How do we tell whether our security programme is mature, and which gaps matter?

Start

We want to know how mature our security programme really is

Maturity is how reliably each security practice is done: whether it happens at all, whether it depends on particular people, whether it is written down and leaves a record, and whether it is measured, checked and improved. It describes how the practice works, not how exposed you are today, so read the result beside the risk register. A maturity result is not an internal audit, a certification or a statement of compliance. It can feed the management review, the internal audit programme and the risk register.

• Then: Use one four-level scale, in words, for every practice

Step

Use one four-level scale, in words, for every practice

Not in place: the practice does not exist, or happens only by chance. Informal: it happens, but depends on particular people and is not written down or not done consistently. Defined: it is written down, agreed and done routinely, and leaves a record. Managed: as Defined, and also measured, checked by someone else and improved. The levels are words. They are not numbers to add, average or weight.

• Then: Split the programme into domains and practices

Step

Split the programme into domains and practices

Assess practices, not technology. The pack's model has 14 domains, from governance to recovery, each made of two or three practices. Every practice is a question with the evidence Defined needs and what Managed adds, so the assessor knows what to look for before the interviews start.

• Then: Does every practice apply to you?

Decision

Does every practice apply to you?

A practice may be left out only for a reason the sponsor approves and the report states, such as a notification duty you are outside or a service you do not run. A weak practice never counts as not applicable: it is Not in place or Informal, and the result says so.

• Yes: Approve a target for every domain before scoring
• No, for an approved reason: Record the sponsor-approved reason for each one left out

Step

Record the sponsor-approved reason for each one left out

Write the reason in the assessment plan and the report. A domain whose practices all do not apply is left out of the result, and the report says why. A practice that does apply stays in, however weak it is.

• Then: Approve a target for every domain before scoring

Step

Approve a target for every domain before scoring

The sponsor approves a target level for each domain, in writing and dated, before any evidence is scored, with a reason: an obligation that rests on it, a risk outside appetite, or a business need. Defined is the default. Managed is a target only where one of those reasons needs measurement and independent checking. A target set after the results tends to settle at the level found, which hides the gap.

• Then: Can someone who does not run each practice rate it?

Decision

Can someone who does not run each practice rate it?

No one rates a practice they own, do, manage day to day, or wrote the procedure for. A colleague from another function, such as a finance controls manager, a risk manager or internal audit, is usually the best choice. If you are not sure that an assessor is independent of a practice, treat them as not independent.

• Yes, for every practice: Rate each practice on evidence, not on description
• No, or not known, for some: Mark those results self-assessed, capped at Defined

Step

Mark those results self-assessed, capped at Defined

A self-assessed result is still useful: it is marked so the reader knows how far to rely on it, and it cannot be above Defined until someone independent checks the evidence. Count them. If more than a third of the results would be self-assessed, the pack's procedure asks the sponsor to decide on an independent assessment.

• Then: Rate each practice on evidence, not on description

Step

Rate each practice on evidence, not on description

An interview alone supports Informal at most, and so does a written procedure with no records of it being done. Defined needs the practice's Defined evidence seen by the assessor; Managed needs Tested, a sample the assessor chose and checked. Only records in the evidence window count: by default the 12 months up to the last day of fieldwork. The assessor chooses any sample, not the practice owner, and every sampled record must pass. Each result states how it was evidenced: Told, Seen or Tested.

• Then: Set each domain at the level of its weakest practice

Step

Set each domain at the level of its weakest practice

A domain's level is the lowest of its practices that apply, with no average and no rounding. Two Defined practices and one Informal make an Informal domain, because the domain depends on the weak practice. Managed beside Not in place is Not in place, never something in between.

• Then: Show each domain's level, target and gap in words

Step

Show each domain's level, target and gap in words

The gap is the target minus the level, counted in levels. There is no overall score, percentage or weighting: a number out of 100, a traffic-light total or a radar chart joining the domains are all scores, and each hides the weak practice that matters. A count such as "2 of 14 domains at target" describes the result without scoring it.

• Then: Is any domain below its target?

Decision

Is any domain below its target?

A domain at or above its target has no gap. The sponsor may then spend less effort on it. Every practice below its domain's target gets an action, so this answer decides whether there is an improvement plan to make.

• No: At target: keep the cycle and re-assess within 12 months
• Yes: Is a recorded risk or unmet obligation resting on the practice?

Outcome

At target: keep the cycle and re-assess within 12 months

Report the result to the approver and keep the full assessment cycle; by the pack's default it runs at least every 12 months. Re-assess a domain sooner after a significant incident, a major change to systems or the organisation, or a new obligation that rests on it.

Decision

Is a recorded risk or unmet obligation resting on the practice?

A practice is pressing when a risk recorded as outside appetite in the risk register, or an obligation recorded as not met by the body that owns it, rests on it. A practice the assessor merely thinks is important is not pressing, and neither is one the registers say nothing about. If you believe a risk is outside appetite but it is not recorded, raise it with the risk owner through your own risk process.

• Yes, on record: Put its action first, the lower level first among them
• No, or not on record: Order the rest: lower level, then larger gap

Step

Put its action first, the lower level first among them

Pressing practices come before all others. Among them, the practice at the lower level goes first. In the pack's example four practices were pressing: the policy set, because the board had recorded a NIS2 measure as outstanding until its policy was approved; supplier assessment, because a payment fraud risk was outside appetite; and backups and recovery testing, because a ransomware risk was outside appetite.

• Then: Order the rest: lower level, then larger gap

Step

Order the rest: lower level, then larger gap

After the pressing practices, take the practice at the lower level first, then the domain with the larger gap, then domain and practice order. A practice already at Defined that sits in a domain with a Managed target comes late, because it moves only to meet the higher target.

• Then: Plan one level per action, a few priority actions per cycle

Step

Plan one level per action, a few priority actions per cycle

Each action moves one practice up one level. A practice at Not in place with a target of Defined needs two actions, so the plan shows whether the first took hold. Managed can be claimed only after at least 6 months at Defined, with records. By the pack's default up to 5 actions take priority in one cycle.

• Then: Take the targets, gaps and plan to the approver

Outcome

Take the targets, gaps and plan to the approver

The top approver depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. Ask for three decisions: the targets, the plan, and the investment it needs. Then pass the results to the management review, the internal audit programme and the risk register.