Module 08 · Lesson 09

Where is your program today?

A maturity assessment tells you where you are, where you need to be, and what it takes to close the gap. This is your roadmap to structured improvement.

NIST CSF Tiers

The four levels

TierNameKey indicators
1PartialAd-hoc, reactive, informal. Security varies by individual.
2Risk InformedSome processes defined but inconsistently applied. Aware of risk.
3RepeatableFormal, org-wide. Policies defined, implemented, regularly reviewed.
4AdaptiveContinuous improvement, predictive indicators, threat intel sharing.

Most organizations should target Tier 3 baseline with Tier 4 for critical capabilities.

Assessment Domains

What to assess

Govern
Governance
Policies, roles, risk appetite, board engagement, culture
Protect
Controls
IAM, data protection, infrastructure, awareness, supply chain
Detect
Detection
Monitoring, SIEM, alert triage, threat hunting, anomaly detection
Respond
Response
IR plan, communication, containment, forensics
Recover
Recovery
BCP/DR, backup testing, lessons learned, improvements
Identify
Assets & Risk
Asset inventory, risk assessment, data classification, compliance
The Gap Analysis

Current → Target → Roadmap

Step 1
Assess current state for each domain. Be honest — overrating yourself creates blind spots.
Step 2
Define target state based on risk appetite, regulatory requirements, and available resources.
Step 3
Identify gaps. Which gaps create the most risk? Which are cheapest to close?
Step 4
Prioritize. Build a phased roadmap: 6-month, 12-month, 24-month targets.
Step 5
Reassess annually. Maturity is a moving target as threats and business evolve.
Common Mistakes

What goes wrong

Mistake
Aiming for Tier 4 everywhere
Not every capability needs maximum maturity. Over-investing in low-risk areas wastes resources needed elsewhere.
Mistake
Self-assessing too high
Teams rate themselves Tier 3 when they're Tier 1.5. Use evidence: "show me the documented process" — if it doesn't exist, it's not repeatable.
Mistake
Assessment without action
A beautiful maturity heatmap that sits on a shelf. Assessment is only valuable if it drives a roadmap with accountability.
Mistake
One-time exercise
Maturity changes as threats evolve. Annual reassessment minimum. Tie to budget cycle for maximum impact.
Communicating to Leadership

The maturity conversation

The message that works with boards:

"We are at Tier 2 across most capabilities. Our regulatory requirements and peer benchmarks suggest we need to be at Tier 3. Here is the investment required, the timeline, and the risk reduction it achieves."

This is clear, actionable, and connects security to business outcomes. It answers: where are we, where should we be, what does it cost, and what do we get?

Key Takeaway

Measure, then improve

Remember this

Maturity models are communication tools as much as assessment tools. They translate security posture into language leadership understands.

Target maturity by risk, not by ambition. Tier 3 everywhere is better than Tier 4 in one place and Tier 1 in five others.

The assessment is only valuable if it produces a funded roadmap with accountability and timeline.

1 / 7