Apply · Practices
The practice model
Every virtue, four bands, twenty practices. Foundation makes the behaviour explicit; Controlled embeds it into the operating model; Measured verifies it happens; Adaptive changes it when the evidence says it is no longer enough.
A band is not a maturity score. A team can be strong in one virtue and weak in another. Read a virtue upward: each band assumes the one before it.
- 01Virtue
- 02Behaviour
- 03Practice
- 04Control
- 05Evidence
- 06Assessment
The model at a glance
Table scrolls horizontally.
| Virtue | 1 · Foundation | 2 · Controlled | 3 · Measured | 4 · Adaptive |
|---|---|---|---|---|
| 義Gi | Make ownership explicit | Control decisions and privilege | Measure attribution | Improve accountability |
| 勇Yū | Enable investigation | Formalise response | Measure investigation | Adapt detection and response |
| 仁Jin | Understand users | Design usable controls | Measure friction | Continuously redesign |
| 礼Rei | Define boundaries | Enforce least privilege | Test boundaries | Continuously re-authorise |
| 誠Makoto | Define truth | Control data quality | Measure accuracy | Automate trust and uncertainty |
| 名誉Meiyo | Define the standard | Assure the controls | Measure effectiveness | Raise and adapt the standard |
| 忠義Chūgi | Define responsibility | Embed stewardship | Measure participation | Distribute responsibility |
| 自制Jisei | Define discipline | Control actions | Measure exceptions | Design for pressure |
01 / 08
Gi
Integrity / rectitude
In one line · Own your actions.
3 / 4 Measured
Verify that the behaviour is happening and that it works.
Measure stale exceptions
Track exceptions past their review or expiry date.
Discipline: ZanshinRemain aware
Report accountability gaps
Include unattributed privileged activity and overdue ownership actions in security reporting.
Discipline: ZanshinRemain aware
4 / 4 Adaptive
Use evidence to improve the behaviour and respond to change.
Learn from accountability failures
Use incidents and near misses to identify where responsibility was unclear.
Discipline: ZanshinRemain aware
Reassess authority boundaries
Review whether decision rights still match the organisation's current architecture and operating model.
Discipline: ZanshinRemain aware
Challenge risk acceptance
Periodically review recurring accepted risks and determine whether the organisation has normalised them.
Discipline: ZanshinRemain aware
02 / 08
Yū
Courage
In one line · Act under uncertainty.
3 / 4 Measured
Verify that the behaviour is happening and that it works.
Track delayed escalation
Identify incidents where evidence existed but action was delayed.
Discipline: ZanshinRemain aware
4 / 4 Adaptive
Use evidence to improve the behaviour and respond to change.
Turn hunts into detections
Convert repeatable hunting discoveries into automated or semi-automated detection.
Discipline: ZanshinRemain aware
Feed incidents into architecture
Use recurring investigation findings to change identity, network, endpoint and application design.
Discipline: ZanshinRemain aware
Reward justified intervention
Recognise analysts and engineers who escalate credible concerns early, including cases that ultimately prove benign.
Discipline: ZanshinRemain aware
03 / 08
Jin
Benevolence
In one line · Design for the people using the control.
1 / 4 Foundation
Make the behaviour explicit and repeatable.
Make reporting easy
Provide simple mechanisms for reporting phishing, lost devices, suspicious activity and accidental exposure.
Discipline: ZanshinRemain aware
2 / 4 Controlled
Embed the behaviour into processes and ownership.
Review workarounds
Treat repeated bypasses as signals that the control or process needs examination.
Discipline: ZanshinRemain aware
3 / 4 Measured
Verify that the behaviour is happening and that it works.
Track exception demand
Look for teams repeatedly requesting the same exception.
Discipline: ZanshinRemain aware
Test usability after deployment
Reassess controls after major changes in technology or business processes.
Discipline: ZanshinRemain aware
4 / 4 Adaptive
Use evidence to improve the behaviour and respond to change.
Continuously redesign workflows
Treat security user experience as an operational product that needs maintenance.
Discipline: ZanshinRemain aware
Automate exception alternatives
Where the same exception appears repeatedly, determine whether it should become a supported pattern.
Discipline: ZanshinRemain aware
04 / 08
Rei
Respect
In one line · Respect boundaries.
3 / 4 Measured
Verify that the behaviour is happening and that it works.
Review stale vendor access
Track external identities that remain active beyond their business need.
Discipline: ZanshinRemain aware
4 / 4 Adaptive
Use evidence to improve the behaviour and respond to change.
Move toward continuous authorisation
Reassess access based on identity, device, context and resource sensitivity.
Discipline: ZanshinRemain aware
Revalidate trust boundaries
Review segmentation and access models when applications, organisations or infrastructure change.
Discipline: ZanshinRemain aware
Treat access as a lifecycle
Design access from creation through review to removal rather than as a one-time approval.
Discipline: ZanshinRemain aware
05 / 08
Makoto
Sincerity
In one line · Verify reality.
1 / 4 Foundation
Make the behaviour explicit and repeatable.
Record freshness
Make the age of security data visible.
Discipline: ZanshinRemain aware
2 / 4 Controlled
Embed the behaviour into processes and ownership.
Monitor security telemetry
Detect when log sources, agents, scanners or integrations stop reporting.
Discipline: ZanshinRemain aware
Establish data-quality workflows
Assign discrepancies to owners and track them to resolution.
Discipline: ZanshinRemain aware
3 / 4 Measured
Verify that the behaviour is happening and that it works.
Measure data freshness
Identify security data that has become too old to support decisions.
Discipline: ZanshinRemain aware
Track reconciliation gaps
Measure recurring differences between authoritative and operational datasets.
Discipline: ZanshinRemain aware
4 / 4 Adaptive
Use evidence to improve the behaviour and respond to change.
Automate reconciliation
Continuously compare inventories and security platforms.
Discipline: ZanshinRemain aware
Detect silent failure
Alert when a security control stops producing expected evidence.
Discipline: ZanshinRemain aware
06 / 08
Meiyo
Honour
In one line · Maintain the standard without supervision.
1 / 4 Foundation
Make the behaviour explicit and repeatable.
Record known failures
Create a visible process for reporting controls that do not work.
Discipline: ZanshinRemain aware
2 / 4 Controlled
Embed the behaviour into processes and ownership.
Run continuous assurance
Test important controls throughout the year.
Discipline: ZanshinRemain aware
Track control degradation
Monitor controls as systems, ownership and integrations change.
Discipline: ZanshinRemain aware
Review standards
Update standards when architecture, threats or business processes change.
Discipline: ZanshinRemain aware
3 / 4 Measured
Verify that the behaviour is happening and that it works.
Track overdue assurance
Monitor controls that have not been tested on schedule.
Discipline: ZanshinRemain aware
Measure recurring findings
Identify weaknesses that repeatedly appear in audits and assessments.
Discipline: ZanshinRemain aware
4 / 4 Adaptive
Use evidence to improve the behaviour and respond to change.
Remove recurring control failures
Treat repeated findings as process or architecture problems.
Discipline: ZanshinRemain aware
Challenge accepted weaknesses
Review whether long-standing accepted risks are still justified.
Discipline: ZanshinRemain aware
07 / 08
Chūgi
Loyalty
In one line · Treat access as responsibility.
1 / 4 Foundation
Make the behaviour explicit and repeatable.
Teach intervention
Tell people what to do when they see suspicious activity or unsafe behaviour.
Discipline: ZanshinRemain aware
Provide reporting mechanisms
Make reporting accessible without requiring specialist knowledge.
Discipline: ZanshinRemain aware
2 / 4 Controlled
Embed the behaviour into processes and ownership.
Support responsible reporting
Ensure employees can report mistakes and suspicious activity without first resolving the issue themselves.
Discipline: ZanshinRemain aware
3 / 4 Measured
Verify that the behaviour is happening and that it works.
Measure reporting behaviour
Track useful reports of phishing, suspicious activity and control failures.
Discipline: ZanshinRemain aware
Measure security participation
Track participation in exercises, training and operational security activities.
Discipline: ZanshinRemain aware
4 / 4 Adaptive
Use evidence to improve the behaviour and respond to change.
Use incidents to clarify ownership
Where an incident exposes responsibility gaps, change the operating model.
Discipline: ZanshinRemain aware
Treat privilege as stewardship
Review whether privileged access is still supported by the responsibility that justified it.
Discipline: ZanshinRemain aware
08 / 08
Jisei
Self-control
In one line · Control your actions under pressure.
3 / 4 Measured
Verify that the behaviour is happening and that it works.
Measure emergency changes
Track how often emergency procedures are used.
Discipline: ZanshinRemain aware
Audit temporary controls
Find expired exceptions, exclusions and temporary rules that remain active.
Discipline: ZanshinRemain aware
4 / 4 Adaptive
Use evidence to improve the behaviour and respond to change.
Reduce emergency demand
Use recurring emergency changes to identify weaknesses in architecture or process.
Discipline: ZanshinRemain aware
Learn from exceptions
Treat repeated emergency behaviour as evidence that the normal operating model needs to change.
Discipline: ZanshinRemain aware