By quarter three, a security program should be ready to show its work: run a first incident exercise, set basic requirements for vendors, and publish an honest security summary for customers. Controls from earlier quarters are now old enough to have evidence behind them.
Why quarter three is the proof quarter
Quarters one and two built habits. Quarter three tests them. Buyers ask for evidence, auditors (if you pursue an audit) ask how long a control has run, and real incidents arrive on their own schedule. It is better to meet those with a rehearsal behind you.
Deliverable 1: a first incident exercise
NIST's incident response publication, SP 800-61 Revision 3 (April 2025), frames incident response as part of overall cybersecurity risk management rather than a separate project, using the CSF 2.0 structure. A small company can take the spirit of that without the full document.
CISA offers free tabletop exercise packages with template objectives, scenarios and discussion questions, including ransomware and insider threat scenarios. Pick one, run it for ninety minutes with engineering, support and a leader, and write down three things: who would have decided, what information was missing, and which contact was out of date.
Fix the contact list and the decision path before the next quarter.
Deliverable 2: vendor basics
CISA's performance goals include contract language that requires vendors to notify you of security incidents and of confirmed vulnerabilities within a time frame you set, and a preference for the more secure supplier when offers are otherwise similar. For a company of this size, a practical start is:
- List vendors that hold customer data or have access to production.
- Add incident notice wording to new and renewing contracts.
- Ask each of those vendors for the security documents they normally share.
- Record who owns each relationship.
Deliverable 3: a customer facing security summary
A one or two page summary of what you do today saves sales engineers hours. The rule is simple: every sentence must be something you can show. If a control is planned, label it as planned. Never describe an audit as complete before the report exists, and never call an attestation a certification.
What to measure
Count exercises held, actions closed from them, vendors with notice clauses, and questionnaires answered from the summary without new research. These show readiness without needing invented targets.
A staffing note
Quarter three often adds load on whoever answers customers. At smaller sizes the named owner does it all. Past a hundred or so engineers, it helps to have a defined intake for security requests, so engineers are not pulled into every questionnaire.
Safeguard's compliance and evidence automation can help collect evidence for the summary and for audits, and its policies and gates give you something concrete to describe. You can try a free scan before deciding whether any of it fits.
Quick check
Do we need an incident response plan before the exercise?
A rough one helps, but the exercise is a good way to find what the plan is missing. Start with roles, contacts and a decision path.
Can we publish a security page before an audit?
Yes, if it describes controls you operate and labels anything planned as planned.
Sources
- NIST SP 800-61 Rev. 3
- CISA Tabletop Exercise Packages
- CISA Cybersecurity Performance Goals (archived page that points to a newer version)
Last reviewed: 19 October 2026.
