RACF-CC Starter Path
A practical starting route into RACF-CC for organisations that do not yet have a complete security baseline, mature governance process or dedicated cybersecurity team.
Two ways in
The Starter Path is guidance, not another assessment. Use the route that matches what you already know.
Use the path from Step 1 when you are unsure where to start or do not yet have a dependable view of the environment.
Start with Define → Already know the problemUse this route when an audit issue, incident lesson, vulnerability, platform recommendation or known weakness is already supported by evidence.
Go to Choose →Your first improvement cycle
These are not five new framework stages. They are a guided entry route into the existing four-stage lifecycle.
Define
Do not begin with the whole organisation if that makes the work unmanageable. Choose one service, environment or operational concern that can be understood well enough to support a decision.
Missing evidence is useful information. Note what is uncertain and carry that confidence judgement into later decisions.
Look
Use a compact evidence sweep across the eight domains. Follow meaningful exposure rather than completing every domain equally for the sake of a full dashboard.
MFA coverage, privileged and stale accounts, risky authentication and access policy.
02Managed-device coverage, encryption, protection, unsupported systems and compliance.
03Broad rules, flat networks, remote access, legacy exposure and management interfaces.
04Known-exploited vulnerabilities, patch gaps, insecure protocols and configuration drift.
05Backup and restore evidence, sensitive sharing, encryption and recovery requirements.
06Which meaningful alerts are reviewed, by whom, how often and with what response.
07Incident routes, containment actions, playbooks, records and escalation decisions.
08Risk ownership, exceptions, change evidence, reviews and links between risk and controls.
A Secure Score, vulnerability count or compliance percentage can contribute evidence, but it should not be treated as the complete risk picture.
Treat it as a risk decision, not a closed finding. The legacy-risk guide shows how to reduce exposure, retain evidence and set a review or exit path.
Choose
Evidence and attack-path reasoning identify the problem and a plausible treatment. Prioritisation then helps sequence that treatment; it does not decide what constitutes a security problem.
Privileged administrators can authenticate using ordinary MFA methods.
Phishing or session compromise could provide privileged access.
Require phishing-resistant authentication for privileged roles.
Reduce viable authentication paths for an attacker targeting privileged accounts.
Keep the first cycle achievable
Combine related findings into meaningful control improvements. Investigate lower-confidence issues further rather than turning every weakness, recommendation or dashboard finding into an immediate project.
Complete, validate and sustain a manageable set before beginning the next cycle.
Current RACF-CC model
Compare Risk Reduction with Implementation Effort, Operational Impact and Cost. Risk Reduction is weighted twice as strongly as each individual delivery constraint.
Priority Score = (Risk Reduction × 2) − (Effort + Impact + Cost)
The result supports First, Next, Develop or Review decisions. The calculated tier indicates sequencing, not absolute security importance. Record Confidence separately and use Governance Action where duties, active exploitation or an unacceptable critical-service threat require management attention.
Act
The purpose of prioritisation is not to produce a prettier spreadsheet. Choose a priority that can move into controlled implementation with realistic ownership and safety measures.
Not every control needs every stage. Use the full Safe Enforcement Pattern where enforcement could disrupt access, systems, information flows or care delivery.
Prove
Check whether the control operated, whether the expected exposure reduced, whether legitimate services continued to work and what risk remains.
Worked evidence chain
A firewall change is an activity. This evidence chain shows whether it achieved a useful and supportable outcome.
Your first RACF-CC cycle
Microsoft 365 privileged access.
Some privileged identities lack phishing-resistant MFA.
Prioritise stronger administrator authentication.
Protect emergency access, pilot and enforce in stages.
Validate coverage, outcomes, exceptions and support impact.
Move to the next meaningful exposure.
What you should have at the end
Start with one defensible improvement
Define what matters, understand a meaningful exposure, choose a proportionate treatment, implement it safely and retain enough evidence to show whether it worked.
Already have evidence of a specific problem? Go directly to the Control Prioritisation Tool.