Prioritization of efforts to increase efficiency
Prioritization can be made using a variety of approaches, and it sometimes can come down to a feeling. For the record, when possible, you should use a quantitative method for prioritization, primarily based on capabilities. To start with, you need to have your gaps identified. That can be done through a risk registry, a purple team exercise, an audit, and so on. From there, you need to take a look at your resources; this includes the current technical capabilities, the personnel and their skill sets, the budget constraints to upgrade or bring in new tools and services, and the work cycles you have available or can make available. After you take a look at your resources, you want to then begin assigning prioritization and scoping out levels of effort, potential fixes, and stakeholders. One helpful tool is to diagram and actually write down the risks. If we were to step through a process, we could start with the following gaps:
