Security Maturity Assessment Pack — Guide

Security Maturity & Internal Assessment

“How mature is our security?” usually gets a score: 3.2 out of 5, or 64%. A score hides the one weak practice that matters, invites arguments about decimals, and says nothing about what to do next. This pack answers the question differently. Each practice is rated on four levels, on evidence someone else has checked. Each area of the programme takes the level of its weakest practice. Management sets the level each area should reach before the evidence is scored. What comes out is a short list of gaps that matter and a plan to close them, never a single number.

Is this for you?

This pack is for you if:

• the board or a customer has asked how mature your security is, and you have only an opinion;
• your last assessment was a questionnaire your own team filled in;
• NIS2 asks you to assess whether your security measures work, and you have no method;
• you have a list of fifty gaps and no way to say which five come first.

How it works

The scale is the one the vulnerability maturity self-assessment and the metrics self-check already use:

Fourteen domains, from governance to recovery, hold 32 practices. Each practice says what evidence shows Defined and what Managed adds. An interview alone can never show more than Informal. Defined is the normal target; Managed is a target only where an obligation or a risk calls for measurement and independent checking.

No one rates a practice they run. In a small team that means a colleague from another function, a swap inside the team, or a peer from another organisation. Where none of these is possible, the result is marked self-assessed and cannot rise above Defined.

A maturity assessment is not an internal audit, a certification or a statement that you comply with anything. It can feed your management review, your internal audit programme and your risk register.

How it runs in practice

Take a distributor with 900 staff, three warehouses and an online ordering service, an important entity under NIS2. It ran its first assessment in September 2026. Its Internal Audit Manager, who runs none of the practices, led it. The Information Security Manager rated the practices IT runs, and the Head of Information Security rated none.

The Chief Operating Officer set the targets on 21 August, before any evidence was seen: Defined everywhere, and Managed for incident response. Fieldwork ran from 7 to 18 September.

Two of the fourteen domains met their target. Measurement and assessment was Not in place, because no one had ever assessed the programme before. Policy, risk, suppliers, recovery and most others were Informal. Usually one practice held the domain back: an exception that had expired and was still in use, five key suppliers not yet assessed, three of five critical services not restored in a test in the last year.

The method put five actions first. Three practices carry a risk outside appetite: backups, recovery testing and supplier assessment. One carries the cryptography policy the board had recorded as outstanding. The fifth was the lowest level found, the missing assessment itself. The Executive Committee reviewed the report on 30 September. The board will choose between three investment options on 29 October.

Start with these three

1. Security Maturity Model & Scoring Method: the levels, the 32 practices and the evidence each level needs, and the rules that turn evidence into a result.
2. Internal Security Assessment Procedure: who assesses what, the nine phases, and when to bring in an independent assessor.
3. Security Programme Maturity Assessment: the questionnaire that works out each domain’s level, target and gap.

Your first assessment

What to report

Each quarter, to the executive committee or the board:

• domains at their target, out of those assessed;
• priority actions closed on time and re-assessed;
• results that were self-assessed;
• months since the last full assessment.

Everything in the pack

Adapting it

• Your own domains: add a practice where your business needs one, with its Defined and Managed evidence. Mark a break in series before you compare with an earlier result.
• Certification: if you are working towards ISO/IEC 27001, the internal audit programme is the audit the standard asks for. A maturity assessment does not replace it.
• Financial entity: DORA requires an internal audit of the ICT risk management framework by independent auditors. This assessment can inform that audit but is not it.
• One-person security function: use a reciprocal assessor from a peer organisation, or contract one for the practices you run.

Framework references

• ISO/IEC 27001:2022: Clause 9.1.
• NIST CSF 2.0: ID.IM-01.
• NIS2: Article 21(2)(f).
• DORA: Article 6(6).