Internal Security Assessment Procedure
Plans, runs and reports an internal assessment with independence rules suited to small teams.
Available soon
- Format
- Word
- Size
- 77 KB
- Length
- 28 pages
- Version
- 1.0
- Updated
What's inside
- Purpose
- Legal note
- Scope
- Roles
- Who may assess what
- When to commission an independent assessment
- Triggers and inputs
- The phases at a glance
- Procedure steps
- Decision points
- Timing targets
- Escalation
- Outputs and records
- Measures
- Assessment plan
- Worked example: the distributor's first assessment
- Related documents
- Adapting this template
- Framework references
- Definitions
What changed
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose
This procedure sets out how [[Organisation Name]] assesses the maturity of its security programme from the inside: how an assessment is planned, who may assess what, how evidence is requested and checked, how the results are validated with the people who run the practices, and how the report reaches the people who decide what to do about it. It ends with the actions tracked to closure and the next assessment planned.
It applies the Security Maturity Model & Scoring Method. That document says what each level needs and how a result is worked out. This one says how to run the assessment so the result can be trusted: no one rates their own work, the targets are set before anyone sees the evidence, the practice owners can add evidence before the result is final, and every action closes only when a re-assessment shows the level moved.
It is written for an organisation without an internal audit department or a large security team. The independence options and the triggers for commissioning an independent assessment are there because small teams cannot always keep assessor and assessed apart. The procedure says what to try first, and what to do when nothing works.
Guidance — delete before approval
Replace every value in [[double brackets]] before approval, and name roles, not people.
The settings in [[double brackets]] (the lead time for requests, the challenge period, the cycle) are the pack's defaults, shared with the Security Maturity Model & Scoring Method. Change them there and here together, before the first assessment.
Legal note
This document helps you judge how well your security practices work. It is not legal advice, and a maturity result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law or a certification asks for an assessment or an audit, confirm with counsel or your certification body what it must include.
What an assessment under this procedure is not
MA-19 A maturity result is not an internal audit, a certification or a statement of compliance, and is never presented as one. It can feed the management review, the internal audit programme and the risk register.
An assessment under this procedure is not the ISO/IEC 27001 internal audit (the ISO 27001 Implementation & Certification Readiness pack, P08, covers that), not the internal audit of the ICT risk management framework that DORA Article 6(6) and Delegated Regulation (EU) 2024/1774 Article 28(5) require of financial entities, and not the independent review of the NIS2 Implementing Regulation's Annex point 2.3. Each has its own rules on who may carry it out and what it must cover. The section "Where a law asks for an independent review or audit" sets out how an assessment can feed each of them.
Scope
This procedure applies to:
- every full assessment of the security programme against the Security Maturity Model & Scoring Method, across its 14 domains and 32 practices;
- every partial assessment of some domains, run after a significant incident, a major change or a new obligation (MA-17);
- every re-assessment of a single practice to close an improvement action (MA-18);
- every assessor, whether a member of staff, a peer from another organisation or a contracted assessor, when they assess against this pack's model.
It does not cover the model itself (the Security Maturity Model & Scoring Method), the evidence to ask for under each practice (the Assessment Evidence Request Checklist), the content of the report (the Maturity Assessment Report Template), or how the improvement plan is sequenced and costed (the Target-State Maturity Roadmap). It does not cover an internal audit, which follows the organisation's audit procedure (P08 for ISO/IEC 27001).
Roles
Role | What they do in this procedure |
|---|---|
Assessment sponsor [[e.g. Chief Operating Officer]] | Commissions the assessment, approves its scope and the target levels before scoring, and takes the report to the approver. |
Assessment lead [[someone who runs none of the practices assessed: e.g. the finance controls manager, internal audit, or a contracted assessor]] | Plans the assessment, assigns assessors so no one rates their own work, decides each result, and writes the report. |
Assessor [[a peer from another function, a reciprocal assessor from a partner organisation, or a contracted assessor]] | Requests and reviews evidence, interviews practice owners, checks samples and proposes a level for each practice assigned to them. |
Practice owner [[the manager who runs each practice]] | Provides the evidence requested by the date set, answers questions, and may add evidence when the draft results are shown. |
Head of Information Security [[e.g. Head of Information Security or CISO]] | Owns the security programme being assessed, coordinates the evidence, proposes the improvement plan from the findings, and owns the tracker. Rates no practice they own or run. |
Approver [[the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management]] | Approves the target levels and the improvement plan, and the investment it needs. |
The Head of Information Security is the person most likely to be asked to run the assessment, and the one person who must not rate it. They own the programme being assessed. They coordinate the evidence, explain the practices, and turn the findings into the plan, but they rate no practice they own or run.
Guidance — delete before approval
The assessment lead needs authority more than security knowledge: the standing to ask a manager for records by a date, and to decide a level a manager disagrees with. An internal audit manager, a finance controls manager or a risk manager usually has it. The assessment sponsor should be senior enough to approve targets and take the result to the board or its equivalent.
Who may assess what
The rule
MA-14 No one rates a practice they own or run (P08 IS-07). Where no independent assessor is available for a practice, the result is marked self-assessed and cannot be above Defined until someone independent checks the evidence.
This is P08's IS-07, "Internal auditors must not audit their own work", applied to an assessment. A practice is your own work if you own it, do it, manage the people who do it day to day, or wrote the procedure it follows. Where you can, also avoid having someone rate a practice run by the person they report to.
A self-assessed result is not worthless. It is marked, so the reader knows how far to rely on it, and it is capped at Defined, because Managed needs a check by someone other than the person who does the work. The report counts how many results are self-assessed (MAM-03).
Ways to stay independent, in the order to try them
Work down this list for each practice in step 4. Use the first option that gives an assessor who neither owns nor runs the practice.
Option | How it works | Where it fits |
|---|---|---|
IO-1 A colleague from another function | Someone who runs none of the practices, such as a finance controls manager, a risk manager or internal audit, assesses them, with the security team explaining the practices. | Most practices. Works best with a short briefing on what each level needs. |
IO-2 A swap between people or teams | People who run different practices assess each other's, never their own: two members of the security team, or the security team and the IT team. | Teams of two or more, or a security team beside an IT team, where the practices are split between people. |
IO-3 A reciprocal assessor | A peer from another organisation assesses your practices, and you assess theirs, under a confidentiality agreement. | Single-person security functions with a trusted peer in the same sector. |
IO-4 A contracted assessor | An external assessor rates the practices no one inside can rate independently, or the whole programme. | Where a regulator or customer will rely on the result, or the practices are all run by one person. |
IO-5 Self-assessed, marked | The owner rates the practice; the result is marked self-assessed and capped at Defined (MA-14) until someone independent checks the evidence. | Only where none of the above is possible for that practice. The report counts how many results are self-assessed. |
Guidance — delete before approval
A colleague from another function (IO-1) is usually the best choice. They know how the organisation works, they can ask for a record and wait for it, and they have no stake in the answer. What they lack is security detail: the briefing below supplies enough of it.
In a reciprocal arrangement (IO-3), agree the scope, the model and the confidentiality terms in writing first. Each side assesses the other against the same model, so the results can be compared over time.
Briefing an assessor who is not a security specialist
Before fieldwork, the lead briefs each assessor from another function (step 5):
- Walk through the four levels and what each needs, using the calibration cases.
- For each practice assigned to them, read the question, the Defined and Managed evidence and the judging note together.
- Agree who explains the practices. The Head of Information Security or the owner may explain what a record is and where it is kept. They do not suggest a level.
- Agree where the assessor can ask for help with technical evidence, from someone who does not run the practice.
- Settle how notes are written: what was found, what the next level needs, and the evidence seen.
A contracted or reciprocal assessor
Agree these terms with them in writing, before fieldwork:
- They have not designed, run or advised on the practices they rate in the last [[12]] months.
- They rate against this pack's model (the Security Maturity Model & Scoring Method) and its rules, so the result can be compared with your own assessments (MA-15). If they use their own model, the result is a break in series.
- They report a level in words for each practice and domain, and give no overall score or percentage (MA-07).
- They state the confidence of every result and keep the samples they chose (MA-05, MA-13).
- They sign a confidentiality agreement, and return or destroy the evidence at the end, keeping only their working papers for the agreed period.
- They show their competence: [[e.g. experience of assessing security programmes, an audit qualification, sector knowledge]].
When to commission an independent assessment
An internal assessment is the right default for most cycles. Commission an independent assessment, instead of or as well as the internal one, when any of these applies:
Trigger | When it applies |
|---|---|
IT-1 | A regulator, a certification body or a customer contract requires an independent assessment or audit, or will rely on the result. |
IT-2 | The management body or the board asks for assurance that does not come from the security function. |
IT-3 | More than a third of the results would be self-assessed (IO-5), or one person runs every practice. |
IT-4 | The last two internal assessments gave the same levels and management doubts them, or a significant incident contradicted them. |
IT-5 | A major change is planned, such as a merger, a new regulated service or a move to a new platform, and the investment decision needs an outside view. |
The lead checks the triggers at step 2, and the sponsor decides. Record the decision and the reason in the plan, including a decision not to commission one when a trigger applies. An independent assessor works to this procedure and the Security Maturity Model & Scoring Method, so the result stays comparable with the internal ones (MA-15).
Where a law asks for an independent review or audit
Some laws ask for a review or audit with its own independence and competence rules. A maturity assessment can feed each of them. It meets one only if it is run to that law's own conditions, which this procedure does not set.
Law | Applies to | What it asks | How an assessment relates |
|---|---|---|---|
NIS2 Implementing Regulation, Annex points 2.3.1, 2.3.2 and 2.3.4 | The providers its Article 1 names, such as cloud, data centre and managed service providers | An independent review of the approach to network and information security, by people with audit competence who are not in the line of authority of the area reviewed, at planned intervals and after significant incidents or changes. Where size does not allow that separation, other measures must guarantee impartiality. | An assessment run under this procedure can be part of that review only if its assessors meet those conditions. Otherwise it feeds the review. Record which in the plan. |
NIS2 Implementing Regulation, Annex points 2.2.1 and 2.2.3 | The same providers | Regular review of compliance with the security policies, reported to the management bodies, at planned intervals and after significant incidents or changes. | The report and its approval keep management informed. The assessment does not replace the compliance review. |
DORA Article 6(6); Delegated Regulation (EU) 2024/1774 Article 28(5) | Financial entities, other than microenterprises under Article 6(6); those under the simplified framework under Article 28(5) | An internal audit of the ICT risk management framework by auditors with ICT risk expertise and appropriate independence, in line with the audit plan. | An assessment is not that internal audit. Its results can help the auditors plan, and internal audit may lead it, as in the example, without turning it into the audit. |
DORA Article 6(4); Delegated Regulation (EU) 2024/1774 Article 28(4) | Financial entities | Segregation and independence of the ICT risk control function and the internal audit function. | Keep the assessment's assessors separate from those who run the practices. Do not let an assessment replace either function. |
DORA Article 6(10) | Financial entities | Verifying compliance may be outsourced, and the entity stays fully responsible for it. | A contracted assessor does not move responsibility. The sponsor still approves the scope and targets, and the approver the plan. |
DORA Article 16(1)(g) | Entities under the simplified framework | Regular testing of the plans and measures, and of the effectiveness of the controls. | An assessment can be part of how that testing is planned and recorded. |
The NIS2 Implementing Regulation (EU) 2024/2690 binds only the providers its Article 1 names. For other entities under NIS2, its Annex is a useful guide to what an authority may look for, and no more.
Guidance — delete before approval
If you are a financial entity under DORA, agree with your internal audit function how the assessment and the ICT audit share evidence and timing. Do not let the assessment's report stand in for the audit's.
Triggers and inputs
When this procedure runs
MA-17 A full assessment runs at least every [[12]] months. A domain is re-assessed sooner after a significant incident, a major change to the systems or the organisation, or a new obligation that rests on it.
Event | What starts | First step |
|---|---|---|
The last full assessment's fieldwork ended [[12]] months ago, or will have by the next fieldwork date | A full assessment of every domain (MA-17) | Step 1 |
A significant incident that a practice should have prevented or limited | A re-assessment of the domains the incident touched (MA-17) | Step 1, scope limited to those domains |
A major change to the systems or the organisation: a merger, a new platform, a new regulated service, a move of IT to a provider | A re-assessment of the domains the change touches (MA-17) | Step 1, scope limited to those domains |
A new obligation that rests on a domain, such as a new law in scope or a customer contract | A re-assessment of that domain, with its target reviewed (MA-09, MA-17) | Step 1, then step 7 |
An action in the Maturity Findings & Improvement Tracker reaches Ready for re-assessment | A re-assessment of that one practice (MA-18) | Step 28 |
The management body, a regulator or a customer asks for assurance | A full assessment, or an independent one where a trigger applies (IT-1 to IT-5) | Step 2 |
Inputs
Input | Where it comes from | Used at |
|---|---|---|
The maturity model: levels, practices, evidence criteria and rules MA-01 to MA-19 | Security Maturity Model & Scoring Method | Steps 3, 12 to 15, 20 |
The last assessment's report, the tracker and any break in series | The last report, written on the Maturity Assessment Report Template; the Maturity Findings & Improvement Tracker | Steps 3, 7, 20 |
The risk register, with the risks outside appetite and their owners | [[Your risk register]] (Information Security Risk Management pack, P05) | Steps 7, 20 |
The obligations register: which laws and contracts apply, and which are recorded as not met | [[Your obligations register]] | Steps 2, 7, 20 |
Who owns and runs each practice, and the organisation chart | [[HR records; the security programme's role descriptions]] | Step 4 |
The evidence requests for each practice | Assessment Evidence Request Checklist | Steps 9 to 11 |
The questionnaire, one row per practice | Security Programme Maturity Assessment | Steps 15, 19 |
Assessor calibration records | The calibration record in the Security Maturity Model & Scoring Method | Step 5 |
The phases at a glance
An assessment runs in nine phases. Each has one person who leads it and one output that the next phase needs.
Phase | Led by | Steps | Output |
|---|---|---|---|
PH-1 Plan | Assessment lead | 1 to 6 | The assessment plan, approved by the sponsor, with the assessor for each practice. |
PH-2 Set targets | Assessment sponsor | 7 to 8 | The target for each domain, with its reason. |
PH-3 Request evidence | Assessment lead | 9 to 11 | The evidence requests, sent and acknowledged. |
PH-4 Fieldwork | Assessor | 12 to 16 | A proposed level, confidence and note for every practice. |
PH-5 Validate | Assessment lead | 17 to 19 | The decided results, with disagreements recorded. |
PH-6 Report | Assessment lead | 20 to 22 | The maturity assessment report. |
PH-7 Plan improvements | Head of Information Security | 23 to 24 | The tracker and the roadmap, ready for approval. |
PH-8 Approve | Assessment sponsor | 25 to 26 | The approved targets, plan and investment, minuted. |
PH-9 Track and re-assess | Head of Information Security | 27 to 30 | The tracker, with re-assessed levels. |
Guidance — delete before approval
Allow about six weeks from step 1 to the report for a first full assessment, of which fieldwork is two. The EXAMPLE below ran from commissioning on 20 Aug 2026 to the report on 29 Sep 2026.
Procedure steps
Steps are numbered across the phases. "Working days" are Monday to Friday excluding [[public holidays]]. The targets are collected in Timing targets, below.
PH-1 Plan
Led by the assessment lead. Agree the scope, the domains and any practice not applicable with the sponsor; assign an assessor to every practice and check that none rates their own work; set the dates.
Step | What happens | Who | When | Output |
|---|---|---|---|---|
1 | Agree with the assessment sponsor why the assessment is run now, whether it is full or covers some domains (MA-17), and which edition of the model it uses. | Assessment lead, with the assessment sponsor | When a trigger occurs | Purpose and type of assessment, in the plan |
2 | Check the triggers for an independent assessment (IT-1 to IT-5). If one applies, the sponsor decides whether to commission an independent assessment instead of, or as well as, this one, and the plan records the decision and the reason. | Assessment lead; Assessment sponsor decides | Before assessors are assigned | Trigger check and decision, in the plan |
3 | Set the scope: the domains assessed and left out, any practice Not applicable with the reason the sponsor approves (MA-08), and the evidence window (MA-04). Compare the scope, model and window with the last assessment, and note any break in series (MA-15). | Assessment lead | With step 2 | Scope, exclusions and window, in the plan |
4 | List the owner of each practice and everyone who runs it. Assign an assessor to every practice so that no one rates a practice they own or run (MA-14, P08 IS-07). Use the independence options in order (IO-1 to IO-5). Count the results that would be self-assessed; more than a third is trigger IT-3. | Assessment lead | With step 3 | Assessor for each practice, with the option used |
5 | Brief every assessor on the model, and have each one who has not done so in the last [[12]] months work through the calibration cases in the Security Maturity Model & Scoring Method. | Assessment lead | Before evidence is requested | Briefing held; calibration recorded |
6 | Set the dates: targets approved, requests sent, fieldwork, draft results shown, end of the challenge period, report, executive review and approval. Send the plan to the sponsor for approval. | Assessment lead; Assessment sponsor approves | Before targets are set | The assessment plan, approved |
MA-08 A practice is Not applicable only for a reason the sponsor approves and the report states, never because it is weak. A domain with every practice Not applicable is left out of the result, and the report says why.
MA-15 Results are compared over time only when the model, the scope and the evidence window are the same. Any change is a break in series, marked in the report as P11's MR-09 marks a changed metric.
Guidance — delete before approval
The evidence window (MA-04) and the sample size (MA-05) are part of the comparison at step 3. A window of [[12]] months this time and six months last time is a break in series, even if nothing else changed.
PH-2 Set targets
Led by the assessment sponsor. Approve a target level and its reason for every domain, before any evidence is scored (MA-09).
Step | What happens | Who | When | Output |
|---|---|---|---|---|
7 | Propose a target level for every domain, with its reason: Defined by default; Managed only where an obligation, a risk outside appetite or a business need asks for measurement and independent checking (MA-09). Name the risk or obligation from the registers. | Head of Information Security, with the assessment lead | Before evidence is requested | Proposed targets with reasons |
8 | Approve the targets, in writing and dated, before any evidence is scored. A target changed after scoring has started applies to the next assessment, not this one. | Assessment sponsor | Before step 9 | Approved targets, dated |
MA-09 The sponsor approves a target level for every domain before any evidence is scored, with a reason: an obligation that rests on it, a risk outside appetite, or a business need. Defined is the default target. Managed is a target only where one of those reasons asks for measurement and independent checking.
Setting targets first is what makes the gap honest. A target set after the results are known tends to settle just below or just at the level found. The dated approval is the evidence that it did not happen.
PH-3 Request evidence
Led by the assessment lead. Send each practice owner the evidence requests from the checklist at least [[10]] working days before fieldwork, with the evidence window.
Step | What happens | Who | When | Output |
|---|---|---|---|---|
9 | Prepare the request for each practice owner from the Assessment Evidence Request Checklist: the evidence for each practice, the evidence window, the date it is due and who will assess it. | Assessment lead | After step 8 | Evidence requests |
10 | Send the requests at least [[10]] working days before fieldwork (PH-3). Ask each owner to acknowledge, and book an interview with each one during fieldwork. | Assessment lead | At least [[10]] working days before fieldwork | Requests sent and acknowledged; interviews booked |
11 | Provide the evidence, and the full lists the assessor will sample from (all leavers in the window from HR, all findings from the scanner, all exceptions), unfiltered. Say where something asked for does not exist: that is an answer, not a failure to reply. | Practice owner | By the date in the request | Evidence and population lists |
MA-04 Records count only if they fall in the evidence window: the [[12]] months up to the last day of fieldwork, or the practice's own last cycle where it runs less often.
Guidance — delete before approval
The Assessment Evidence Request Checklist has the request for every practice, the window dates and a note to send with them. Ask for the lists the samples will be drawn from, not for a selection: the assessor chooses the sample (MA-05).
PH-4 Fieldwork
Led by the assessor. Review the evidence, interview each practice owner, choose and check the samples, and propose a level with its confidence for each practice.
Step | What happens | Who | When | Output |
|---|---|---|---|---|
12 | Read the evidence against the practice's criteria in the Security Maturity Model & Scoring Method. Set aside records dated outside the window (MA-04). | Assessor | First days of fieldwork | Evidence reviewed; questions for the interview |
13 | Interview the practice owner. Ask them to show, not describe: the record, the ticket, the minutes, the screen. An interview explains evidence; on its own it supports Informal at most (MA-02). | Assessor | During fieldwork | Interview notes |
14 | Choose the sample yourself from the full list, [[3]] records or all of them if there are fewer, and check each against the practice (MA-05). Record each record's reference and what it showed. | Assessor | During fieldwork | Sample list and results |
15 | Propose a level, its confidence (Told, Seen or Tested) and a note for each practice, in the Security Programme Maturity Assessment (MA-02, MA-03, MA-13). Mark a result self-assessed where the assessor owns or runs the practice (MA-14). | Assessor | By the last day of fieldwork | Proposed level, confidence and note for every practice |
16 | Review the proposals for consistency: decide [[3]] practices again from the evidence on file, including one from each assessor, and compare. Discuss and settle every difference before the draft results are shown. | Assessment lead | Last day of fieldwork | Proposals reviewed |
MA-02 Evidence decides the level. An interview alone supports Informal at most. A written procedure with no records of it being done supports Informal at most, because Defined needs the practice to be done routinely and leave a record.
MA-05 Where the assessor checks recurring records, the sample is [[3]], or all of them if there are fewer, chosen by the assessor, not by the practice owner; a result is Tested only on such a sample. A sampled record that fails means the level is not met, unless the practice itself caught and corrected the failure and recorded it.
MA-13 Every result states how it was evidenced: Told, Seen or Tested. A level above Informal needs at least Seen; Managed needs Tested.
- Told (described in an interview, with nothing shown): supports up to Informal.
- Seen (a document or record was shown, and it says what the practice needs): supports up to Defined.
- Tested (the assessor chose a sample of records and checked each one against the practice): supports up to Managed.
Running the fieldwork well
- Start each interview by asking the owner to walk through the last time the practice ran, using the records. It is quicker than asking about the procedure, and it shows whether the procedure is followed.
- Draw samples from a source the practice does not control: leavers from HR records, not from the access system; findings from the scanner's export, not from the remediation tracker. An incomplete list is itself a finding.
- Where evidence is promised but not shown, record Told and move on. The owner can add it at validation.
- A failure the practice caught and recorded itself is evidence that it works. A failure the assessor found is evidence that Defined is not met (MA-05).
- Write each note as a finding would read: what was found, what the next level needs, and the evidence seen. The Maturity Assessment Report Template uses the notes as they stand.
PH-5 Validate
Led by the assessment lead. Show each practice owner the draft results; take any added evidence within [[5]] working days; decide each result and record disagreements (MA-16).
Step | What happens | Who | When | Output |
|---|---|---|---|---|
17 | Show each practice owner the draft results for their practices, with the notes, and the date by which they may add evidence. | Assessment lead | As soon as fieldwork ends | Draft results sent |
18 | Add any evidence that was missed, within [[5]] working days (MA-16). A record counts only if it is dated in the evidence window: a document written after fieldwork does not raise this assessment's level. | Practice owner | Within [[5]] working days of the draft | Added evidence, or none |
19 | Decide each result. Where the owner still disagrees, record their view and the reason for the decision (MA-16). The decision is the lead's; the sponsor is told of every disagreement. | Assessment lead | When the challenge period ends | Decided results; disagreements recorded |
MA-16 The report goes to the approver (the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management), who approves the targets and the improvement plan. The practice owners see the draft results first and may add evidence within [[5]] working days; the assessment lead decides, and records any disagreement.
Validation is not a negotiation. The owner may add evidence; they may not argue a level up without it. When the owner and the assessor disagree on what a record shows, the lead decides on the criteria in the model, and records both views.
Keep a validation log, one row per practice where anything changed or was disputed:
Practice | Draft level | Evidence added | Decided level | Disagreement and decision |
|---|---|---|---|---|
[[MP-nn]] | [[Level]] | [[Record, its date; or none]] | [[Level]] | [[Owner's view; the lead's reason]] |
PH-6 Report
Led by the assessment lead. Write the report: the profile by domain, targets, gaps, findings and the next actions in priority order.
Step | What happens | Who | When | Output |
|---|---|---|---|---|
20 | Work out each domain's level, the lowest of its practices that apply (MA-06), its gap to target (MA-10), and the order of the actions (MA-11). Show no overall score, percentage or weighting (MA-07). Count the self-assessed results and mark every break in series (MA-15). | Assessment lead | After step 19 | Domain profile, gaps and action order |
21 | Write the report in the Maturity Assessment Report Template's eight sections. State in it what the result is and is not (MA-19). | Assessment lead | [[1 to 3]] working days after the challenge period | The maturity assessment report |
22 | Send the report to the assessment sponsor and the Head of Information Security. | Assessment lead | With step 21 | Report issued |
MA-06 A domain's level is the lowest level among its practices that apply. No average, no rounding.
MA-07 There is no overall score, no percentage and no weighting. The result is each domain's level and target, in words, and the gap between them.
MA-10 A domain's gap is its target level minus its current level, counted in levels. A domain at or above its target has no gap.
The report follows the Maturity Assessment Report Template, in eight sections: 1 summary for the approver, 2 scope and method, 3 results by domain, 4 findings, 5 changes since the last assessment, 6 improvement plan, 7 limits of this assessment and 8 decisions requested. Section 7 says what the result does not say, including how many results are self-assessed.
PH-7 Plan improvements
Led by the Head of Information Security. Turn the findings into actions, one level per practice per action, sequence them in the roadmap, and estimate effort.
Step | What happens | Who | When | Output |
|---|---|---|---|---|
23 | Turn each practice below its domain's target into one action that moves it one level (MA-11, MA-12), with an owner, a due date and the evidence that will show it is done. Enter them in the Maturity Findings & Improvement Tracker. | Head of Information Security | Before the approver's meeting | Actions in the tracker |
24 | Sequence the actions in the Target-State Maturity Roadmap: the first [[5]] in MA-11's order first, dependencies before the actions that need them, Managed only after [[6]] months at Defined (MA-12). Estimate effort and spend, and prepare the investment options. | Head of Information Security | With step 23, before the approver's meeting | Roadmap and options |
MA-11 Every practice below its domain's target gets an action. Actions take priority first where a risk outside appetite, or an obligation the organisation has recorded as not met, rests on the practice; then the practice at the lower level; then the domain with the larger gap; then domain and practice order. Up to [[5]] actions take priority in one cycle.
MA-12 A practice moves up one level per action. Managed can be claimed only after the practice has run at Defined, with records, for at least [[6]] months. A roadmap never plans a jump of two levels in one step.
PH-8 Approve
Led by the assessment sponsor. Take the report, the plan and the investment it needs to the approver for decision.
Step | What happens | Who | When | Output |
|---|---|---|---|---|
25 | Take the report, the plan and the options to the executive review, then to the approver with the Maturity Results Executive Summary Deck. Ask for approval of the targets, the plan and the investment (MA-16). | Assessment sponsor | At the next scheduled meeting of the approver | Approved targets, plan and investment, minuted |
26 | Pass the results to where they are used: the management review, the internal audit programme, which may use them to choose what to audit, and the risk register (MA-19). | Head of Information Security | After approval | Results recorded as inputs |
The approver is the one MA-16 names. Ask for three decisions: the targets, the plan, and the investment, with the options and what each leaves undone. The Maturity Results Executive Summary Deck has five slides for it.
PH-9 Track and re-assess
Led by the Head of Information Security. Track actions to closure; have each closed action re-assessed by someone other than its owner (MA-18); report progress each quarter.
Step | What happens | Who | When | Output |
|---|---|---|---|---|
27 | Track the actions each month with their owners. Report the headline measures MAM-01 to MAM-04 to management each quarter. | Head of Information Security | Monthly; quarterly report | Updated tracker; quarterly report |
28 | When an owner marks an action Ready for re-assessment, have someone other than the action's owner check the practice against the level the action aimed for, using records made since the action. Close the action only if the level moved; otherwise mark it Not achieved and plan again (MA-18). | Head of Information Security arranges; an assessor who does not own the action | Within [[20]] working days of Ready | Re-assessed level; action closed or Not achieved |
29 | Re-assess a domain sooner after a significant incident, a major change or a new obligation that rests on it (MA-17). | Assessment lead, at the Head of Information Security's request | When the trigger occurs | Re-assessment of the domain |
30 | Plan the next full assessment so its fieldwork ends within [[12]] months of this one's (MA-17). | Head of Information Security | At approval | Next assessment in the plan |
MA-18 An action closes only when a re-assessment, by someone other than the action's owner, shows that the practice reached the level the action aimed for.
A re-assessment applies the same criteria, the same confidence rules and the same independence rule as the assessment. It uses records made since the action, so a practice that has only just changed may need time to leave the records Defined asks for. Managed needs [[6]] months at Defined first (MA-12).
Decision points
Decision | Who decides | Rule | Recorded in |
|---|---|---|---|
Full assessment or some domains? | Assessment sponsor | MA-17 | Assessment plan |
Run internally, or commission an independent assessment? | Assessment sponsor | IT-1 to IT-5 | Assessment plan |
Is a practice Not applicable? | Assessment sponsor | MA-08: a reason, never because it is weak | Assessment plan; report section 2 |
Who assesses each practice? | Assessment lead | MA-14; options IO-1 to IO-5 in order | Assessment plan |
What is each domain's target? | Assessment sponsor | MA-09: Defined by default; Managed with a reason | Approved targets, dated |
What level does a practice reach? | Assessor proposes; Assessment lead decides | MA-02 to MA-05, MA-13, MA-14 | Questionnaire; report |
Does added evidence change the level? | Assessment lead | MA-04, MA-16 | Validation log |
Which actions take priority? | Head of Information Security proposes; Approver approves | MA-11 | Tracker; report section 6 |
Is an action closed? | The re-assessor, who is not the action's owner | MA-18 | Tracker |
Can this result be compared with the last? | Assessment lead | MA-15 | Report section 5 |
Timing targets
Values in [[double brackets]] are this template's defaults. Keep the order: targets, requests, fieldwork, validation, report, approval.
Activity | Target | Basis |
|---|---|---|
Full assessment | Fieldwork ends within [[12]] months of the last one's | MA-17; step 30 |
Targets approved | Before any evidence is scored | MA-09; step 8 |
Evidence requests sent | At least [[10]] working days before fieldwork | PH-3; step 10 |
Evidence window | The [[12]] months up to the last day of fieldwork, or the practice's own last cycle | MA-04 |
Owners add evidence | Within [[5]] working days of seeing the draft results | MA-16; step 18 |
Report issued | [[1 to 3]] working days after the challenge period ends | Step 21 |
Approval | At the approver's next scheduled meeting after the report | MA-16; step 25 |
Re-assessment of a closed action | Within [[20]] working days of Ready for re-assessment | MA-18; step 28 |
Managed claimed | Only after [[6]] months at Defined, with records | MA-12 |
Escalation
When | Escalated to | By | Basis |
|---|---|---|---|
No independent assessor can be found for a practice | Assessment sponsor | Assessment lead | MA-14; IO-5 |
More than a third of the results would be self-assessed | Assessment sponsor, with a proposal to commission an independent assessment | Assessment lead | IT-3 |
A practice owner has not sent evidence by the start of fieldwork | The owner's manager; then the assessment sponsor | Assessment lead | Step 11 |
The sponsor has not approved targets before fieldwork | Fieldwork waits | Assessment lead | MA-09 |
A practice owner disputes a decided result | Assessment sponsor, for information; the decision stands | Assessment lead | MA-16 |
Someone asks for a target to change after scoring has started | Assessment sponsor: the change applies to the next assessment | Assessment lead | MA-09 |
A priority action is overdue | Assessment sponsor; named in the quarterly report | Head of Information Security | MA-11; MAM-02 |
An action reaches Not achieved twice | Approver | Head of Information Security | MA-18 |
The next full assessment will not be done within the cycle | Assessment sponsor | Head of Information Security | MA-17; MAM-04 |
Outputs and records
Output | Steps | Held in | Kept by |
|---|---|---|---|
Assessment plan: purpose, scope, exclusions, window, assessors, trigger check, dates | 1 to 6 | [[Assessment file]] | Assessment lead |
Approved targets with reasons, dated | 7, 8 | [[Assessment file]] | Assessment lead |
Evidence requests and acknowledgements | 9, 10 | [[Assessment file]] | Assessment lead |
Evidence, population lists, samples, interview notes | 11 to 14 | [[Assessment file, access restricted]] | Assessor |
Questionnaire with every level, confidence and note | 15 to 19 | Security Programme Maturity Assessment | Assessment lead |
Validation log: draft results, evidence added, decisions, disagreements | 17 to 19 | [[Assessment file]] | Assessment lead |
The report | 20 to 22 | Maturity Assessment Report Template | Assessment lead |
Tracker and roadmap | 23, 24, 27, 28 | Maturity Findings & Improvement Tracker; Target-State Maturity Roadmap | Head of Information Security |
Approval minutes | 25 | [[Minutes of the approver's meeting]] | Assessment sponsor |
Evidence retained
Evidence | Shows | Minimum retention |
|---|---|---|
The approved plan and the assessor for each practice | No one rated their own work (MA-14) | [[Two full cycles]] |
The dated approval of the targets | Targets were set before scoring (MA-09) | [[Two full cycles]] |
Evidence seen, samples and notes for each practice | Each level rests on evidence another assessor could check (MA-02, MA-05, MA-13) | [[Two full cycles]] |
The validation log | Owners could challenge, and disagreements were recorded (MA-16) | [[Two full cycles]] |
The report and its approval | Results reached the approver, and what was decided (MA-16) | [[Six years]] |
Re-assessment records for closed actions | Actions closed only when the level moved (MA-18) | [[Two full cycles]] |
Guidance — delete before approval
Evidence from practice owners can include personal data (joiner and leaver records, training records) and security detail (privileged account lists, configuration baselines). Keep the assessment file access-restricted, and keep references to records rather than copies where you can.
Measures
The Head of Information Security reports these with the tracker each quarter (step 27). Each is a count or a number of months, never a percentage (MA-07).
Measure | Definition | Target | EXAMPLE, 30 Sep 2026 |
|---|---|---|---|
MAM-01 Domains at target | Domains at or above their target level, out of the domains assessed. | Rising each cycle | 2 of 14 |
MAM-02 Priority actions on time | Priority actions closed by their due date, re-assessed, out of those due in the period. | All | None due yet |
MAM-03 Self-assessed results | Practice results marked self-assessed, out of all results. | None; never more than a third | 2 of 32 |
MAM-04 Months since the last full assessment | Months from the end of the last full assessment's fieldwork to the period end. | [[12]] or fewer | 0 |
Assessment plan
Copy this plan for each assessment. The sponsor approves it at step 6.
Assessment plan | |||
Assessment reference | [[ASM-YYYY-n]] | Type | [[Full / Partial: domains]] |
Purpose why now | [[Cycle due / incident / change / new obligation / request]] | ||
Sponsor | [[Role]] | Lead | [[Role]] |
Model edition | [[Security Maturity Model & Scoring Method, edition]] | ||
Scope domains assessed and left out | [[DM-01 to DM-14, or the list; reasons for any left out]] | ||
Not applicable practices, with the sponsor's reason | [[None / MP-nn: reason]] | ||
Evidence window | [[YYYY-MM-DD to YYYY-MM-DD]] | Break in series? | [[No / Yes: what changed]] |
Independent assessment triggers IT-1 to IT-5 | [[None applies / IT-n applies: sponsor's decision and reason]] | ||
Assessors and the option used for each | [[Name, role: practices, IO-n]] | ||
Self-assessed results count, out of all results | [[n of n]] | More than a third? | [[No / Yes: see IT-3]] |
Targets approved | [[YYYY-MM-DD]] | Requests sent | [[YYYY-MM-DD]] |
Fieldwork | [[YYYY-MM-DD to YYYY-MM-DD]] | Draft results shown | [[YYYY-MM-DD]] |
Challenge period ends | [[YYYY-MM-DD]] | Report due | [[YYYY-MM-DD]] |
Approval meeting and date | [[Approver; YYYY-MM-DD]] | ||
Plan approved by | [[Sponsor, date]] | ||
Worked example: the distributor's first assessment
EXAMPLE, not part of the procedure. The organisation used throughout the pack is a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. It is an important entity under NIS2 in its Member State, and its board has seven members: the chair, the chief executive, the chief financial officer and four non-executive directors. Its first assessment, ASM-2026-1, covered the whole security programme, all fourteen domains. No practice was Not applicable. Replace every date, role and result with your own.
The timeline
Date | Phase | What happened | Rule |
|---|---|---|---|
20 Aug 2026 | PH-1 | The Chief Operating Officer commissions a full assessment and names the Internal Audit Manager as lead. The plan assigns an assessor to every practice. | MA-14, MA-17 |
21 Aug 2026 | PH-2 | The Chief Operating Officer approves a target for each of the 14 domains, before any evidence is scored. | MA-09 |
24 Aug 2026 | PH-3 | Evidence requests go to every practice owner, 10 working days before fieldwork. | PH-3: at least 10 |
7 Sep 2026 to 18 Sep 2026 | PH-4 | Fieldwork. The evidence window is 19 Sep 2025 to 18 Sep 2026. | MA-04, MA-05 |
21 Sep 2026 | PH-5 | Draft results go to every practice owner. | MA-16 |
28 Sep 2026 | PH-5 | The challenge period ends, 5 working days later. The lead decides every result. | MA-16 |
29 Sep 2026 | PH-6 | The report is issued to the sponsor and the Head of Information Security. | MA-06, MA-07 |
29 Sep 2026 | PH-7 | Every finding turned into an action in the tracker, with an owner and a date, one level per action. | MA-11, MA-12 |
30 Sep 2026 | PH-8 | The Executive Committee reviews the report, the plan and the options. | MA-16 |
29 Oct 2026 | PH-8 | The board receives the report and is asked to approve the targets, the plan and option B. | MA-16 |
By 17 Sep 2027 | PH-1 | Fieldwork for the next full assessment ends. | MA-17 |
EXAMPLE. Requests went 10 working days before fieldwork, against the [[10]] the procedure asks. The owners had exactly [[5]] working days to add evidence, and the report followed 1 working day later.
Who assessed what
EXAMPLE. The Internal Audit Manager led the assessment. Internal audit runs none of the security practices, and the Internal Audit Manager already observes the incident exercises as an independent party, so this is option IO-1. The Internal Audit Manager rated 21 practices. The Information Security Manager rated the other 11: those the Head of IT runs, and two practices the Information Security Manager runs.
EXAMPLE. Those two, MP-26 logging and MP-27 alert handling, are self-assessed: no one independent could judge the technical evidence in the time. Both are marked and capped at Defined (option IO-5). That is 2 of 32 results, below the third that would trigger an independent assessment (IT-3). The Head of Information Security owns the programme and rated nothing.
Practice owner | Practices | Assessed by | Independent? |
|---|---|---|---|
Chief Operating Officer | MP-01 | Internal Audit Manager | Yes |
Head of Information Security | MP-02, MP-03, MP-04, MP-06, MP-07, MP-08, MP-11, MP-12, MP-13, MP-14, MP-16, MP-20, MP-29 | Internal Audit Manager | Yes |
HR Director | MP-05 | Internal Audit Manager | Yes |
Procurement | MP-09 | Internal Audit Manager | Yes |
Information Security Manager | MP-10, MP-22, MP-23, MP-28, MP-30 | Internal Audit Manager | Yes |
Head of IT | MP-15, MP-17, MP-18, MP-19, MP-21, MP-24, MP-25, MP-31, MP-32 | Information Security Manager | Yes |
Information Security Manager | MP-26, MP-27 | Information Security Manager | No: self-assessed, capped at Defined |
The targets
EXAMPLE. The Chief Operating Officer approved the targets on 21 Aug 2026, before any evidence was scored. Thirteen domains have the default, Defined. One has Managed: incident response and notification. Reason: incidents test the programme most often, NIS2's reporting deadlines rest on the response, and R-01 is outside appetite. Response must be measured and checked by someone other than the team that runs it.
Fieldwork and validation
- An interview alone. MP-05: HR said every joiner acknowledges the policies at induction, but could not show the records during fieldwork, so the result is capped at Informal (MA-13).
- Evidence added at validation. MP-30: Raised from Informal at validation, when the owner added the after-action report on 23 Sep 2026. The report it added was approved on 31 Mar 2026, inside the window, so it counted.
- A disagreement. MP-20: The Head of Information Security held that the earlier reviews count. The lead kept Informal: they left no record of what was removed (MA-02).
- A failure the practice caught. MP-19: Five leavers sampled from HR records: four had their access removed in time. The fifth was found by the monthly reconciliation and removed, so the practice caught its own failure (MA-05) (P13).
EXAMPLE. The validation log:
Practice | Draft level | Evidence added | Decided level | Disagreement and decision |
|---|---|---|---|---|
MP-30 Exercises | Informal | The after-action report of the tabletop, added on 23 Sep 2026 | Defined | None |
MP-20 Access reviews | Informal | None | Informal | The Head of Information Security held that the earlier reviews count. The lead kept Informal: they left no record of what was removed (MA-02). |
The result and the route to approval
EXAMPLE. 2 of 14 domains are at target: governance and accountability, and awareness and training. There is no overall score. 18 practices are below their domain's target, so there are 18 actions, each one level. The first 5 take priority: MP-04 policy set, MP-10 supplier assessment, MP-24 backups restored, MP-32 recovery tested and MP-14 assessment and follow-up.
EXAMPLE. The Executive Committee reviewed the report on 30 Sep 2026. The Head of Information Security had put every action in the tracker before that review. The board receives the report on 29 Oct 2026 and is asked to approve the targets, the plan and option B, "close the gaps by the 2027 assessment": €59,000 one-off and €18,000 a year. The next full assessment's fieldwork must end by 17 Sep 2027.
Guidance — delete before approval
The example's results, targets and actions are the same in every P19 document. The Security Maturity Model & Scoring Method shows how each level was decided, the Maturity Findings & Improvement Tracker tracks the actions and the Target-State Maturity Roadmap sequences them.
Related documents
Document | Relationship |
|---|---|
Security Maturity Assessment Pack — Guide | How the pack's documents fit together |
Security Maturity Model & Scoring Method | The levels, practices, evidence criteria and rules MA-01 to MA-19 this procedure applies |
Security Programme Maturity Assessment | Where each practice's level, confidence and note are recorded (PH-4, PH-5) |
Assessment Evidence Request Checklist | The evidence requests sent at PH-3 |
Maturity Findings & Improvement Tracker | The actions, tracked to re-assessment (PH-7, PH-9) |
Maturity Assessment Report Template | The report written at PH-6 |
Target-State Maturity Roadmap | The improvement plan sequenced at PH-7 |
Maturity Results Executive Summary Deck | The slides for the approver at PH-8 |
ISO 27001 Implementation & Certification Readiness (P08) | The internal audit programme, which assessment results can feed, and IS-07 |
Information Security Risk Management (P05) | The risk register and the risks outside appetite that make a practice pressing |
Cybersecurity Metrics & Reporting Programme (P11) | The break-in-series rule MR-09, which MA-15 follows |
Adapting this template
Guidance — delete before approval
Small organisation (one or two people in security): keep the independence rule, the targets set before scoring and the challenge period; they are what makes the result trustworthy. Use a colleague from another function as lead and assessor (IO-1). A reciprocal assessor (IO-3) can rate the technical practices. Assess some domains each year if all 14 at once is too much, as long as each is assessed within [[12]] months.
Organisation with internal audit: internal audit can lead the assessment, as in the example. Keep it separate from the audit itself: a different plan, a different report and the statement that the result is not an audit (MA-19).
Regulated entity (NIS2, DORA): record in the plan whether the assessment is meant to feed an independent review or an ICT audit, and check with [[legal or compliance]] whether its assessors meet that law's independence and competence conditions.
Several business units: run one assessment per unit with the same model, window and sample, and report each unit's profile. Do not combine units by averaging (MA-06, MA-07).
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR).
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.35 — Independent review of information security | Who may assess what; when to commission an independent assessment; the planned cycle and triggers (MA-14, MA-17) |
ISO/IEC 27001:2022 | Clause 5.3 — Organizational roles, responsibilities and authorities | Roles; decision points |
ISO/IEC 27001:2022 | Clause 9.2 — Internal audit | What an assessment is not: results can feed the internal audit programme (MA-19) |
ISO/IEC 27001:2022 | Clause 9.3.2 — Management review inputs | PH-8: results passed to the management review |
NIST CSF 2.0 | ID.IM-01 — “Improvements are identified from evaluations” | The whole procedure: improvements identified from the assessment and tracked to re-assessment |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | The whole procedure: a procedure to assess the effectiveness of the security measures |
NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Who the Implementing Regulation binds; for other entities its Annex is a guide only |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 7.1 — establish, implement and apply a policy and procedures to assess whether the cybersecurity risk-management measures taken are effectively implemented and maintained | The whole procedure, applying the model's rules |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 7.2 — taking into account the risk assessment and past significant incidents, determine what is monitored and measured, the methods “to ensure valid results”, when it is measured, who measures, when the results are analysed and evaluated, and who analyses and evaluates them | Who measures and when: assessors and independence; the timing targets; PH-6 analysis and evaluation |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 7.3 — review and, where appropriate, update the policy and procedures at planned intervals and after significant incidents or significant changes to operations or risks | Triggers: re-assessment after significant incidents or changes (MA-17) |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.2.1 — regularly review compliance with the network and information system security policies, topic-specific policies, rules and standards; “The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.” | PH-8: results reported to the management body |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.2.3 — “The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur.” | Triggers: planned intervals and significant incidents or changes |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.3.1 — “The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies.” | Where a law asks for an independent review |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.3.2 — independent reviews are carried out by individuals with appropriate audit competence; staff who conduct them “shall not be in the line of authority of the personnel of the area under review”, and where the entity’s size does not allow that separation, alternative measures guarantee the impartiality of the reviews | Who may assess what; where a law asks for an independent review: line of authority and impartiality |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.3.4 — “The independent reviews shall take place at planned intervals and when significant incidents or significant changes to operations or risks occur.” | Triggers; the planned cycle (MA-17) |
DORA — Regulation (EU) 2022/2554 | Article 5(2)(f) — the management body shall “approve and periodically review the financial entity’s ICT internal audit plans, ICT audits and material modifications to them” | What an assessment is not: the management body's ICT audit plans stay separate |
DORA — Regulation (EU) 2022/2554 | Article 6(4) — a control function for ICT risk, independent enough to avoid conflicts of interest, and segregation of ICT risk management, control and internal audit functions | Where a law asks for an independent review: control and audit functions kept separate |
DORA — Regulation (EU) 2022/2554 | Article 6(6) — “The ICT risk management framework of financial entities, other than microenterprises, shall be subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan.” The auditors possess sufficient knowledge, skills and expertise in ICT risk and appropriate independence, and the frequency and focus of ICT audits are commensurate to the entity’s ICT risk | What an assessment is not: it is not the internal audit, and can inform it (MA-19) |
DORA — Regulation (EU) 2022/2554 | Article 6(10) — financial entities may outsource the tasks of verifying compliance with ICT risk management requirements to intra-group or external undertakings, and then remain “fully responsible for the verification of compliance with the ICT risk management requirements” | A contracted assessor: responsibility stays with the entity |
DORA — Regulation (EU) 2022/2554 | Article 16(1)(g) — the entities under the simplified ICT risk management framework, to which Articles 5 to 15 do not apply, “test, on a regular basis, the plans and measures referred to in point (f), as well as the effectiveness of the controls implemented in accordance with points (a) and (c)” | Where a law asks for an independent review: testing the effectiveness of controls under the simplified framework |
DORA — Delegated Regulation (EU) 2024/1774 | Article 28(4) — the entities under the simplified framework (DORA Article 16(1)) “shall ensure an appropriate segregation and the independence of control functions and internal audit functions” | Where a law asks for an independent review: independence of control and audit functions |
DORA — Delegated Regulation (EU) 2024/1774 | Article 28(5) — the simplified ICT risk management framework “is subject to an internal audit by auditors, in line with the financial entities’ audit plan”; the auditors have sufficient knowledge, skills and expertise in ICT risk “and shall be independent”, and the frequency and focus of ICT audits are commensurate to the entity’s ICT risk | What an assessment is not: the internal audit of the simplified framework stays separate |
GDPR — Regulation (EU) 2016/679 | Article 32(1)(d) — the security measures include, as appropriate, “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing” | The planned cycle: regularly assessing the effectiveness of the measures that protect personal data |
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.
Definitions
Term | Meaning in this procedure |
|---|---|
Action | The work that will move one practice up one level, with an owner, a due date and the evidence that will show it is done. |
Assessment lead | The person who plans the assessment, assigns assessors, decides each result and writes the report. Independent of the practices they rate. |
Break in series | A change to the model, the scope or the evidence window that means a result cannot be compared with an earlier one. It is marked, as P11's MR-09 marks a change to a metric (MA-15). |
Confidence | How a result was evidenced: Told, Seen or Tested (MA-13). |
Domain | One area of the security programme, such as risk management or identity and access, made up of two to three practices (DM-01 to DM-14). |
Domain level | The lowest level among a domain's practices that apply. One weak practice limits the domain, and an average would hide it (MA-06). |
Evidence | A document or record that shows a practice is done as the level requires. Interviews explain evidence; they are not evidence of Defined or Managed on their own (MA-02). |
Evidence window | The period records must fall in to count: the [[12]] months up to the last day of fieldwork, or the practice's own last cycle where it runs less often than that (MA-04). |
Finding | A practice below its domain's target, written as what was found, what the level needs, and the evidence seen. |
Gap | The number of levels between a domain's level and its target: 0 when the target is met, up to 3 (MA-10). |
Independent | Said of an assessor who neither owns nor runs the practice they rate, and did not write its procedure (MA-14). |
Level | One of the four levels of the scale: Not in place, Informal, Defined or Managed. The scale is P01-A09's, and P11 uses it too. |
Maturity | How reliably a security practice is done: whether it happens at all, whether it depends on particular people, whether it is written down and leaves a record, and whether it is measured, checked and improved. It describes how the practice works, not how exposed the organisation is today. |
Practice | One thing the programme does, stated as a question with the evidence each level needs (MP-01 to MP-32). Practices are what the assessor rates. |
Pressing | Said of a practice on which a risk outside appetite, or an obligation the organisation has recorded as not met, rests. Its action takes priority (MA-11). |
Re-assessment | Checking a practice again after its action closes, by someone other than the action's owner, to confirm the level moved (MA-18). |
Sample | The records the assessor chooses, not the practice owner, to check that a practice is done as its level requires (MA-05). |
Self-assessed | A result given by someone who owns or does the practice. It is marked as such and cannot be above Defined until someone independent checks the evidence (MA-14). |
Sponsor | The member of management who commissions the assessment, approves its scope and targets, and receives the report. |
Target | The level management decides a domain should reach, set before the evidence is scored, with the reason for it (MA-09). |
Working day | Monday to Friday, excluding [[public holidays where you are]]. |