Every prioritisation framework is impact against effort with a coat of paint. The useful version is honest about how imprecise both axes are, and leans on the one place the judgement is easy: the things that are nearly free.
The grid, filled in
| Low effort | High effort | |
|---|---|---|
| High impact | Registrar MFA · rua everywhere · non-sending domain lockdown · removing dangling records · np=reject | DMARC to enforcement · aligning third-party senders · DNSSEC on an unsigned estate |
| Lower impact | CAA · TLS-RPT · null MX · reverse DNS · auto-renew | DANE · BIMI · registry lock across an estate · a monitoring programme |
The top-left cell is the whole argument for doing this in the order the previous module described: it is a day of work, it carries no risk, and there is no version of the estate where it is the wrong thing to do first.
Where the axes are imprecise
IMPACT depends on things no framework knows: which domain the business actually depends on whether the exposure has ever been exploited what the organisation would lose, specifically EFFORT depends on things you cannot see yet: whether one vendor gates the whole DMARC programme whether the DNS provider supports what you need whether anyone can find the registrar login So: use the grid to sort, and expect to be wrong about the high-effort cells until you have started.
Re-rank after step one
The first week of a programme changes the estimates more than any amount of planning. Reports name senders nobody listed; one vendor turns out to gate everything; a domain thought parked is sending invoices. Re-rank once the evidence arrives, and say at the outset that you will — a plan presented as fixed and then changed reads worse than one presented as provisional and then refined.
Sequence high-impact-high-effort work behind its dependency
Enforcement is high impact and high effort, and most of that effort is elapsed time waiting for evidence and vendors. Starting it in week one — by publishing rua — costs nothing and means the waiting runs concurrently with everything else rather than after it.