Grades are how we help customers understand how to trade time for safety.
A Minimum Grade needs less upfront time to implement.
An Ideal Grade takes more time, but provides convenience and security that is required by some businesses.

The Minimum Grade is like soap. Washing our hands properly gives us a lot of protection against viruses and bacteria. Similarly, password managers (included in our Minimum Grade resources) give us a lot of protection against common cyber threats, like credential stuffing (Glossary: credential stuffing).

Stairs as analogy for grades.

Advanced practices, like monitoring the dark web for your leaked credentials, are justified in certain cases but unnecessary for most operations. With your team using password managers, you are no longer the lowest hanging fruit for most threat actors (Glossary: threat actor).

It's not feasible, nor required, that all businesses to aim for an Ideal Grade across the board. More realistic is an à la carte approach-

With a selective, à la carte approach, an operation aims for a Minimum Grade in all Layers, to meet regulations and move some of the way towards protecting against common risks. Then, the team picks those Layers most beneficial for additional investment towards Ideal. Our newsletter and archives will help you make these choices.