Score every app on five risk axes in under 30 minutes. The output is a prioritized roadmap a CFO will sign. 

Most legacy assessments are 80-page PDFs nobody reads. This is a five-axis scoring model that fits on one page, takes 30 minutes per app, and produces a roadmap a board will actually fund. It is built to translate technical risk into language an audit committee already uses, and it maps cleanly to NIST CSF 2.0 and Gartner’s TIME framework.

Every legacy app is scored from 1 to 5 on five axes: Business Criticality, Security Exposure, Operational Fragility, Talent Risk, and Compliance Burden. The five scores sum to a total out of 25. Apps scoring 18 or higher are urgent and warrant action this fiscal year. Scores of 12 to 17 belong in the next 18-month roadmap. Below 12, the right move is to watch and rescore annually. This single number reframes the modernization conversation from technical debt to board-level risk.

Why a Scored Portfolio Matters Now

Three regulatory shifts have moved risk scoring from internal hygiene to external evidence. The SEC cybersecurity rule (Item 1.05 of Form 8-K) requires public companies to disclose material cybersecurity incidents within four business days of materiality determination. The proposed HIPAA Security Rule update (HHS NPRM issued December 27, 2024) would make many previously addressable safeguards required, including mandatory encryption and multi-factor authentication for ePHI. NIST CSF 2.0, finalized in February 2024, formally added the GOVERN function and expects a documented, repeatable risk assessment of material IT systems.

A scored portfolio with sourced inputs is exactly the evidence those regimes expect to see.

The Five Risk Axes

Axis: Business Criticality | Score 1 (low): Internal tool, low usage. | Score 5 (high): Revenue or regulated system of record. | Where to find the data: Revenue ops, finance.

Axis: Security Exposure | Score 1 (low): Internal only, no PII. | Score 5 (high): Internet-facing, handles PHI, NPI, or PCI data. | Where to find the data: Security team, last pen test.

Axis: Operational Fragility | Score 1 (low): Stable, automated recovery. | Score 5 (high): Manual restarts, undocumented dependencies. | Where to find the data: SRE and on-call logs.

Axis: Talent Risk | Score 1 (low): Modern stack, easy to hire. | Score 5 (high): One or two people know it and both are near retirement. | Where to find the data: HR, engineering leadership.

Axis: Compliance Burden | Score 1 (low): No specific regulations. | Score 5 (high): SOX, HIPAA, SOC 2, GLBA, plus open audit findings. | Where to find the data: Compliance, audit log.

The Scoring Bands

1. 18 to 25 (Urgent). Act this fiscal year. These apps are one incident, one resignation, or one audit finding away from a board-level event.
2. 12 to 17 (Planned). Slot into the 12 to 18 month roadmap. Begin discovery and vendor selection now so funding lands in the next budget cycle.
3. 6 to 11 (Watch). Annual review. Track for score drift. Talent Risk and Security Exposure rise the fastest, often without anyone updating the assessment.
4. 5 (Stable). Document the assessment and move on. Modernization budget spent here is budget not spent on the urgent tier.

A Field Example

A specialty hospital network ran this model against twelve critical apps in a four-hour workshop. Three landed in the Urgent band: an aging patient billing system, an on-premises imaging gateway, and a homegrown scheduler. The billing system had been on the next-year list for four budget cycles. The score moved it to a board agenda item the same quarter. The framing that worked was simple: the same data, presented as risk exposure rather than technical debt, changes who in the room cares.

Why the score works on a board: Boards lose interest in technical debt. They engage on risk, exposure, dependency, and ownership. The five-axis score speaks in language an audit committee already uses, with the same underlying data, and that reframing tends to produce very different funding outcomes.

How to Run the 30-Minute Scoring Workshop

The workshop is short on purpose. The goal is a defensible first-pass score, not a perfect one. Anything that takes longer than 30 minutes per app tends to never get done across a 60-plus app portfolio.

5. Pre-load the five inputs. Pull the source data for each axis the day before: revenue dependency from finance, last pen-test findings from security, on-call ticket counts from SRE, headcount and tenure from HR, open audit findings from compliance. Walking in without these turns a 30-minute scoring session into a two-hour debate.
6. Convene a small room. The app owner, one security lead, one SRE, and a facilitator from the CIO’s office. No more than five people. Larger rooms anchor on the loudest voice.
7. Score live, on a shared sheet. Each axis 1 to 5, with one sentence of rationale per score. The rationale is what makes the score auditable later.
8. Stop at 30 minutes. If a score is contested, mark it as a range (for example 3 to 4) and move on. Resolve ranges in a follow-up using the source data, not opinion.
9. Publish the score with the rationale. The score without the sentence behind it loses credibility within one budget cycle.

The Score Drift Watch List

Scores age fast in two specific axes. Build a quarterly check just for these, and an annual full rescore for everything else.

• Talent Risk. A single retirement, resignation, or reorg can move an app from a 3 to a 5 in a quarter. Tie this axis to HR’s retention dashboard, not to memory.
• Security Exposure. New CVEs, a new internet-facing integration, or a vendor that changes its data handling can move the score overnight. Hook this to the vulnerability management feed.
• Compliance Burden. Each new state privacy law, each SEC or HHS update, and each new customer audit requirement can push an app up a band. Review at the end of every quarter.
• Operational Fragility. Watch the rolling 90-day on-call ticket count. A 50 percent rise without a known cause usually means the app has quietly moved up a band.

Translating the Score for the Board

The score itself is an internal artifact. What goes to the board is a one-page summary: the number of apps in each band, the top five Urgent apps with a one-line risk statement each, the year-over-year movement of the portfolio average, and the dollar exposure on the Urgent band derived from the cost model (linked below). Boards approve modernization budget on that page. They rarely approve it on a 60-page technical appendix.

Two metrics consistently move the conversation. First, the percentage of the portfolio in the Urgent band, tracked quarterly. Second, the average time an app spends in the Urgent band before remediation starts. Both numbers are simple, comparable across years, and align with how audit committees already think about risk.

Common Mistakes to Avoid

• Letting the app owner self-score. They will under-score Operational Fragility and Talent Risk every time. Use the SRE on-call log and HR retention data as a check.
• Treating the score as final. Rescore quarterly for Urgent apps and annually for the rest. Talent Risk in particular moves quickly.
• Ignoring the bottom of the list. Apps scoring 5 to 8 are the best Retire candidates, and a retirement frees budget for the urgent ones.
• Skipping Compliance Burden because last year’s audit passed. SOC 2 expectations and SEC and HIPAA rules tighten yearly. Last year’s pass is not next year’s pass.
• Confusing the score with the roadmap. The score tells you what to act on. The 6Rs tell you how. A high score does not automatically mean Refactor or Replatform; sometimes a Retire or Repurchase is the right answer.
• Hiding the rationale. A score without a one-sentence rationale per axis dies the first time a senior leader pushes back. Publish the rationale alongside the number, every time.

Frequently Asked Questions

How is this different from Gartner’s TIME framework?

TIME (Tolerate, Invest, Migrate, Eliminate) is an outcome framework. This is an input scoring model that feeds TIME or the 6Rs. The two are complementary, not competing.

Do we need a dedicated tool for this?

A spreadsheet works fine for fewer than 50 apps. For 50-plus, an application portfolio management tool such as LeanIX or Ardoq is useful, but populate it with this scoring model rather than the vendor default.

Who owns the score inside the company?

The CIO’s office. Inputs come from security, SRE, HR, compliance, and the app owner. The score itself is owned centrally so it stays comparable across the portfolio.

Is the score auditable?

Yes, and that is the point. NIST CSF 2.0, SOC 2, and the SEC cybersecurity rule all expect a documented, repeatable risk assessment of material IT systems. A scored portfolio with sourced inputs is exactly what auditors want to see.

References

• NIST Cybersecurity Framework 2.0 — https://www.nist.gov/cyberframework
• SEC Cybersecurity Disclosure Rule (2023) — https://www.sec.gov/newsroom/press-releases/2023-139
• HHS HIPAA Security Rule NPRM (Dec 27, 2024) — https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html