Roadmap: which hardening measure first?

Why prioritize?

The thirteen MHC are not to be understood as a linear sequence from MHC-01 to MHC-13. Without prioritization every control appears equally urgent — and that is precisely what makes the implementation decision harder. What is prioritized is not the control as such but its contribution to reducing the threats most relevant to the organization. This chapter combines two complementary views for that purpose: the measurable coverage breadth of each MHC (how many degraded controls it supports) and the threat- and effort-related sequence (threat correlation). The prioritization remains compatible with the overarching MRIS principle: structural controls before new detection or automation capabilities.

At a glance

• Purpose: a traceable, threat-oriented implementation roadmap instead of a linear MHC sequence.
• Basis: coverage breadth per MHC plus the threat priority score.
• Result: standard tiering P0/P1/P2 as an adaptable template, with dependency rules.
• Important: MHC-01 and MHC-13 have coverage 0 but may be P0 depending on architecture and data situation.

Coverage breadth: how many degraded controls each MHC supports

The following overview shows how many of the controls degraded under Mythos (categories "partially degraded" and "friction-only", 41 controls in total) each MHC flanks. The figures are verified against the assessment matrix in MRIS, Annex A (overall distribution 29 robust / 37 partially degraded / 4 friction-only / 23 not affected). Because a degraded control can be flanked by several MHC, the column total (44) is greater than 41. The column "also robust" additionally names flanked controls that are already robust — several MHC therefore harden robust controls further, beyond the degraded ones.

MHC-05 is by far the broadest cross-cutting control. Effect is measurably unevenly distributed — that is the strongest argument against the perception that every MHC is equally important.

Two priority views and how they relate

• Coverage breadth: unconditional leverage — how many degraded controls an MHC supports. High coverage means high leverage across many risks at once.
• Threat and effort relevance: the sequence — dependent on the threat landscape, impact, exposure, control gap, dependencies and effort.

The two views do not contradict each other; they complement each other. Coverage alone would place MHC-01 and MHC-13 last, because they flank only robust controls. That would be wrong: MHC-13 is potentially P0 for any organization with AI agents (it addresses the core of the Mythos threat landscape), and MHC-01 for long-lived confidential data. The rule is therefore: order by leverage, but with a threat and applicability gate — never by coverage alone. "Low hanging fruit" then means controls with high leverage, a large control gap and low effort, having regard to the dependencies.

Assessment logic: threat priority score

For the sequence, a simple, transparent score is formed per threat scenario. It makes visible whether an MHC is being prioritized because of a high threat level, high impact, strong exposure or a large control gap.

Threat priority score = threat relevance × business impact × exposure × control gap

Example: AI-supported phishing with threat relevance 5, business impact 4, exposure 5 and control gap 4 gives a score of 400 — very high priority, primarily for MHC-03, flanked by MHC-05 and MHC-11.

The threat priority score is a qualitative prioritization index, not a substitute for a formal risk analysis (ISO/IEC 27005) or an organization-specific risk matrix. Multiplying the factors makes relative action priorities visible; the value is ordinal, not metric — a score of 400 is not "twice as urgent" as 200 but serves ranking and triage.

Threat-to-MHC matrix

The matrix shows which MHC are particularly effective against which threat. It is suitable as a basis for the Statement of Applicability, the risk treatment plan and the implementation roadmap.

Dependencies as roadmap rules

The following logic prevents controls from being implemented in isolation when they only become effective, or meaningfully verifiable, through other MHC.

Standard prioritization P0 / P1 / P2

The following tiering is an example for typical enterprise environments. It must be reconciled with the actual threat landscape, asset criticality and applicability. MHC-01 and MHC-13 formally sit in P2 but move up where there is long-lived confidential data (MHC-01) or productive AI agent use (MHC-13). The standard tiering is not a universal implementation plan but a starting point; it is to be adjusted per organization to exposure, architecture, asset criticality, existing controls, resource position and regulatory context.

Note on the market situation (July 2026): the multi-vendor development and the disclosure waves now beginning (MRIS Chapter 2.5) raise the threat-level values of the supply chain and exploit volume scenarios for most profiles; upgrading MHC-02 and MHC-09 within the tiering is then justified.

Approach in four steps

• Step 1 — establish the threat landscape: identify relevant attacker types, TTPs and attack scenarios; take account of sector-specific threats (financial services, critical services, supply chain, cloud, AI); assess threats by currency, likelihood of occurrence and proximity to the organization.
• Step 2 — map threats to MHC: determine for each threat which MHC act preventively, detectively, reactively or in a validating role; weight controls with several threat relationships more heavily; document a sound rationale in the Statement of Applicability for controls that are not applicable.
• Step 3 — calculate the score: rate threat relevance, business impact, exposure and control gap from 1 to 5 each; form the score and take account of effort and dependencies; where risk is equal, take quick wins first — those with high risk reduction and low dependency.
• Step 4 — derive the roadmap: P0 (immediate measures against high threats and large gaps), P1 (controls with dependencies or technical groundwork), P2 (context-dependent controls and validation); reassess regularly as soon as the threat landscape, architecture or regulation changes.

Wording for governance documents

For the risk-based prioritization of the Mythos Hardening Controls, the MHC are correlated with relevant threat scenarios. For each threat it is assessed which controls act preventively, detectively, reactively or in a validating role. The prioritization follows from threat relevance, business impact, exposure, the existing control gap, dependencies and implementation effort. The result is not a linear MHC sequence but a threat-oriented roadmap that justifies, for each control, why it is implemented at its particular point in time.

Reading the maturity levels

The Initial level documents the implementation path begun and does not necessarily represent full fulfilment of the respective MHC control statement. Only from Defined onwards is an MHC deemed implemented in principle; Managed describes the advanced or continuously effective implementation. The control statements of the modules describe the minimum requirements of the Defined level; requirements going beyond that are expressly marked in the statement as advanced hardening (Managed level). For reporting this means: an MHC at the Initial level is recorded as "in implementation", not as implemented. Those wishing to connect the levels to a common maturity model can read them as follows: not implemented – Initial (partial) – Defined (implemented) – Managed (governed and optimized).

Sensitivity of the threat priority score

The score is a qualitative ordinal index without factor weights: the four factors are multiplied with equal standing. Because ordinal values are multiplied, the result is a ranking and not a metric quantity — decimal places or percentage comparisons would be false precision. Check step per organization: the rating of each factor is varied individually by one rating step, so far as that is substantively plausible; if the priority class changes as a result, the classification must be specifically justified (documented in the risk process under ISO/IEC 27005).

For the standard tiering of this guide the following applies: the four P0 controls each rest on at least two dominant factors (threat level and impact, or an enabler role) as well as on the dependency rules from Section 5. If the priority class of an MHC changes on variation of a single factor by one rating step, the classification is to be marked as sensitive and justified separately. Without a documented organization-specific sensitivity calculation, no statement is made here about the stability of the P0 set. What can be expected to react are mainly the ranks within P1 and P2 (typical candidates for change: MHC-06 and MHC-12 depending on exposure). Organization-specific deviations remain permissible and are to be documented.