A useful SABSA starting point for a small team is a one-page map for one critical service. Include the business process, key assets, main failure modes, required security properties, and the controls already in place. Then add one owner per control. If a control has no owner, it tends to drift. If a control has no clear link to a business risk, review whether it is still needed.










