BSE 202: Compliance Standards

How to read this course. Among the questions FIR receives most often is a simple one: how mature is my community — or my plant, or my campus — really, and how would I show it? BSE 202 is FIR’s answer to the second half of that question: the scoring instrument. It does not tell you what to build or in what order; that is BSE 203. What it gives you is the standard an entity is measured against, and it begins by settling what that entity even is — the scope of the assessment — before anything is scored. From there it covers the ten capability-maturity dimensions (named, not lettered), the 0-5 rubric each is scored on, how the three threat vectors — cyber, physical, and electromagnetic pulse / geomagnetic disturbance (EMP-GMD) — are scored independently, and how the result is assembled into a scorecard that can be defended. The course ends where 203 begins: at the scores and gaps.

The lens. A score is not a private note; it is a representation. Funders, insurers, mutual-aid partners, and authorities will rely on what an entity claims about its readiness, and it will later be held to what it represented. Every scoring decision in this course is presented against one question: is this an honest representation of a measured condition? That question is why the Prudence Standard is covered at all — you learn to score honestly because someone will act on the number.

The standard. Partial-vector maturity is real, credited progress toward readiness — but it is not Black Sky Event readiness, and it must never be represented as such. Only verified maturity across all three vectors (Cyber, Physical, EMP-GMD) is Diamond Blue Readiness. A score describes a measured condition against a standard; it does not certify a guarantee. Presenting a partial or aspirational score as full readiness is a misrepresentation, not optimism — and it is exactly the representation FIR will not make and this course teaches you not to make.

A methodology-track course (prerequisites: the 099 -> 100 -> 101 -> 102 foundation chain) that teaches the FIR scoring instrument – the standard a community, facility, or campus is assessed against. BSE 202 begins with scoping the assessment (deciding exactly what is being measured – an entire metropolitan area, a municipality’s Continuity of Operations fallback, an industrial park, a single water plant, refinery, or shipping port, or a school or college campus), then covers the ten capability-maturity dimensions by name, the 0-5 maturity rubric, per-vector scoring across the three threat vectors (cyber, physical, and electromagnetic pulse / geomagnetic disturbance, or EMP-GMD), portfolio-managed scoring, and how to assemble a defensible scorecard. Its companion, BSE 203 (Roadmap Development), consumes the scores and gaps this course produces and turns them into a prioritized, costed, phased roadmap; 202 ends at the scorecard, 203 begins from it. The governing discipline throughout is the Prudence Standard: partial-vector maturity is real, credited progress toward readiness, but it is not Black Sky Event readiness and must never be represented as such – only verified maturity across all three vectors is Diamond Blue Readiness. Because a score is a representation others rely on, the course routes every decision about how a score is claimed or represented back to the community and its own counsel. Passing score is 80%. BSE 202 is a scoring standard and orientation, not legal, compliance, or procurement advice, and not a certification of readiness; FIR states the scoring standard, not the legal line.