Assessment Evidence Request Checklist

Lists the evidence to request per domain and how to judge whether it demonstrates the claimed level.

Available soon

Format: Excel
Size: 79 KB
Length: 12 sheets
Version: 1.3
Updated: 2 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.33 Oct 2026
DM-14 names P23.
1.22 Oct 2026
DM-14 Recovery and continuity names P22.
1.12 Oct 2026
MP-24 names the monthly restore check of the ordering platform (P10 EA-04).

Earlier versions (1)

1.02 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Before you start: the assessment plan names an assessor for every practice, and the sponsor has approved a target for every domain (MA-09, Internal Security Assessment Procedure). On the Domain Results sheet, enter the fieldwork dates and confirm the settings. The evidence window and the date by which requests must go out calculate from them.
2	On the Evidence Requests sheet, name the practice owner and the assessor for each row. No one may assess a practice they own or run (MA-14, which applies P08's IS-07). If there is no other way, mark the row self-assessed and its result is capped at Defined.
3	Send each owner the "Evidence to request" text for their practices, at least [[10]] working days before fieldwork (Internal Security Assessment Procedure, phase PH-3). The Request Note sheet has wording you can adapt. Enter the date sent. The Request column shows whether it went in time.
4	Ask for whole registers and lists, not examples. You choose the sample, not the owner (MA-05). Where the request says [[three]] or [[five]], that is the number to check; take all of them where there are fewer.
5	In fieldwork, read "How to judge it" before you look at the evidence. Check that each record falls in the evidence window (MA-04). Interview the owner to understand the records, not instead of them (MA-02).
6	For each practice, choose "Evidence shown", then the confidence: Told (nothing shown), Seen (a record shown) or Tested (you checked a sample). Then choose the level the evidence supports on its face. The Level Evidence sheet says what Defined and Managed need for each practice.
7	The workbook works out the level the evidence demonstrates. A Told result cannot be above Informal; Managed needs Tested; a self-assessed result cannot be above Defined (MA-13, MA-14). The Check column says when a cap applied or an answer does not fit.
8	Write a note for every row: what you saw, and why the level is not higher. A practice is Not applicable only for a reason the sponsor approved, written in the note (MA-08).
9	Read the Domain Results sheet. Each domain's level is the lowest level among its practices (MA-06). The gap is the target minus that level, counted in levels (MA-10). Nothing is added, averaged or weighted (MA-07).
10	Show each owner the draft results. They may add evidence within [[5]] working days. The assessment lead decides, and records any disagreement in the note (MA-16). Then copy the decided results into the Security Programme Maturity Assessment and the Maturity Assessment Report Template.
11	To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column on the Evidence Requests sheet, and the targets and reasons on the Domain Results sheet. The practices and formulas stay. Rows at the foot of the sheet take practices you add; give each an ID and a domain from the list.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

The rules for judging evidence are on the How to Judge sheet. MA-14 applies P08's IS-07: "Internal auditors must not audit their own work."

This document helps you judge how well your security practices work. It is not legal advice, and a maturity result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law or a certification asks for an assessment or an audit, confirm with counsel or your certification body what it must include.

A maturity result is not an internal audit, a certification or a statement of compliance, and is never presented as one. It can feed the management review, the internal audit programme and the risk register. This checklist gathers the evidence; it does not test controls as an audit would.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State. Its first assessment, ASM-2026-1, was led by its Internal Audit Manager, who runs none of the practices. Requests went out on 24 Aug 2026; fieldwork ran from 7 Sep 2026 to 18 Sep 2026, with an evidence window from 19 Sep 2025. The Evidence Requests sheet shows the results after validation.

Domains with no published pack: DM-11 Protection of systems and data and DM-12 Detection and monitoring. Their practices are generic. Judge them on the same evidence rules; the Level Evidence sheet says what each level needs.

Tailoring — small organisation: one record can answer several practices, such as a single security plan with its objectives and report. Name it on each row it answers. Independence still applies: see the options in the Internal Security Assessment Procedure.

Tailoring — IT run by a service provider: records the provider keeps count only if you can see them. Ask for them through the contract owner, and note on the row whose record it is.

Tailoring — group of companies: where the parent holds a record, such as a group policy, ask for it and check that it covers your organisation and was applied here.

This workbook is your own record. Keep it with the assessment plan, the evidence and the report.

Evidence Requests

One row per practice, by domain. Yellow columns are yours; Request, Level demonstrated and Check calculate. Read "How to judge it" before the evidence.

Row	Practice ID	Domain	Practice	Evidence to request	How to judge it	Practice owner	Assessor	Requested on	Request	Evidence shown	Confidence	Level the evidence supports	Self-assessed	Level demonstrated	Check	Assessor's note: what was seen, and why not higher
EXAMPLE	MP-01	Governance and accountability	Accountable person	The role description or appointment record, and the last objectives review.	The named person must hold the role today. A role description for a vacant post, or one never approved, is Informal at most.	Chief Operating Officer	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Defined	No	Defined	OK	The Head of Information Security's role description, approved by the Executive Committee, sets out the role's reporting line and authority. Objectives are not yet reviewed against results each year.
EXAMPLE	MP-02	Governance and accountability	Management reporting	The last [[four]] reports and the minutes of the meetings that received them.	Minutes that note a report was received, with no decision or question recorded across the window, are Informal: reporting happens, governance does not yet.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Tested	Defined	No	Defined	OK	The last four quarterly board reports and their minutes each record decisions, such as the approval of the security measures on 30 Jul 2026 (P12). The decisions are not yet tracked back to the board as a list.
EXAMPLE	MP-03	Governance and accountability	Security objectives	This year's objectives with their approval, and the latest progress report.	A strategy document without dated, owned objectives is Informal.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Defined	No	Defined	OK	The 2026 security plan has nine milestones with owners and dates, reported to the board each quarter (P03: 7 of 9 on track).
EXAMPLE	MP-04	Policy	Policy set	The policy register with approval and review dates, and [[three]] policies chosen by the assessor.	A policy past its review date without a recorded extension counts against Defined. A sample in which any policy has no approval record is not Defined.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	No	Informal	OK	Recent policies were approved at the right level, such as classification on 14 Jul 2026 (P15). There is no cryptography policy, and no register shows when each policy is due for review.
EXAMPLE	MP-05	Policy	Policy acknowledgement	Acknowledgement records for [[ten]] people chosen by the assessor, including [[two]] recent joiners.	A sampled joiner with no acknowledgement within the time the policy sets means Defined is not met.	HR Director	Internal Audit Manager	24 Aug 2026	Sent in time	No	Told	Defined	No	Informal	Capped by confidence (MA-13)	HR said every joiner acknowledges the policies at induction, but could not show the records during fieldwork, so the result is capped at Informal (MA-13).
EXAMPLE	MP-06	Risk management and exceptions	Risk register	The risk method, the register, and the record of its last two reviews.	A register whose ratings cannot be traced to the method, or whose risks have no named owner, is Informal.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Tested	Defined	No	Defined	OK	Twelve risks, each with an owner and a rating by the written method. R-04 was re-rated on 20 Aug 2026 after the August ransomware incident (P05).
EXAMPLE	MP-07	Risk management and exceptions	Risk appetite	The appetite statement with its approval, and the decisions for each risk outside appetite.	A risk outside appetite with no recorded decision at the level the method sets means Defined is not met.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Defined	No	Defined	OK	The board approved the appetite on 30 Jul 2026. Both risks outside it, R-01 and R-02, carry a decision to treat them; R-01's funding goes to the board on 29 Oct 2026 (P05 TA-01).
EXAMPLE	MP-08	Risk management and exceptions	Exceptions	The exception register, and [[three]] exception records chosen by the assessor.	An expired exception still in use without a renewal decision means Defined is not met.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Tested	Informal	No	Informal	OK	Four exceptions are open, and one of them expired and is still in use without a renewal decision (P03).
EXAMPLE	MP-09	Third-party security	Supplier tiering and contracts	The supplier register, and the contracts of [[three]] high-tier suppliers chosen by the assessor.	A high-tier supplier with no security clause and no recorded plan to add one means Defined is not met.	Procurement	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Defined	No	Defined	OK	Every supplier with access to data or systems is tiered (14 in Tier 1, 22 in Tier 2, 31 in Tier 3, 45 in Tier 4), and the three Tier 1 contracts sampled carry the incident notification clause (P06 CL-07).
EXAMPLE	MP-10	Third-party security	Supplier assessment	The assessments and the last review of [[three]] high-tier suppliers.	A questionnaire sent and never assessed is Informal.	Information Security Manager	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	No	Informal	OK	9 of 14 Tier 1 suppliers were assessed by the end of fieldwork; the other 5 are planned from 20 Oct to 8 Dec 2026 (P06). One High finding is past its deadline.
EXAMPLE	MP-11	Legal and regulatory obligations	Obligations known and owned	The obligations register and the record of its last review.	A NIS2 or DORA classification that was never recorded or approved means Defined is not met for an organisation that may be in scope.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Defined	No	Defined	OK	The NIS2 scope assessment, approved by the board on 21 May 2026, records the company as an important entity (P12). The applicability profile approved on 15 Sep 2026 records its GDPR role and that DORA does not apply (P18).
EXAMPLE	MP-12	Legal and regulatory obligations	Compliance checked	The last compliance check and the gaps it recorded.	A check done once, for a certification or a customer, and not repeated is Informal.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	No	Informal	OK	The board approved the NIS2 measures on 30 Jul 2026, but no check of whether they are in place had been made by the end of fieldwork. The first readiness self-assessment is set for 30 Sep 2026 (P12).
EXAMPLE	MP-13	Measurement and assessment	Security metrics	The metric definitions and the data quality records of the last reporting cycle.	Metrics produced by tools and reported as supplied are Informal at most.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Tested	Defined	No	Defined	OK	Every reported metric has an approved definition card and a validator who is not its supplier, and data quality checks ran in the July and August cycles (P11).
EXAMPLE	MP-14	Measurement and assessment	Assessment and follow-up	The last assessment or audit report and the tracker of its findings.	An assessment whose findings have no owners or dates is Informal. A first assessment can be Defined only once its findings have been followed up and their closure checked, which the next assessment shows.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Not in place	No	Not in place	OK	No assessment or audit of the security programme had been made before this one (P12).
EXAMPLE	MP-15	Assets and information	Asset inventory	The inventory, and the record of the last check against another source.	An inventory last updated outside the evidence window is Informal.	Head of IT	Information Security Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	No	Informal	OK	Devices and cloud services are listed in IT's tools, in separate lists, with no owner for each and no set process to keep them current.
EXAMPLE	MP-16	Assets and information	Information classification	The scheme, the handling rules, and the record of the last handling check.	A scheme published but never applied to real information is Informal.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Tested	Defined	No	Defined	OK	The classification policy was approved on 14 Jul 2026, the information register built on 28 Aug, and the first handling check made on 17 Sep 2026 (P15).
EXAMPLE	MP-17	Vulnerabilities and patching	Finding and prioritising vulnerabilities	The coverage report, the prioritisation method, and [[five]] findings chosen by the assessor.	Prioritisation by scanner score alone, without the organisation's own method, is Informal.	Head of IT	Information Security Manager	24 Aug 2026	Sent in time	Yes	Seen	Defined	No	Defined	OK	Scans cover the in-scope systems, and findings are prioritised by the written method. The board receives the share of the most urgent fixes made on time (P03).
EXAMPLE	MP-18	Vulnerabilities and patching	Fixing on time	The deadlines, and the remediation records of [[five]] findings chosen by the assessor.	A missed deadline with no approved deferral in the sample means Defined is not met.	Head of IT	Information Security Manager	24 Aug 2026	Sent in time	Yes	Tested	Informal	No	Informal	OK	The most urgent fixes made on time fell to 81% against a target of 95% (P03). Two of the five findings sampled missed their June deadline with no approved deferral; deferrals have been approved as exceptions only since the patch standard was approved on 3 Sep 2026 (P17).
EXAMPLE	MP-19	Identity and access	Joiners, movers and leavers	Access records for [[five]] joiners and [[five]] leavers chosen by the assessor from HR records.	Samples must be chosen from HR records, not from the access system, or late removals cannot be seen.	Head of IT	Information Security Manager	24 Aug 2026	Sent in time	Yes	Tested	Defined	No	Defined	OK	Five leavers sampled from HR records: four had their access removed in time. The fifth was found by the monthly reconciliation and removed, so the practice caught its own failure (MA-05) (P13).
EXAMPLE	MP-20	Identity and access	Access reviews	The last review of [[two]] systems chosen by the assessor, with the removals it led to.	A review that removed nothing across several systems deserves a sample check: an approve-all review is Informal.	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	No	Informal	OK	The first review campaign under the procedure started on 1 Sep 2026 and had not closed by the end of fieldwork (P07). Earlier reviews were made by system owners in their own way, with no record of removals. Disagreement recorded: The Head of Information Security held that the earlier reviews count. The lead kept Informal: they left no record of what was removed (MA-02).
EXAMPLE	MP-21	Identity and access	Privileged access	The privileged account list and the approval records of [[three]] accounts chosen by the assessor.	Shared administrator accounts with no record of who used them mean Defined is not met.	Head of IT	Information Security Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	No	Informal	OK	The privileged account inventory was built on 16 Sep and the standard approved on 18 Sep 2026, but separate administrator accounts went live only on 21 Sep, after fieldwork (P14).
EXAMPLE	MP-22	Awareness and training	Training	The training plan and the completion records for [[ten]] people chosen by the assessor.	One course for everyone, with no role-based training, is Informal.	Information Security Manager	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Tested	Defined	No	Defined	OK	A training plan by audience for July 2026 to June 2027, approved on 26 Jun 2026 (P16). Completion records for the ten people sampled were complete.
EXAMPLE	MP-23	Awareness and training	Behaviour measured	The measure's definition and its last [[four]] values.	Completion rates alone measure attendance, not behaviour: Informal at most.	Information Security Manager	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Defined	No	Defined	OK	The reporting rate of simulated phishing is measured each month from July 2026 (P16). It has no target yet.
EXAMPLE	MP-24	Protection of systems and data	Backups restored	The backup schedule, and the records of the last [[two]] restore tests.	Backups that have never been restored in a test are Informal, whatever the backup reports say.	Head of IT	Information Security Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	No	Informal	OK	Critical data is backed up daily, and an offline copy is kept. Since May 2026 IT has restored and checked one backup of the ordering platform each month (P10 EA-04), and the August incident restores worked (P09). No restore test is set for the rest of the critical data, so restoring it is not yet routine.
EXAMPLE	MP-25	Protection of systems and data	Secure configuration	The baselines and the build records of [[three]] systems chosen by the assessor.	Vendor defaults with ad hoc hardening are Informal.	Head of IT	Information Security Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	No	Informal	OK	Servers are built to a checklist. Office PCs had local administrator rights until the August incident, and their removal is due by 31 Oct 2026 (P09 PIA-01).
EXAMPLE	MP-26	Detection and monitoring	Logging	The log source list, and evidence that [[three]] sources chosen by the assessor reach the central store.	Logs kept only on the systems that produce them are Informal.	Information Security Manager	Information Security Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	Yes	Informal	OK	Logs from the ordering platform and the firewalls reach the managed provider's store; the warehouse systems' logs stay on the systems. There is no list of the sources required. Self-assessed: no one independent could judge the technical evidence in the time.
EXAMPLE	MP-27	Detection and monitoring	Alert handling	The alert criteria, and the triage records of [[five]] alerts chosen by the assessor.	Alerts sent to a mailbox that nobody is assigned to watch are Not in place.	Information Security Manager	Information Security Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	Yes	Informal	OK	Alerts go to the managed provider and the Information Security Manager, with no written criteria or response times. Self-assessed, for the same reason as MP-26.
EXAMPLE	MP-28	Incident response and notification	Incident procedure	The procedure and the records of [[two]] incidents chosen by the assessor.	A procedure that recent incident records do not follow is Informal.	Information Security Manager	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Tested	Defined	No	Defined	OK	The Q3 incidents followed the procedure's severity levels and roles, and the August ransomware incident had a post-incident review on 27 Aug 2026 (P09).
EXAMPLE	MP-29	Incident response and notification	Notification readiness	The applicability record, the last readiness check, and the reportability decisions of the window.	Where no notification duty applies, record Not applicable with the reason (MA-08).	Head of Information Security	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Informal	No	Informal	OK	The notification procedure was adopted on 15 Sep 2026; its first readiness check, on 18 Sep 2026, was Not ready (P18). The re-check on 25 Sep 2026 falls after fieldwork.
EXAMPLE	MP-30	Incident response and notification	Exercises	The exercise programme and the report of the last exercise.	An exercise held with no lessons recorded is Informal.	Information Security Manager	Internal Audit Manager	24 Aug 2026	Sent in time	Yes	Seen	Defined	No	Defined	OK	The tabletop of 18 Mar 2026 has an after-action report, approved on 31 Mar 2026, with an owner for each lesson (P10). Raised from Informal at validation, when the owner added the after-action report on 23 Sep 2026.
EXAMPLE	MP-31	Recovery and continuity	Recovery plans	The critical service list with its objectives, and the recovery plans of [[two]] services chosen by the assessor.	Recovery objectives set by IT without the business owner's agreement are Informal.	Head of IT	Information Security Manager	24 Aug 2026	Sent in time	Yes	Seen	Defined	No	Defined	OK	The 5 critical services have recovery objectives agreed by their business owners, and a recovery plan each.
EXAMPLE	MP-32	Recovery and continuity	Recovery tested	The records of the last recovery test of [[two]] critical services.	A test that restored data but never measured the time against the objective is Informal.	Head of IT	Information Security Manager	24 Aug 2026	Sent in time	Yes	Tested	Informal	No	Informal	OK	2 of the 5 critical services were restored within their objectives in a test in the last 12 months (P03). The ordering platform cannot yet be restored within 24 hours; P05's TA-01 would rebuild its recovery.

Domain Results

Domain results and settings

Each domain's level, worked out from the Evidence Requests sheet as the lowest level among its practices that apply (MA-06), and its gap to the target the sponsor approved before scoring (MA-09, MA-10). No overall score, percentage or weighting (MA-07).

EXAMPLE: the results of ASM-2026-1, after validation. Clear the EXAMPLE answers and targets to use your own.

Your settings

Setting	Value	What it does
First day of fieldwork	7 Sep 2026	Requests must go out at least the lead time before this date (Internal Security Assessment Procedure, PH-3).
Last day of fieldwork	18 Sep 2026	The evidence window ends on this date (MA-04).
Evidence window (months)	12	MA-04: records count only if they fall in this many months up to the last day of fieldwork, or in the practice's own last cycle where it runs less often.
Request lead time (working days)	10	PH-3: working days between sending the requests and the first day of fieldwork.
Sample size	3	MA-05: recurring records checked per practice, or all of them if there are fewer. A request may name its own number.
Evidence window starts	19 Sep 2025	Calculated: the day after the same date the window's length earlier.
Send requests by	24 Aug 2026	Calculated: the lead time in working days before fieldwork, weekends excluded. Add your public holidays by hand.

Results by domain

Domain ID	Domain	Practices	Judged	Level now (lowest)	Target	Gap (levels)	Practices below target	Self-assessed	Reason for the target
DM-01	Governance and accountability	3	3	Defined	Defined	0	0	0	Default. NIS2 makes the management body answerable for the security measures (P12).
DM-02	Policy	2	2	Informal	Defined	1	2	0	Default. The board recorded the cryptography policy as outstanding on 30 Jul 2026 (P12, measure (h)).
DM-03	Risk management and exceptions	3	3	Informal	Defined	1	1	0	Default.
DM-04	Third-party security	2	2	Informal	Defined	1	1	0	Default. Supplier payment fraud, R-02, is outside appetite (P05).
DM-05	Legal and regulatory obligations	2	2	Informal	Defined	1	1	0	Default.
DM-06	Measurement and assessment	2	2	Not in place	Defined	2	1	0	Default. NIS2 asks for policies and procedures to assess whether the security measures are effective.
DM-07	Assets and information	2	2	Informal	Defined	1	1	0	Default.
DM-08	Vulnerabilities and patching	2	2	Informal	Defined	1	1	0	Default.
DM-09	Identity and access	3	3	Informal	Defined	1	2	0	Default.
DM-10	Awareness and training	2	2	Defined	Defined	0	0	0	Default.
DM-11	Protection of systems and data	2	2	Informal	Defined	1	2	0	Default. Ransomware taking ordering offline, R-01, is outside appetite (P05).
DM-12	Detection and monitoring	2	2	Informal	Defined	1	2	2	Default.
DM-13	Incident response and notification	3	3	Informal	Managed	2	3	0	Incidents test the programme most often, NIS2's reporting deadlines rest on the response, and R-01 is outside appetite. Response must be measured and checked by someone other than the team that runs it.
DM-14	Recovery and continuity	2	2	Informal	Defined	1	1	0	Default. R-01 is outside appetite (P05).

A gap of 0 means the domain is at or above its target. "Not all judged": a practice in the domain has no level yet. "Left out (MA-08)": every practice is Not applicable; say why in the report.

Counts

Count	Result	What it counts
Domains at target (MAM-01)	2 of 14	Domains with a gap of 0, out of the domains with a level.
Practices below target, each needing an action (MA-11)	18	One action per practice, moving it one level (MA-12). The order is set in the tracker.
Self-assessed results (MAM-03)	2 of 32	Never more than a third. Above that, the sponsor decides whether to commission an independent assessment, and records the decision (IT-3).
Results capped by a rule	1 of 32	Rows where the confidence or self-assessment held the level below what the evidence supports on its face.
Evidence shown	31 of 32	Rows where at least one record was shown. The others rest on interview alone.
Results evidenced Told	1 of 32	Described in an interview, with nothing shown.
Results evidenced Seen	21 of 32	A document or record was shown, and it says what the practice needs.
Results evidenced Tested	10 of 32	The assessor chose a sample of records and checked each one against the practice.
Requests not sent, or sent late	0	Late requests leave owners less time, and the evidence arrives during fieldwork.

These are the checklist's working results. The results the lead decides after validation go in the Security Programme Maturity Assessment and the report.

Sign-off

Role	Name	Date	Signature or reference
Evidence judged by (Assessors)	[[Names]]	[[YYYY-MM-DD]]	[[Reference]]
Draft results shown to practice owners by (Assessment lead)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Results decided by (Assessment lead)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]

Level Evidence

What each level needs, practice by practice

From the Security Maturity Model & Scoring Method. Defined needs the evidence in the third column; Managed needs all of it and the fourth column too (MA-03). Informal: someone can describe it and show one instance. Not in place: no evidence.

Practice	Practice and domain	Defined needs	Managed adds
MP-01	Accountable person (Governance and accountability)	A role description or appointment, approved by management, that names the person accountable for security, their reporting line and their authority.	Their objectives are reviewed each year against results by the person they report to, and the role was changed at least once because of a review.
MP-02	Management reporting (Governance and accountability)	A security report to the board or its equivalent at least every quarter, and minutes that record the decisions taken on it.	The report's measures have targets, and the decisions and actions it leads to are tracked to closure and reported back.
MP-03	Security objectives (Governance and accountability)	Written security objectives for the year, approved by management, each with an owner, a date and how it will be measured.	Progress is reported at least each quarter, and an objective that will be missed leads to a recorded decision.
MP-04	Policy set (Policy)	A policy set, each policy approved at the level its tier requires, with an owner and a review date, published where staff can read it.	Reviews are measured as on time or late and reported, and policy breaches and exceptions are used to revise the policies.
MP-05	Policy acknowledgement (Policy)	Records of acknowledgement for the policies staff must follow, taken on joining and after each material change.	The acknowledgement rate is measured and reported, and those who have not acknowledged are followed up to a deadline.
MP-06	Risk register (Risk management and exceptions)	A written risk method, a register in which every risk has an owner and a rating made by that method, and a review of the register at the interval the method sets.	Treatment progress and risks outside appetite are measured and reported, and the method was changed at least once because of what the reviews found.
MP-07	Risk appetite (Risk management and exceptions)	An appetite statement approved by the approver, and a decision recorded at the right level for every risk outside it: treat, or accept with the reason.	Appetite is reviewed each year, and the number of risks outside it, and their age, is reported to management each quarter.
MP-08	Exceptions (Risk management and exceptions)	An exception register in which every exception has a risk owner, an approver at the level its rating requires, compensating controls and an expiry date.	Expired and renewed exceptions are counted and reported, and an exception renewed more than the rules allow goes to the next level up.
MP-09	Supplier tiering and contracts (Third-party security)	A supplier register in which every supplier with access to data or systems has a tier, and the contracts of the highest tier carry the security clauses the tier requires.	The share of high-tier suppliers whose contracts carry the required clauses is measured, and gaps are closed at renewal to a plan.
MP-10	Supplier assessment (Third-party security)	An assessment on record before contract for every supplier in the highest tiers, and a periodic review at the interval the tier sets.	Overdue reviews are counted and reported, and assessment findings are tracked to closure with the supplier.
MP-11	Obligations known and owned (Legal and regulatory obligations)	A register of the security obligations that apply, each with an owner and the date it was last confirmed, including whether NIS2, DORA or the GDPR apply and in which role.	The register is reviewed at least each year and whenever the business changes, and a new obligation reaches the register within a set time.
MP-12	Compliance checked (Legal and regulatory obligations)	A check against each obligation at least each year, with gaps recorded and assigned.	Gaps are tracked to closure and reported, and the checks are made by someone other than the obligation's owner.
MP-13	Security metrics (Measurement and assessment)	A written definition for every reported metric, a named owner, and data quality checks recorded before each report.	Metrics are reviewed each year against the decisions they serve, and failed data checks are used to fix their sources.
MP-14	Assessment and follow-up (Measurement and assessment)	A planned assessment or internal audit at least each year, its findings in a tracker with owners and dates, and closure checked by someone other than the action owner.	Overdue findings are counted and reported to management, and the assessment method was improved at least once because of what an assessment showed.
MP-15	Asset inventory (Assets and information)	An inventory of devices, software and cloud services, each with an owner, kept current by a set process.	Completeness is checked against another source, such as network discovery or purchasing records, and differences are measured and fixed.
MP-16	Information classification (Assets and information)	A classification scheme approved by management, handling rules for each level, and records showing information is labelled and handled by them.	Handling is checked on a sample at a set interval, and the results are reported and used to change the rules or the training.
MP-17	Finding and prioritising vulnerabilities (Vulnerabilities and patching)	Scan coverage of the in-scope assets on record, and a written prioritisation method applied to every finding.	Coverage is measured against the inventory and reported, and the method was adjusted because of what the measures showed.
MP-18	Fixing on time (Vulnerabilities and patching)	Written remediation deadlines by priority, records showing fixes against them, and a deferral approved as an exception whenever a deadline is missed.	Fixes within deadline are measured and reported, and fixes are verified by a rescan before closure.
MP-19	Joiners, movers and leavers (Identity and access)	A written process with approval before access, and records showing leavers' access removed within the time it sets.	Removal times are measured and reported, and the process was changed because of a late removal.
MP-20	Access reviews (Identity and access)	Access reviews of the in-scope systems at the interval the procedure sets, with removals made and recorded.	Completion and removal rates are measured and reported, and reviews are checked by someone other than the reviewer.
MP-21	Privileged access (Identity and access)	A list of privileged accounts with an owner and approval for each, separate accounts for privileged work, and strong authentication on them.	Privileged activity is logged and reviewed, and the number of privileged accounts is measured and reported.
MP-22	Training (Awareness and training)	A training plan by audience, records of completion, and additional training for roles at higher risk.	Completion is measured and followed up, and the plan is changed each year from incidents and risks.
MP-23	Behaviour measured (Awareness and training)	A written measure of behaviour, such as the reporting rate of suspicious emails, collected at a set interval.	The measure has a target, it is reported, and the programme was changed because of it.
MP-24	Backups restored (Protection of systems and data)	A backup schedule for critical data, a copy protected from the systems it backs up, and records of restore tests at the interval set.	Restore success and time are measured and reported, and failed restores lead to recorded changes.
MP-25	Secure configuration (Protection of systems and data)	Written configuration baselines for the main system types, and records showing new systems are built to them.	Drift from the baseline is detected and measured, and the baselines are reviewed at a set interval.
MP-26	Logging (Detection and monitoring)	A list of the systems whose logs are collected, central collection protected from change, and retention as the organisation has decided.	Missing log sources are detected and reported, and the list is reviewed when systems change.
MP-27	Alert handling (Detection and monitoring)	Written criteria for the alerts that must be reviewed, a response time, and records of triage.	Triage times and missed alerts are measured and reported, and the criteria are tuned from incidents and false positives.
MP-28	Incident procedure (Incident response and notification)	An approved incident procedure with severity levels and named roles, and incident records that follow it.	Response measures are reported, and post-incident reviews lead to changes that are tracked to closure.
MP-29	Notification readiness (Incident response and notification)	A record of which regimes apply, a written way of deciding whether to report, named people with tested access to each authority's channel, and records of decisions made.	Decisions and reports on time are measured, and readiness is re-checked at a set interval.
MP-30	Exercises (Incident response and notification)	An exercise programme, at least one exercise held in the evidence window, and its lessons recorded with owners.	Lessons are tracked to closure and reported, and the programme varies scenarios and participants from year to year.
MP-31	Recovery plans (Recovery and continuity)	A list of critical services with recovery time objectives agreed by their business owners, and a recovery plan for each.	The objectives are reviewed each year, and plans are updated after each test or real recovery.
MP-32	Recovery tested (Recovery and continuity)	Recovery tests at the interval set, with the time achieved recorded against the objective.	Results are reported, and every missed objective leads to a recorded change.

The packs that show how to raise each domain

Domain	Name	What it covers	Packs
DM-01	Governance and accountability	Who is accountable for security, what management receives, and what it decides.	P03 Board Cybersecurity Reporting
DM-02	Policy	Whether the rules people must follow are written, approved, known and kept current.	P04 Security Policy Management
DM-03	Risk management and exceptions	Whether security risks are assessed, owned and treated within an approved appetite, and exceptions are controlled.	P05 Information Security Risk Management; P02 Security Exception, Waiver & Segregation of Duties
DM-04	Third-party security	Whether suppliers are tiered by risk, bound by contract, and assessed before and during the relationship.	P06 Third-Party Security Risk Management
DM-05	Legal and regulatory obligations	Whether the obligations that apply are known, owned and checked.	P12 NIS2 Implementation & Readiness; P08 ISO 27001 Implementation & Certification Readiness
DM-06	Measurement and assessment	Whether the programme measures itself and assesses itself, and acts on what it finds.	P11 Cybersecurity Metrics & Reporting Programme; P19 Security Maturity & Internal Assessment (this pack)
DM-07	Assets and information	Whether the organisation knows what it has and how sensitive its information is.	P15 Information Classification & Handling
DM-08	Vulnerabilities and patching	Whether weaknesses are found, prioritised and fixed on time.	P01 Vulnerability & Exposure Management; P17 Patch Management
DM-09	Identity and access	Whether access is granted, reviewed and removed on rules, and privileged access is controlled.	P13 Joiner-Mover-Leaver & Access Provisioning; P07 User Access Review; P14 Privileged Access Management
DM-10	Awareness and training	Whether people know what to do, and whether their behaviour changes.	P16 Security Awareness Programme
DM-11	Protection of systems and data	Whether systems are configured securely and data can be restored.	No published pack covers this domain yet. Its practices are generic: judge them on the evidence alone.
DM-12	Detection and monitoring	Whether attacks and failures are seen in time.	No published pack covers this domain yet. Its practices are generic: judge them on the evidence alone.
DM-13	Incident response and notification	Whether incidents are handled to a plan, reported on time, and rehearsed.	P09 Security Incident Management; P18 Regulatory Incident Notification & Reporting; P10 Cyber Incident Exercises & Tabletop Scenario Library
DM-14	Recovery and continuity	Whether critical services can be restored within the time the business needs.	P22 Cyber Resilience & Recovery; P23 Backup & Restore Assurance

How to Judge

How to judge evidence

The same tests for every practice, so that two assessors looking at the same evidence give the same level.

The four levels

Level	What it means	What the assessor must see
Not in place	The practice does not exist, or happens only by chance.	Nothing. This is the level when there is no evidence that the practice happens, or it happens only by chance.
Informal	It happens, but depends on particular people and is not written down or not done consistently.	Someone can describe how it is done and show at least one instance, but there is no agreed written way of doing it, or the records are not kept consistently.
Defined	It is written down, agreed and done routinely, and leaves a record.	The practice's Defined evidence, seen by the assessor: a written, agreed way of doing it, and records in the evidence window showing it was done routinely. Where the assessor checks a sample, every sampled record must pass (MA-05).
Managed	As Defined, and it is also measured, checked by someone else and improved.	All of Defined, and the practice's Managed evidence: a measure with a target that is reported, a check by someone other than the person who does the work, and a record of at least one improvement made because of them.

How a result was evidenced (MA-13)

Confidence	What it means	Supports up to
Told	Described in an interview, with nothing shown.	Informal
Seen	A document or record was shown, and it says what the practice needs.	Defined
Tested	The assessor chose a sample of records and checked each one against the practice.	Managed

A self-assessed result cannot be above Defined, whatever the confidence (MA-14).

The rules the judgement follows

Rule	What it says
MA-02	Evidence decides the level. An interview alone supports Informal at most. A written procedure with no records of it being done supports Informal at most, because Defined needs the practice to be done routinely and leave a record.
MA-03	Levels build on each other. Managed needs everything Defined needs, and more; a practice that is measured but not written down is Informal.
MA-04	Records count only if they fall in the evidence window: the [[12]] months up to the last day of fieldwork, or the practice's own last cycle where it runs less often.
MA-05	Where the assessor checks recurring records, the sample is [[3]], or all of them if there are fewer, chosen by the assessor, not by the practice owner; a result is Tested only on such a sample. A sampled record that fails means the level is not met, unless the practice itself caught and corrected the failure and recorded it.
MA-06	A domain's level is the lowest level among its practices that apply. No average, no rounding.
MA-07	There is no overall score, no percentage and no weighting. The result is each domain's level and target, in words, and the gap between them.
MA-08	A practice is Not applicable only for a reason the sponsor approves and the report states, never because it is weak. A domain with every practice Not applicable is left out of the result, and the report says why.
MA-13	Every result states how it was evidenced: Told, Seen or Tested. A level above Informal needs at least Seen; Managed needs Tested.
MA-14	No one rates a practice they own or run (P08 IS-07). Where no independent assessor is available for a practice, the result is marked self-assessed and cannot be above Defined until someone independent checks the evidence.

Mistakes to avoid

Mistake	What goes wrong	The fix
PF-01	Rating what should happen instead of what does.	Rate only on evidence in the window (MA-02, MA-04), and check a sample the assessor chooses (MA-05).
PF-02	Turning the levels into a single score.	Report each domain's level and target in words, and never add, average or weight them (MA-06, MA-07).
PF-05	The security team rating its own practices.	Assign assessors so no one rates their own work; mark and cap what cannot be (MA-14).

What does not count as evidence

Case	Why	What to record
An interview alone	It describes the practice; it does not show that it happens (MA-02).	Told. The result cannot be above Informal.
A written procedure with no records	Defined needs the practice done routinely, leaving a record (MA-02).	Seen, at Informal at most.
Records the owner picked	A chosen example shows the best case, not the routine (MA-05).	Choose the sample yourself from the full register or list.
Records outside the window	Old records show the practice once ran, not that it runs now (MA-04).	Ask for records in the window; if there are none, the level is not met.
A record that fails in the sample	The level is not met (MA-05).	Unless the practice caught and corrected the failure and recorded it.

Request Note

Request note: wording to adapt

Send one note to each practice owner, at least [[10]] working days before fieldwork, with the rows of the Evidence Requests sheet for their practices.

Part	Wording
Subject	Evidence request: security maturity assessment [[assessment ID]], [[your practices]]
To	[[Practice owner]]
From	[[Assessment lead]], on behalf of [[Assessment sponsor]]
Why	[[Sponsor]] has commissioned an assessment of how reliably our security practices work. It rates each practice on four levels: Not in place, Informal, Defined and Managed. It is not an audit and it does not rate you.
What we ask	Please send the evidence listed in the attached rows for the practices you own: [[practice IDs]]. Send whole registers and lists. We choose the records to check from them.
Which records	Records from [[evidence window start]] to [[last day of fieldwork]] count. Where your practice runs less often than that, send the records of its last cycle.
By when	[[Date: at least two working days before fieldwork starts]]. Tell us at once if a record does not exist; that is a result too, and a useful one.
Where	[[Secure folder or route]]. Do not send personal data beyond what the request asks for; send records that name people only where the request needs them, such as joiners and leavers.
Interview	[[Assessor]] will meet you on [[date]] for about [[an hour]] to go through the evidence.
After fieldwork	You will see the draft results for your practices and may add evidence within [[5]] working days. The assessment lead then decides each result.
Contact	[[Name, email, telephone]]

Lists

Level	Answer	Confidence	ConfidenceCap	YesNo	Domain
Not in place	Not in place	Told	2	Yes	Governance and accountability
Informal	Informal	Seen	3	No	Policy
Defined	Defined	Tested	4		Risk management and exceptions
Managed	Managed				Third-party security
	Not applicable				Legal and regulatory obligations

Measurement and assessment

Assets and information

Vulnerabilities and patching

Identity and access

Awareness and training

Protection of systems and data

Detection and monitoring

Incident response and notification

Recovery and continuity

Definitions

Definitions

Term	Meaning in this workbook
Maturity	How reliably a security practice is done: whether it happens at all, whether it depends on particular people, whether it is written down and leaves a record, and whether it is measured, checked and improved. It describes how the practice works, not how exposed the organisation is today.
Domain	One area of the security programme, such as risk management or identity and access, made up of two to three practices (DM-01 to DM-14).
Practice	One thing the programme does, stated as a question with the evidence each level needs (MP-01 to MP-32). Practices are what the assessor rates.
Level	One of the four levels of the scale: Not in place, Informal, Defined or Managed. The scale is P01-A09's, and P11 uses it too.
Not in place	The practice does not exist, or happens only by chance.
Informal	It happens, but depends on particular people and is not written down or not done consistently.
Defined	It is written down, agreed and done routinely, and leaves a record.
Managed	As Defined, and it is also measured, checked by someone else and improved.
Domain level	The lowest level among a domain's practices that apply. One weak practice limits the domain, and an average would hide it (MA-06).
Target	The level management decides a domain should reach, set before the evidence is scored, with the reason for it (MA-09).
Gap	The number of levels between a domain's level and its target: 0 when the target is met, up to 3 (MA-10).
Evidence	A document or record that shows a practice is done as the level requires. Interviews explain evidence; they are not evidence of Defined or Managed on their own (MA-02).
Evidence window	The period records must fall in to count: the [[12]] months up to the last day of fieldwork, or the practice's own last cycle where it runs less often than that (MA-04).
Sample	The records the assessor chooses, not the practice owner, to check that a practice is done as its level requires (MA-05).
Confidence	How a result was evidenced: Told, Seen or Tested (MA-13).
Told	Described in an interview, with nothing shown. Supports a level up to Informal.
Seen	A document or record was shown, and it says what the practice needs. Supports a level up to Defined.
Tested	The assessor chose a sample of records and checked each one against the practice. Supports a level up to Managed.
Self-assessed	A result given by someone who owns or does the practice. It is marked as such and cannot be above Defined until someone independent checks the evidence (MA-14).
Not applicable	A practice that does not apply, for a reason the sponsor approves and the report states (MA-08).
Level the evidence supports	The level the evidence would show on its face, before the confidence and self-assessment caps.
Level demonstrated	The level after the caps of MA-13 and MA-14. This is the practice's result.
Practice owner	Provides the evidence requested by the date set, answers questions, and may add evidence when the draft results are shown.
Assessor	Requests and reviews evidence, interviews practice owners, checks samples and proposes a level for each practice assigned to them.
Assessment lead	The person who plans the assessment, assigns assessors, decides each result and writes the report. Independent of the practices they rate.
Assessment sponsor	The member of management who commissions the assessment, approves its scope and targets, and receives the report.
MA-nn	The rules of the Security Maturity Model & Scoring Method, MA-01 to MA-19. MP-nn are its practices, DM-nn its domains, MAM-nn its headline measures, PH-n the phases of the Internal Security Assessment Procedure.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its first assessment, ASM-2026-1. Clear the EXAMPLE answers before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 7.5 — Documented information	Evidence Requests sheet: the documented information the practices produce, requested and checked as evidence
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	Domain Results sheet: the gaps from this evaluation, from which improvements are identified
NIS2 — Directive (EU) 2022/2555	Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”	The checklist as a whole: the evidence an assessment of how well each security practice works rests on, judged by the same tests for every practice
NIS2 — Directive (EU) 2022/2555	Article 32(2) — for essential entities, supervision includes on-site inspections and off-site supervision, regular and targeted security audits, ad hoc audits, security scans, and requests for information, including documented cybersecurity policies, for access to data and documents, and for evidence of implementation of cybersecurity policies	Evidence Requests sheet: the documented policies and the records that show they are applied, which a competent authority may ask an essential entity for, gathered in one place. Gathering them is not supervision
NIS2 — Directive (EU) 2022/2555	Article 33(2) — for important entities, supervision includes on-site inspections and off-site ex post supervision, targeted security audits, security scans, and requests for information, including documented cybersecurity policies, for access to data and documents, and for evidence of implementation of cybersecurity policies	Evidence Requests sheet: the same evidence, which a competent authority may ask an important entity for after the event
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	Applies to the providers its Article 1 names. For them, the Annex point below; for others, a useful guide only
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 7.2 — taking into account the risk assessment and past significant incidents, determine what is monitored and measured, the methods “to ensure valid results”, when it is measured, who measures, when the results are analysed and evaluated, and who analyses and evaluates them	Settings and How to Judge sheets: what is checked, by which method, when, and by whom, so results are valid and comparable
DORA — Regulation (EU) 2022/2554	Article 6(3) — financial entities minimise the impact of ICT risk through appropriate strategies, policies, procedures, ICT protocols and tools, and “shall provide complete and updated information on ICT risk and on their ICT risk management framework to the competent authorities upon their request”	Evidence Requests sheet, for financial entities: complete, current records of the ICT risk management framework, ready for the competent authority on request
DORA — Delegated Regulation (EU) 2024/1774	Article 27(2)(l) — the sources of information for the review report: for financial entities other than microenterprises, the results of internal audits; the results of compliance assessments; results of digital operational resilience testing, including threat-led penetration testing where applicable; and external sources	Domain Results sheet, for financial entities: results that can be one source for the review report. They are not the results of an internal audit
GDPR — Regulation (EU) 2016/679	Article 5(2) — “The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).”	Evidence Requests sheet: records that help a controller show that its security measures are in place
GDPR — Regulation (EU) 2016/679	Article 32(1)(d) — the security measures include, as appropriate, “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing”	The checklist as a whole: part of a process for testing, assessing and evaluating the effectiveness of security measures

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.