Inputs
- Policies, standards and obligations
- Asset, identity and service inventories
- Configurations, scans and logs
- Staff interviews and known constraints
- Critical-service and supplier dependencies
The RACF-CC method
From evidence to sustainable improvement
A repeatable four-stage cycle for turning an imperfect view of risk into prioritised, safely implemented and demonstrably effective security improvement.
More than recommendations
A method with defined handovers
RACF-CC does not assume that buying a product, applying a policy or raising a dashboard score proves that risk has been reduced. Each stage receives evidence, performs a distinct kind of work and produces an output that can be reviewed before the organisation moves forward.
01
Understand produces an evidence-based current-state picture.
02
Prioritise produces a governed improvement plan.
03
Implement produces a safely deployed, owned control.
04
Evidence produces a validated outcome and next-cycle decision.
Across every stage
Governance is a continuous layer
Care impact, safeguarding, accessibility, privacy, legal and contractual duties, service continuity, approval and risk ownership should shape the whole cycle—not appear as a final compliance check.
01
Understand
Build a trustworthy picture of the environment
Begin with the services the organisation must sustain and the evidence actually available. Record uncertainty rather than treating absent telemetry as proof that no problem exists.
Core activities
- Identify essential services and sensitive information
- Map identities, devices, systems and trust relationships
- Validate evidence coverage and important blind spots
- Describe credible attack paths and care consequences
- Record assumptions, limitations and legacy dependencies
Primary output
A current-state evidence pack containing service dependencies, material control gaps, plausible risk scenarios and an evidence register.
Decision gate
Ready to prioritise when: decision-makers can explain what is exposed, why it matters, how reliable the evidence is and which unknowns remain.
Common failure: treating a platform score or incomplete inventory as a complete picture, leaving unmanaged and legacy systems outside the assessment.
02
Prioritise
Choose work by risk and operational reality
Compare meaningful security benefit with effort, cost and disruption. Mandatory or critical issues retain a separate governance requirement even when delivery is difficult.
Inputs
- Current-state evidence and attack paths
- Service criticality and care impact
- Legal, regulatory and contractual duties
- Available people, licensing and budget
- Dependencies, constraints and confidence levels
Core activities
- Define the risk reduction expected from each option
- Apply a consistent prioritisation model
- Test operational impact, accessibility and feasibility
- Separate governance obligations from numeric attractiveness
- Sequence prerequisites, interim mitigations and quick wins
Primary output
A governed improvement plan with rationale, owners, dependencies, target evidence, interim safeguards and required risk decisions.
Decision gate
Ready to implement when: priorities, ownership, resources and acceptance criteria are approved, and deferred risks have an authorised treatment.
Common failure: rewarding easy activity, chasing dashboard points or allowing a low numeric score to conceal an issue that still requires governance action.
03
Implement
Deliver change without losing control of the service
Translate the selected improvement into a tested operational change. Pilot where practical, communicate clearly and decide the conditions that would pause or reverse deployment.
Inputs
- Approved priority and accountable owner
- Technical design and intended scope
- Pilot group and success criteria
- Change, communication and support plans
- Rollback triggers and exception process
Core activities
- Validate prerequisites and recovery options
- Pilot or use report-only modes where appropriate
- Obtain proportionate technical and operational approval
- Apply staged enforcement and monitor early effects
- Communicate user impact and manage justified exceptions
Primary output
A safely deployed, owned control supported by a change record, communications, operational ownership, exceptions and a usable rollback route.
Decision gate
Ready to evidence when: the intended scope is deployed safely, material exceptions are recorded and the organisation knows what evidence will demonstrate effectiveness.
Common failure: moving directly from design to broad enforcement without piloting compatibility, preparing support or defining a realistic rollback decision.
Use the RACF-CC Safe Enforcement Pattern
Audit/report-only → pilot → validate → enforce → monitor → reviewApply the reusable pattern whenever a control can block access, applications, traffic, data movement, updates or care workflows. Open the Safe Enforcement guide →
04
Evidence
Prove what changed—and what did not
Test coverage, technical behaviour and operational effect against the baseline. Evidence should support a decision, not merely show that a setting exists.
Inputs
- Baseline measures and target evidence
- Current configuration and telemetry
- Validation or recovery-test results
- Service, user and support feedback
- Exceptions, incidents and observed side effects
Core activities
- Confirm intended coverage and technical operation
- Compare equivalent populations and measurements
- Assess disruption, accessibility and care impact
- Identify residual risk and evidence limitations
- Decide whether to sustain, extend, redesign or retire
Primary output
A validated outcome and next-cycle decision supported by control evidence, operational effects, residual risk, lessons and a review owner.
Decision gate
Ready to begin the next cycle when: the result and its limitations are understood, residual risks have owners and new evidence has updated the current-state picture.
Common failure: reporting a changed maturity score without checking control coverage, measurement denominators, operational consequences or remaining attack paths.
Compact worked example
Strengthening privileged-account authentication
This simplified example shows how one improvement moves through the method. Local design and governance would still be required.
Understand
Identify privileged identities, current authentication methods, emergency access, legacy dependencies, sign-in patterns and gaps in available evidence.
Output:Defined exposure and baseline.Prioritise
Assess likely account-compromise reduction against licensing, administration effort, user impact and compatibility. Flag any mandatory treatment separately.
Output:Approved scope, owner and success measures.Implement
Protect emergency access, pilot with administrators, review report-only results, communicate the change and enforce in controlled stages with rollback criteria.
Output:Deployed control with managed exceptions.Evidence
Verify authentication coverage, sign-in outcomes, exception use and support impact. Record residual legacy paths and decide the next improvement.
Output:Validated result and residual-risk decision.Practical artefacts
The method creates a usable evidence trail
Future RACF-CC spreadsheets and downloadable templates can support these handovers without becoming the framework itself.
See how control status is evidenced →- Evidence and dependency register
- Prioritised improvement record
- Implementation and rollback plan
- Control validation record
- Exception and residual-risk register
- Next-cycle action log
Continue the RACF-CC journey
Use the method, then test it against evidence.
Compare proposed controls with the prioritisation tool, explore the relevant domain guidance and see how the cycle worked in an anonymised care environment.