where good plans go to live or die, so map the stakeholders and what they secretly worry about.
Speaker 2: For example, engineering fears surprise workloads, support wants proof customer comms won’t break, and finance wants to see cost avoidance.
Speaker 1: Meet them where they are with Loom explainers, office hours and training so adoption beats compliance theater.

10
00:04:10.399 --> 00:04:36.399
Speaker 1: Measurement keeps momentum, so set up a dashboard—even if it’s Google Sheets—that tracks risk burn down, spend and blockers.
Speaker 2: Celebrate the green lights too; ring a Slack bell when Sarah’s team locks down the prod database or crushes a diligence interview.
Speaker 1: And when something slips, log the lesson learned and next experiment so you don’t lose trust with leadership.

11
00:04:36.399 --> 00:05:01.199
Speaker 1: Reflection isn’t fluff—capturing surprises and broken assumptions shows investors you’re learning, not just reacting.
Speaker 2: Let’s pose it to the room: what did Sarah’s team get wrong about vendor coverage, and what support do they need to keep momentum?
Speaker 1: Encourage them to log those answers with the backlog so leadership sees the human side of resilience work.

12
00:05:01.199 --> 00:05:27.599
Speaker 1: Time to build—open the template and draft Sarah’s roadmap with five concrete actions, metrics and a review date.
Speaker 2: Don’t forget a mini risk register entry and an executive summary paragraph; those pieces make the homework instantly useful.
Speaker 1: We’ll circle the room, answer questions, and line up five-minute readouts for next session—one risk retired, one still nagging, one follow-up call booked.

13
00:05:27.599 --> 00:05:51.599
Speaker 1: Quick reminder on resources—you’ve got the backlog spreadsheet, executive summary template and the risk register from earlier sessions.
Speaker 2: Plus links to ServiceNow, Jira or Linear examples, and the Part 5 communication plan so cadence rituals stay aligned.
Speaker 1: Bookmark them now; nothing kills momentum like hunting for a template five minutes before an investor call.

14
00:05:51.599 --> 00:06:13.999
Speaker 1: Let’s land the plane—a good roadmap keeps the capstone energy alive and proves progress with evidence.
Speaker 2: Publish your draft within 48 hours, celebrate the first win loudly, and be honest about the next big risk on deck.
Speaker 1: Do that and Sarah’s team—and yours—will keep improving long after the exercise ends.

15
00:06:13.999 --> 00:06:41.599
Narrative Outline — Capstone: Remediation Roadmap

Tasks
- [x] Prompt participants to generate due diligence questions tailored to their startup scenario.
- [x] Guide teams in assembling a take-home remediation roadmap.
- [x] Define reflection questions to close the capstone.

Notes
- Plan the take-home remediation roadmap and reflection prompts for the capstone.
- Include slides on risk communication, change management, measurement and available templates to support non-technical learners.