Using Scenarios to Baseline Initial Security Readiness