You already ask grantees about cyber-preparedness. This is how you find out.
A questionnaire tells you whether an organization has a policy. It cannot tell you whether anyone has read it, who is allowed to shut down a server at 2am, or how long it would take to warn the people they serve. One hour of rehearsal tells you all three — and the grantee is better off either way.
A capacity-building line, not a software purchase.
Grantees are slow to buy tools and quick to say yes to training. This is training — led, written up and evidenced — which is why it survives a budget conversation that a subscription would not.
- Step 01
Sponsor the group
One agreement covers every grantee in your portfolio. They sign in and run their own drills, with nothing for each organization to buy separately.
- Step 02
They keep the report
The After-Action Report belongs to the organization that ran the drill. It is theirs to act on and theirs to send you — the value does not depend on you seeing it.
- Step 03
You see the roll-up
Which organizations have rehearsed, where the group as a whole is weakest, and how many of the fixes they promised actually got done. Not a self-assessment score.
Nobody is being tested, scored or ranked.
If a grantee thinks the funder is marking them, you get a performance instead of a rehearsal — and the gaps you most need to hear about are exactly the ones nobody will admit to. So decisions are recorded against a role and never against a person, and the roll-up reports on the group as a whole rather than grading the organizations in it.
It is also not a penetration test or a security audit. Nothing is installed in a grantee's systems and no password or account access is ever requested. It is a discussion in a room, on a clock.
17 scenarios today, covering ransomware, payment fraud, account takeover, a departing member of staff, a breach at a supplier, data sent to the wrong people, and a social-media account taken over in public.
Start with one grantee, and one hour.
Pick an organization you trust to be honest with you, have them run a drill, and read the report they produce. If it tells you something a grant report never has, the wider conversation is easy. If it does not, you have spent an hour.