Maturity Assessment Report Template
Reports current state, target state, gaps and a sequenced improvement plan for management approval.
Available soon
- Format
- Word
- Size
- 78 KB
- Length
- 29 pages
- Version
- 1.2
- Updated
What's inside
What changed
- 1.2
DM-14 Recovery and continuity names P22.
- 1.1
MP-24 names the monthly restore check of the ordering platform (P10 EA-04).
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
How to use this template
Use this template to report the result of one maturity assessment run under the Internal Security Assessment Procedure. It tells the approver where the security programme stands against the targets set for it, which gaps matter, what will be done about them, and what is being asked. It applies the Security Maturity Model & Scoring Method: levels and targets in words, gaps in levels, and no overall score.
The assessment lead writes it after validation (PH-6). The Head of Information Security adds the improvement plan from the tracker and the roadmap (PH-7). The assessment sponsor takes it, with the plan and the investment it needs, to the approver for decision (PH-8).
The report goes to the approver (the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management), who approves the targets and the improvement plan. The practice owners see the draft results first and may add evidence within [[5]] working days; the assessment lead decides, and records any disagreement (MA-16).
The eight sections
Every report has these sections, in this order. Do not leave one out: write "None" where a section has nothing to report.
Section | What it gives |
|---|---|
1. Summary for the approver | Where the programme stands against target, the three most important gaps, and the decisions asked for. |
2. Scope and method | Domains assessed and left out, the evidence window, the assessors and how independence was kept, and the model's version. |
3. Results by domain | Each domain's level, target, gap and the reason for the target, with no overall score. |
4. Findings | Each practice below target: what was found, what the next level needs, and the evidence seen. |
5. Changes since the last assessment | Levels that moved and why, and any break in series. |
6. Improvement plan | The next actions in priority order, their owners and dates, and the roadmap for later years. |
7. Limits of this assessment | Self-assessed results, practices not tested, and what the result does not say. |
8. Decisions requested | Approve the targets, the plan and the investment, or choose another option. |
Steps
- Start after validation. Write from the decided results, after practice owners have seen the draft results and the time to add evidence has passed (PH-5, MA-16). Never report a proposed level.
- Fill sections 2 and 3 first. Scope, method and the results by domain come straight from the questionnaire and the approved targets. Check each domain's level is the lowest of its practices (MA-06).
- Write the findings (section 4) from the assessors' notes: one per practice below its domain's target, in the order MA-11 gives the actions.
- Compare with the last assessment (section 5) only where the model, scope and evidence window are the same (MA-15). Otherwise mark the break in series.
- Add the improvement plan (section 6) from the Head of Information Security's tracker and roadmap (PH-7): one action per finding, one level per action (MA-12).
- Write the limits (section 7): count the self-assessed results, list what was not tested, and keep the statement of what the result is.
- Write the summary (section 1) and the decisions (section 8) last. They must say nothing the body does not show.
- Send it to the sponsor, who takes it, the plan and the investment options to the approver (PH-8).
Legal note
This document helps you judge how well your security practices work. It is not legal advice, and a maturity result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law or a certification asks for an assessment or an audit, confirm with counsel or your certification body what it must include.
What the report is and is not
A maturity result is not an internal audit, a certification or a statement of compliance, and is never presented as one. It can feed the management review, the internal audit programme and the risk register (MA-19).
So a report from this template is not the internal audit of the information security management system that ISO/IEC 27001 asks for (the ISO 27001 Implementation & Certification Readiness pack, P08, covers that), not the internal audit of the ICT risk management framework that DORA Article 6(6) asks of financial entities, and not the independent review of the NIS2 Implementing Regulation's Annex point 2.3. It can feed each of them. Section 7 of every report says so in the same words.
Where a law asks management to act on an evaluation
Framework references, at the end of this template, quote what each law asks. This table says how a report can feed it, never that a report meets it.
Law | How the report can feed it |
|---|---|
NIS2 Articles 20(1) and 21(2)(f) | The report records one such assessment and puts its result and a decision to the management body (sections 1, 3 and 8). |
NIS2 Implementing Regulation, Annex points 2.2.1, 2.2.2 and 2.3.3 (only the providers its Article 1 names) | The report can be part of that reporting, said to be a maturity result. It is not a compliance review or the independent review of point 2.3; its findings can be given to both. |
DORA Articles 5(2) and 6(5); Delegated Regulation (EU) 2024/1774 Articles 27(2) and 41(2) (financial entities) | Sections 3, 4 and 6 can supply those parts of the review report. The review and its report remain the entity's own. |
DORA Article 6(6) (financial entities other than microenterprises) | The report is not that audit. The auditors can use it to plan what to audit. |
GDPR Article 32(1)(d) | The report records one evaluation in that process. |
Rules and wording
These rules of the Security Maturity Model & Scoring Method decide most of what the report shows; MA-16 and MA-19 are quoted above, and the guidance in each section names the others. Quote them by number.
MA-06 A domain's level is the lowest level among its practices that apply. No average, no rounding.
MA-07 There is no overall score, no percentage and no weighting. The result is each domain's level and target, in words, and the gap between them.
MA-11 Every practice below its domain's target gets an action. Actions take priority first where a risk outside appetite, or an obligation the organisation has recorded as not met, rests on the practice; then the practice at the lower level; then the domain with the larger gap; then domain and practice order. Up to [[5]] actions take priority in one cycle.
MA-14 No one rates a practice they own or run (P08 IS-07). Where no independent assessor is available for a practice, the result is marked self-assessed and cannot be above Defined until someone independent checks the evidence.
MA-15 Results are compared over time only when the model, the scope and the evidence window are the same. Any change is a break in series, marked in the report as P11's MR-09 marks a changed metric.
Words to use and to avoid
Avoid | Write instead | Why |
|---|---|---|
A single maturity figure: an average of the levels, a score out of 100 or a percentage | "2 of 14 domains are at target. Ten are one level below target, and two are two levels below." | No overall score, no percentage, no average (MA-07). |
"Identity and access is mostly Defined" | "Identity and access is Informal: one practice is Defined and two practices are Informal." | A domain is its lowest practice (MA-06). |
"We are compliant with NIS2" or "the audit found" | "The assessment found" and "the result can feed the internal audit programme". | A maturity result is not an audit, a certification or compliance (MA-19). |
"Improved from last year" after the model changed | "Not comparable: break in series (the practice's criteria changed)." | Compare like with like only (MA-15). |
"Not applicable" for a weak practice | The level the evidence supports, and a finding. Not applicable only with a reason the sponsor approved. | MA-08. |
Writing a finding
A finding is a practice below its domain's target, written as what was found, what the level needs, and the evidence seen. Take what was found from the assessor's note. Take what the next level needs from the Security Maturity Model & Scoring Method: for Informal, the general evidence of that level; for Defined, the practice's own Defined evidence; for Managed, what its Managed evidence adds. Write what is missing, as fact, so the owner can act on it. Mark a finding pressing only where a risk is recorded as outside appetite, or an obligation is recorded as not met by the body that owns it (MA-11).
Before you send it
- Every domain's level is the lowest of its practices that apply, and every gap is the target minus the level, in levels (MA-06, MA-10).
- No overall score, percentage, average, weighting or colour total anywhere, including charts and the summary (MA-07).
- The targets in section 3 are the ones the sponsor approved before scoring, with the approval date (MA-09).
- Every result above Informal was at least Seen, every Managed result Tested, and every self-assessed result is marked and no higher than Defined (MA-13, MA-14).
- Every practice below its domain's target has one finding and one action, and no action moves a practice more than one level (MA-11, MA-12).
- Every disagreement recorded at validation is in the report (MA-16).
- The statement of what the result is, and is not, is in section 7 unchanged (MA-19).
- Roles, not names, throughout.
Send the full report to the assessment sponsor, executive management and internal audit, and each practice owner their own findings. The approver receives at least sections 1, 3, 6 and 8. Report the four measures the Maturity Findings & Improvement Tracker computes with it: MAM-01 domains at target; MAM-02 priority actions on time; MAM-03 self-assessed results; MAM-04 months since the last full assessment.
The report
Guidance — delete before approval
Copy this section into a new document for each assessment. Replace every value in [[double brackets]] and delete the guidance boxes.
Keep the levels, rules and IDs exactly as the Security Maturity Model & Scoring Method sets them. The domain and practice lists are the model's: if you have added a practice, add its row.
Report details
Assessment | |||
Assessment ID | [[ASM-YYYY-n]] | Report date | [[YYYY-MM-DD]] |
Organisation and the part assessed | [[Organisation Name; the whole organisation or the units assessed]] | ||
Assessment sponsor commissions it, approves scope and targets | [[Role, e.g. Chief Operating Officer]] | Assessment lead runs none of the practices assessed | [[Role]] |
Assessors and the number of practices each rated | [[Role: n practices; role: n practices]] | ||
Fieldwork | [[YYYY-MM-DD to YYYY-MM-DD]] | Evidence window MA-04 | The [[12]] months to the last day of fieldwork: [[YYYY-MM-DD to YYYY-MM-DD]] |
Model and edition | [[Security Maturity Model & Scoring Method, MP-01 to MP-32, edition]] | ||
Reviewed by before it goes to the approver | [[Executive management, YYYY-MM-DD]] | ||
Approver decides on the targets, the plan and the investment (MA-16) | [[the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management]] | Meeting date | [[YYYY-MM-DD]] |
Status | [[Draft / Final, for decision / Decided]] | ||
1. Summary for the approver
Guidance — delete before approval
A good section: One page. Counts written as counts ("[[n]] of [[n]] domains are at target"), the three gaps that matter with the risk or obligation on each, and the decisions asked for. A reader who stops here knows what to decide.
Sent back when: An overall maturity figure, a percentage or a traffic-light total (MA-07). Or a summary that names no risk or obligation, so the approver cannot see why a gap matters.
Where the programme stands
[[n]] of [[n]] domains are at target. [[n]] are one level below target, and [[n]] are [[two]] levels below. [[The domains at target.]] [[The largest gaps, with each domain's level and target.]] There is no overall score: the result is each domain's level and target, in words (MA-07).
[[First assessment: the baseline / Compared with the assessment of YYYY-MM-DD: what moved, see section 5.]] [[n]] of [[n]] results are self-assessed; section 7 sets out what the result does not say.
The three gaps that matter
A gap matters most where a risk outside appetite, or an obligation the organisation has recorded as not met, rests on it (MA-11).
Gap | Practices below target | What rests on it | Actions |
|---|---|---|---|
[[Domain]] [[Level, target]] | [[MP-nn name: level]] | [[Risk R-nn outside appetite, or the obligation recorded as not met, and where]] | [[MF-nn, due YYYY-MM-DD]] |
[[…]] | [[…]] | [[…]] | [[…]] |
[[…]] | [[…]] | [[…]] | [[…]] |
Decisions asked for
- Approve the targets in section 3, approved by the sponsor on [[YYYY-MM-DD]], before any evidence was scored.
- Approve the improvement plan in section 6: [[n]] actions this cycle, the first [[n]] with priority.
- Choose an investment option (section 8). We recommend option [[X]]: [[one-off spend]] and [[yearly spend]].
2. Scope and method
Guidance — delete before approval
A good section: The domains assessed and any left out, with the sponsor's reason; the evidence window as dates; who rated which practices and how no one rated their own work; the model's edition.
Sent back when: "All controls were reviewed" with no window, no assessors and no word on independence. A reader cannot judge how far to rely on the result.
Scope and method | |||
Domains assessed | [[n of 14 domains: which]] | ||
Left out, or Not applicable with the reason the sponsor approved (MA-08) | [[None / domain or practice: reason]] | ||
Sample MA-05 | [[3]] records, or all of them if fewer, chosen by the assessor | ||
How independence was kept MA-14 | [[Who rated which practices; that no one rated their own work; how many results are self-assessed, and which]] | ||
How results were evidenced MA-13 | [[Told: n of n Seen: n of n Tested: n of n]] | Validation MA-16 | [[Dates; results changed on added evidence; disagreements recorded]] |
The dates of each phase of the Internal Security Assessment Procedure.
Phase | What happened | Date |
|---|---|---|
PH-1 Plan | The assessment plan, approved by the sponsor, with the assessor for each practice. | [[YYYY-MM-DD]] |
PH-2 Set targets | The target for each domain, with its reason. | [[YYYY-MM-DD]] |
PH-3 Request evidence | The evidence requests, sent and acknowledged. | [[YYYY-MM-DD]] |
PH-4 Fieldwork | A proposed level, confidence and note for every practice. | [[YYYY-MM-DD]] |
PH-5 Validate | The decided results, with disagreements recorded. | [[YYYY-MM-DD]] |
PH-6 Report | The maturity assessment report. | [[YYYY-MM-DD]] |
PH-8 Approve | The approved targets, plan and investment, minuted. | [[YYYY-MM-DD]] |
3. Results by domain
Guidance — delete before approval
A good section: Each domain's level and target in words, the gap in levels, and the reason the sponsor gave for the target. The practice results beneath it, with the confidence and any self-assessed mark.
Sent back when: An average of the domains, a radar chart joining them into a shape, or a domain shown at Defined when one of its practices is Informal (MA-06).
Each domain's level is the lowest of its practices that apply (MA-06), and each gap is the target minus the level, in levels (MA-10). There is no overall score (MA-07). [[n]] of [[n]] domains are at target.
Domain | Practices | Level | Target | Gap | Reason for the target |
|---|---|---|---|---|---|
DM-01 Governance and accountability | MP-01 [[level]] MP-02 [[level]] MP-03 [[level]] | [[Level]] | [[Target]] | [[Gap]] | [[Default, or what rests on it]] |
DM-02 Policy | MP-04 [[level]] MP-05 [[level]] | [[Level]] | [[Target]] | [[Gap]] | [[Default, or what rests on it]] |
One row for every domain, DM-01 to DM-14, in the model's order. Give each practice's level after the caps for confidence and self-assessment (MA-13, MA-14), and mark any self-assessed or capped result. The Security Programme Maturity Assessment holds the evidence and note for each.
4. Findings
Guidance — delete before approval
A good section: For each practice below target: what was found, in the assessor's words; what the next level needs, from the model; and how the result was evidenced. Facts, not blame. Roles, not names.
Sent back when: "Access management is weak." A finding must say what is missing and what would show the next level, or the owner cannot act on it.
One finding for each practice below its domain's target, in the order MA-11 gives the actions. Give each finding the ID of its action in the tracker.
Finding | What was found | What the next level needs |
|---|---|---|
MF-[[nn]] [[MP-nn name]] [[Level, target]] [[Told / Seen / Tested, assessor's role]] [[Pressing?]] | [[What the assessor saw, and what was missing. Facts, roles not names]] | [[The next level, and its evidence from the model]] |
MF-[[nn]] | [[…]] | [[…]] |
Disagreements and changes at validation
[[MP-nn name.]] [[What the practice owner held, what the lead decided, and why (MA-16); or a result changed on evidence added at validation. Or: none.]]
5. Changes since the last assessment
Guidance — delete before approval
A good section: Each level that moved since the last assessment, and why. Any break in series, beside the results it affects. For a first assessment, say it is the baseline.
Sent back when: A change shown across a changed model or scope, or a fall in level explained away. A fall without a break in series is a finding (MA-15).
Compare like with like only (MA-15). A fall in level without a break in series is a finding.
Domain or practice | Last level | This level | Why it moved | Break in series |
|---|---|---|---|---|
[[DM-nn or MP-nn]] | [[Level]] | [[Level]] | [[An action closed and re-assessed; a person left; evidence accepted last time that should not have been]] | [[None / what changed: the model, the scope or the window]] |
[[…]] | [[…]] | [[…]] | [[…]] | [[…]] |
[[For a first assessment: None to compare. These results are the baseline.]]
6. Improvement plan
Guidance — delete before approval
A good section: The actions in MA-11's order, the priority ones first, each with one owner, a due date, the level it aims for and the evidence that will show it. Later steps by quarter, after the actions they wait on.
Sent back when: An action that jumps two levels, a Managed step planned before Defined has run for the set months (MA-12), or an action with no owner or date.
One action per finding, each moving its practice one level (MA-12), in MA-11's order. The first [[5]] take priority (MA-11); mark them. Each closes only on re-assessment by someone other than its owner (MA-18).
Actions this cycle
Action | Practice | What will be done | Owner, due | Effort, spend |
|---|---|---|---|---|
MF-[[nn]] [[Priority]] | [[MP-nn name]] [[From to]] | [[One action, one level (MA-12)]] | [[Role]] [[YYYY-MM-DD]] | [[S / M / L]] [[€ or in-house]] |
[[…]] | [[…]] | [[…]] | [[…]] | [[…]] |
Later steps
Step | Practice | After | Owner, due | Why |
|---|---|---|---|---|
RS-[[nn]] | [[MP-nn name]] [[From to]] | [[MF-nn]] | [[Role]] [[YYYY-MM-DD]] | [[The target needs a second level; Managed only after [[6]] months at Defined]] |
[[Total external spend, one-off and yearly; the rest in-house.]]
7. Limits of this assessment
Guidance — delete before approval
A good section: The count of self-assessed results, the practices rated on Told or Seen only, evidence that arrived after fieldwork, domains with no published pack, and the statement of what the result is.
Sent back when: No limits stated. A report with no limits is read as stronger than it is.
Limit | In this assessment |
|---|---|
Self-assessed results | [[n of n: which, and why no one independent was available]]. Marked, and no higher than Defined (MA-14). |
Rated on an interview alone | [[Which, and the level the evidence could support if shown]] |
Not tested on a sample | [[Which results rest on documents seen, with no sample checked]] |
Evidence after fieldwork | [[Not counted (MA-04). Which, and when the next assessment or re-assessment will see it]] |
Domains with no published pack | Protection of systems and data (DM-11) and Detection and monitoring (DM-12). Their practices are generic and set the minimum evidence for each level. |
What the result does not say | This report gives the maturity of the security programme: how reliably each practice is done, judged on evidence against the organisation's own model. It is not an internal audit, a certification or a statement that the organisation complies with any law or standard. It does not say how exposed the organisation is to attack today; read it beside the risk register. Its results can feed the management review, the internal audit programme and the risk register. |
8. Decisions requested
Guidance — delete before approval
A good section: Each decision the approver is asked to take, with the options, what each buys and what each leaves, and the recommendation. A place to record the decision and the minute.
Sent back when: "Note the report." The approver approves the targets, the plan and the investment (MA-16), or chooses another option.
The assessment sponsor asks the approver to take these decisions (MA-16).
Decision | What is asked | Recommendation |
|---|---|---|
1. Targets | Approve the target for every domain in section 3. | [[Approve / approve with changes]] |
2. Plan | Approve the actions and later steps in section 6, with their owners and dates. | [[Approve]] |
3. Investment | Choose one of the options below. | [[Option X]] |
The investment options
Cost each option from the roadmap. Say what each funds and what each leaves below target.
Option | What it funds | One-off | Each year | What it leaves |
|---|---|---|---|---|
A. [[Within the current budget]] | [[The items done in-house]] | [[€]] | [[€]] | [[The practices left below target, and the risk that stays]] |
B. [[Recommended option]] | [[…]] | [[€]] | [[€]] | [[…]] |
C. [[Faster or wider option]] | [[…]] | [[€]] | [[€]] | [[…]] |
Decision record | |||
Decided by the approver (MA-16) | [[The approver in the report details]] | Meeting date | [[YYYY-MM-DD]] |
Decision on the targets and the plan | [[Approved / approved with changes: which / not approved]] | ||
Option chosen | [[A / B / C / other]] | Minute reference | [[Reference]] |
Recorded by | [[Role, date]] | ||
Worked example: the distributor's first assessment
EXAMPLE. The organisation used throughout the pack is a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. It is an important entity under NIS2 in its Member State. This is the report on its first assessment, ASM-2026-1, led by its Internal Audit Manager. The Executive Committee reviewed it on 30 Sep 2026, and it goes to the board on 29 Oct 2026 for the investment decision. The organisation, roles, dates and amounts are fictional.
Guidance — delete before approval
Every result, target, finding, action and option here is the same as in the other P19 documents: the Security Programme Maturity Assessment records the evidence, the Maturity Findings & Improvement Tracker tracks the actions, the Target-State Maturity Roadmap sequences them and the Maturity Results Executive Summary Deck puts them to the board.
Note what the example shows: a domain at its lowest practice (MA-06), a result capped because it rested on an interview (MA-13), two results self-assessed and marked (MA-14), a disagreement recorded (MA-16), and evidence after fieldwork left out (MA-04).
Delete this worked example from your adopted template.
Report details (EXAMPLE)
Assessment — EXAMPLE | |||
Assessment ID | ASM-2026-1 | Report date | 29 Sep 2026 |
Organisation and the part assessed | A wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders | ||
Assessment sponsor commissions it, approves scope and targets | Chief Operating Officer | Assessment lead runs none of the practices assessed | Internal Audit Manager |
Assessors and the number of practices each rated | Internal Audit Manager: 21 practices Information Security Manager: 11 practices | ||
Fieldwork | 7 Sep 2026 to 18 Sep 2026 | Evidence window MA-04 | 19 Sep 2025 to 18 Sep 2026 |
Model and edition | P19 practices MP-01 to MP-32, first edition | ||
Reviewed by before it goes to the approver | Executive Committee, 30 Sep 2026 | ||
Approver decides on the targets, the plan and the investment (MA-16) | The board (a board of seven: the chair, the chief executive, the chief financial officer and four non-executive directors) | Meeting date | 29 Oct 2026 |
Status | Final, for decision | ||
1. Summary for the approver (EXAMPLE)
Where the programme stands
2 of 14 domains are at target. Ten are one level below target, and two are two levels below. Governance and accountability (DM-01) and awareness and training (DM-10) are at target. The two largest gaps are in measurement and assessment (Not in place, target Defined) and incident response and notification (Informal, target Managed). Measurement and assessment is Not in place because no assessment or audit of the security programme had been made before this one. There is no overall score: the result is each domain's level and target, in words (MA-07).
This is the organisation's first assessment, so it sets the baseline for the next one, due by 17 Sep 2027. 2 of 32 results are self-assessed, and section 7 sets out what the result does not say.
The three gaps that matter
A gap matters most where a risk outside appetite, or an obligation the organisation has recorded as not met, rests on it (MA-11). Three do. Their actions take priority.
Gap | Practices below target | What rests on it | Actions |
|---|---|---|---|
Policy Informal, target Defined | MP-04 Policy set: Informal | The board recorded NIS2 measure (h), cryptography, as outstanding until its policy is approved (P12, 30 Jul 2026). | MF-01, due 18 Dec 2026 |
Third-party security Informal, target Defined | MP-10 Supplier assessment: Informal | R-02, payment fraud through a compromised supplier email account, is outside appetite (P05). | MF-02, due 8 Dec 2026 |
Protection of systems and data Informal, target Defined Recovery and continuity Informal, target Defined | MP-24 Backups restored: Informal MP-32 Recovery tested: Informal | R-01, ransomware takes online ordering offline, is outside appetite (P05). | MF-03, due 29 Jan 2027 MF-04, due 26 Mar 2027 |
No practice in the two domains with the largest gaps is pressing, so their actions follow. MP-14 Assessment and follow-up is the fifth priority action: it is the only practice at Not in place. Incident response and notification has a Managed target, so each of its practices has an action, and MP-29 Notification readiness needs a second step after this cycle.
Decisions asked for
- Approve the targets in section 3, which the assessment sponsor approved on 21 Aug 2026, before any evidence was scored.
- Approve the improvement plan in section 6: 18 actions this cycle, the first 5 with priority, and two later steps.
- Choose an investment option (section 8). We recommend option B, close the gaps by the 2027 assessment: €59,000 one-off and €18,000 a year.
2. Scope and method (EXAMPLE)
Scope and method — EXAMPLE | |||
Domains assessed | The whole security programme, all fourteen domains. No practice was Not applicable. DM-01 to DM-14: 14 of 14. | ||
Left out, or Not applicable with the reason the sponsor approved (MA-08) | None | ||
Sample MA-05 | [[3]] records, or all of them if fewer, chosen by the assessor | ||
How independence was kept MA-14 | The Head of Information Security owns the programme and rated nothing. The lead runs none of the practices. The Information Security Manager rated the practices IT runs; the Internal Audit Manager rated the rest. 2 of 32 results are self-assessed (MP-26 and MP-27), marked, and no higher than Defined (MA-14). | ||
How results were evidenced MA-13 | Told: 1 of 32 Seen: 21 of 32 Tested: 10 of 32 | Validation MA-16 | Draft results shown 21 Sep 2026; owners could add evidence until 28 Sep 2026. One result was raised on added evidence (MP-30); one disagreement is recorded (MP-20, section 4). |
The assessment ran in the phases of the procedure. Every date below is before the report.
Phase | What happened | Date |
|---|---|---|
PH-1 Plan | Commissioned by the Chief Operating Officer | 20 Aug 2026 |
PH-2 Set targets | Targets approved, with reasons, before any evidence was scored (MA-09) | 21 Aug 2026 |
PH-3 Request evidence | Evidence requests sent to practice owners | 24 Aug 2026 |
PH-4 Fieldwork | Evidence reviewed, owners interviewed, samples checked | 7 Sep 2026 to 18 Sep 2026 |
PH-5 Validate | Draft results shown; owners could add evidence for 5 working days | 21 Sep 2026 to 28 Sep 2026 |
PH-6 Report | Report issued; reviewed by the Executive Committee on 30 Sep 2026 | 29 Sep 2026 |
PH-8 Approve | Targets, plan and investment to the board | 29 Oct 2026 |
3. Results by domain (EXAMPLE)
2 of 14 domains are at target. Ten are one level below target, and two are two levels below. Each domain's level is the lowest of its practices (MA-06), and each gap is the target minus the level, in levels (MA-10). There is no overall score (MA-07).
Domain | Practices | Level | Target | Gap | Reason for the target |
|---|---|---|---|---|---|
DM-01 Governance and accountability | MP-01 Defined MP-02 Defined MP-03 Defined | Defined | Defined | None | Default. NIS2 makes the management body answerable for the security measures (P12). |
DM-02 Policy | MP-04 Informal MP-05 Informal (capped, Told) | Informal | Defined | 1 level | Default. The board recorded the cryptography policy as outstanding on 30 Jul 2026 (P12, measure (h)). |
DM-03 Risk management and exceptions | MP-06 Defined MP-07 Defined MP-08 Informal | Informal | Defined | 1 level | Default. |
DM-04 Third-party security | MP-09 Defined MP-10 Informal | Informal | Defined | 1 level | Default. Supplier payment fraud, R-02, is outside appetite (P05). |
DM-05 Legal and regulatory obligations | MP-11 Defined MP-12 Informal | Informal | Defined | 1 level | Default. |
DM-06 Measurement and assessment | MP-13 Defined MP-14 Not in place | Not in place | Defined | 2 levels | Default. NIS2 asks for policies and procedures to assess whether the security measures are effective. |
DM-07 Assets and information | MP-15 Informal MP-16 Defined | Informal | Defined | 1 level | Default. |
DM-08 Vulnerabilities and patching | MP-17 Defined MP-18 Informal | Informal | Defined | 1 level | Default. |
DM-09 Identity and access | MP-19 Defined MP-20 Informal MP-21 Informal | Informal | Defined | 1 level | Default. |
DM-10 Awareness and training | MP-22 Defined MP-23 Defined | Defined | Defined | None | Default. |
DM-11 Protection of systems and data | MP-24 Informal MP-25 Informal | Informal | Defined | 1 level | Default. Ransomware taking ordering offline, R-01, is outside appetite (P05). |
DM-12 Detection and monitoring | MP-26 Informal (self-assessed) MP-27 Informal (self-assessed) | Informal | Defined | 1 level | Default. |
DM-13 Incident response and notification | MP-28 Defined MP-29 Informal MP-30 Defined | Informal | Managed | 2 levels | Incidents test the programme most often, NIS2's reporting deadlines rest on the response, and R-01 is outside appetite. Response must be measured and checked by someone other than the team that runs it. |
DM-14 Recovery and continuity | MP-31 Defined MP-32 Informal | Informal | Defined | 1 level | Default. R-01 is outside appetite (P05). |
Each practice's level is after the caps for confidence and self-assessment (MA-13, MA-14). How the results were evidenced: Told 1 of 32, Seen 21 of 32, Tested 10 of 32. The Security Programme Maturity Assessment holds the evidence and the assessor's note for every practice.
4. Findings (EXAMPLE)
18 practices are below their domain's target, so there are 18 findings, in the order MA-11 gives their actions. Each finding has the same ID as its action. Pressing findings, on which a risk outside appetite or a recorded unmet obligation rests, are marked.
Finding | What was found | What the next level needs |
|---|---|---|
MF-01 MP-04 Policy set Informal, target Defined Seen, Internal Audit Manager Pressing | Recent policies were approved at the right level, such as classification on 14 Jul 2026 (P15). There is no cryptography policy, and no register shows when each policy is due for review. | Defined: A policy set, each policy approved at the level its tier requires, with an owner and a review date, published where staff can read it. |
MF-02 MP-10 Supplier assessment Informal, target Defined Seen, Internal Audit Manager Pressing | 9 of 14 Tier 1 suppliers were assessed by the end of fieldwork; the other 5 are planned from 20 Oct to 8 Dec 2026 (P06). One High finding is past its deadline. | Defined: An assessment on record before contract for every supplier in the highest tiers, and a periodic review at the interval the tier sets. |
MF-03 MP-24 Backups restored Informal, target Defined Seen, Information Security Manager Pressing | Critical data is backed up daily, and an offline copy is kept. Since May 2026 IT has restored and checked one backup of the ordering platform each month (P10 EA-04), and the August incident restores worked (P09). No restore test is set for the rest of the critical data, so restoring it is not yet routine. | Defined: A backup schedule for critical data, a copy protected from the systems it backs up, and records of restore tests at the interval set. |
MF-04 MP-32 Recovery tested Informal, target Defined Tested, Information Security Manager Pressing | 2 of the 5 critical services were restored within their objectives in a test in the last 12 months (P03). The ordering platform cannot yet be restored within 24 hours; P05's TA-01 would rebuild its recovery. | Defined: Recovery tests at the interval set, with the time achieved recorded against the objective. |
MF-05 MP-14 Assessment and follow-up Not in place, target Defined Seen, Internal Audit Manager | No assessment or audit of the security programme had been made before this one (P12). | Informal: Someone can describe how it is done and show at least one instance, but there is no agreed written way of doing it, or the records are not kept consistently. |
MF-06 MP-29 Notification readiness Informal, target Managed Seen, Internal Audit Manager | The notification procedure was adopted on 15 Sep 2026; its first readiness check, on 18 Sep 2026, was Not ready (P18). The re-check on 25 Sep 2026 falls after fieldwork. | Defined: A record of which regimes apply, a written way of deciding whether to report, named people with tested access to each authority's channel, and records of decisions made. |
MF-07 MP-05 Policy acknowledgement Informal, target Defined Told, Internal Audit Manager | HR said every joiner acknowledges the policies at induction, but could not show the records during fieldwork, so the result is capped at Informal (MA-13). | Defined: Records of acknowledgement for the policies staff must follow, taken on joining and after each material change. |
MF-08 MP-08 Exceptions Informal, target Defined Tested, Internal Audit Manager | Four exceptions are open, and one of them expired and is still in use without a renewal decision (P03). | Defined: An exception register in which every exception has a risk owner, an approver at the level its rating requires, compensating controls and an expiry date. |
MF-09 MP-12 Compliance checked Informal, target Defined Seen, Internal Audit Manager | The board approved the NIS2 measures on 30 Jul 2026, but no check of whether they are in place had been made by the end of fieldwork. The first readiness self-assessment is set for 30 Sep 2026 (P12). | Defined: A check against each obligation at least each year, with gaps recorded and assigned. |
MF-10 MP-15 Asset inventory Informal, target Defined Seen, Information Security Manager | Devices and cloud services are listed in IT's tools, in separate lists, with no owner for each and no set process to keep them current. | Defined: An inventory of devices, software and cloud services, each with an owner, kept current by a set process. |
MF-11 MP-18 Fixing on time Informal, target Defined Tested, Information Security Manager | The most urgent fixes made on time fell to 81% against a target of 95% (P03). Two of the five findings sampled missed their June deadline with no approved deferral; deferrals have been approved as exceptions only since the patch standard was approved on 3 Sep 2026 (P17). | Defined: Written remediation deadlines by priority, records showing fixes against them, and a deferral approved as an exception whenever a deadline is missed. |
MF-12 MP-20 Access reviews Informal, target Defined Seen, Internal Audit Manager | The first review campaign under the procedure started on 1 Sep 2026 and had not closed by the end of fieldwork (P07). Earlier reviews were made by system owners in their own way, with no record of removals. | Defined: Access reviews of the in-scope systems at the interval the procedure sets, with removals made and recorded. |
MF-13 MP-21 Privileged access Informal, target Defined Seen, Information Security Manager | The privileged account inventory was built on 16 Sep and the standard approved on 18 Sep 2026, but separate administrator accounts went live only on 21 Sep, after fieldwork (P14). | Defined: A list of privileged accounts with an owner and approval for each, separate accounts for privileged work, and strong authentication on them. |
MF-14 MP-25 Secure configuration Informal, target Defined Seen, Information Security Manager | Servers are built to a checklist. Office PCs had local administrator rights until the August incident, and their removal is due by 31 Oct 2026 (P09 PIA-01). | Defined: Written configuration baselines for the main system types, and records showing new systems are built to them. |
MF-15 MP-26 Logging Informal, target Defined Seen, Information Security Manager, self-assessed | Logs from the ordering platform and the firewalls reach the managed provider's store; the warehouse systems' logs stay on the systems. There is no list of the sources required. Self-assessed: no one independent could judge the technical evidence in the time. | Defined: A list of the systems whose logs are collected, central collection protected from change, and retention as the organisation has decided. |
MF-16 MP-27 Alert handling Informal, target Defined Seen, Information Security Manager, self-assessed | Alerts go to the managed provider and the Information Security Manager, with no written criteria or response times. Self-assessed, for the same reason as MP-26. | Defined: Written criteria for the alerts that must be reviewed, a response time, and records of triage. |
MF-17 MP-28 Incident procedure Defined, target Managed Tested, Internal Audit Manager | The Q3 incidents followed the procedure's severity levels and roles, and the August ransomware incident had a post-incident review on 27 Aug 2026 (P09). | Managed: All of Defined, and: response measures are reported, and post-incident reviews lead to changes that are tracked to closure. |
MF-18 MP-30 Exercises Defined, target Managed Seen, Internal Audit Manager | The tabletop of 18 Mar 2026 has an after-action report, approved on 31 Mar 2026, with an owner for each lesson (P10). | Managed: All of Defined, and: lessons are tracked to closure and reported, and the programme varies scenarios and participants from year to year. |
Disagreements and changes at validation (EXAMPLE)
MP-20 Access reviews. The Head of Information Security held that the earlier reviews count. The lead kept Informal: they left no record of what was removed (MA-02).
MP-30 Exercises. Raised from Informal at validation, when the owner added the after-action report on 23 Sep 2026.
5. Changes since the last assessment (EXAMPLE)
None to compare. This is the organisation's first assessment: no assessment or audit of the security programme had been made before this one. These results are the baseline.
Item | This assessment |
|---|---|
Levels that moved | None: no earlier result |
Break in series (MA-15) | None: no earlier result. The model, scope and evidence window used are recorded in section 2 |
Next full assessment (MA-17) | Fieldwork by 17 Sep 2027. It compares with these results only if the model, the scope and the evidence window are the same |
Earlier re-assessment | Any domain, after a significant incident, a major change or a new obligation that rests on it (MA-17) |
6. Improvement plan (EXAMPLE)
18 actions this cycle, one for each finding, each moving its practice one level (MA-12). The first 5, in MA-11's order, take priority, and are marked. The Head of Information Security owns the Maturity Findings & Improvement Tracker, which tracks them; each closes only when a re-assessment by someone other than its owner shows the level moved (MA-18).
Actions this cycle (EXAMPLE)
Action | Practice | What will be done | Owner, due | Effort, spend |
|---|---|---|---|---|
MF-01 Priority | MP-04 Policy set Informal to Defined | Approve a cryptography policy, and keep a policy register with an approval and review date for every policy | Head of Information Security 18 Dec 2026 | Medium In-house |
MF-02 Priority | MP-10 Supplier assessment Informal to Defined | Assess the five remaining Tier 1 suppliers on P06's plan, and agree a date for the overdue High finding | Information Security Manager 8 Dec 2026 | Medium In-house |
MF-03 Priority | MP-24 Backups restored Informal to Defined | Protect the backup copy from the systems it backs up, and restore critical data in a test each quarter | Head of IT 29 Jan 2027 | Medium €9,000 |
MF-04 Priority | MP-32 Recovery tested Informal to Defined | Test the recovery of every critical service against its objective once the ordering platform's recovery is rebuilt | Head of IT 26 Mar 2027 | Large In-house |
MF-05 Priority | MP-14 Assessment and follow-up Not in place to Informal | Set the 2027 assessment in the plan, and report progress on this assessment's actions to the Executive Committee each quarter | Head of Information Security 18 Dec 2026 | Small In-house |
MF-06 | MP-29 Notification readiness Informal to Defined | Close P18's open readiness actions and rehearse a report in the October tabletop | Head of Information Security 31 Oct 2026 | Small In-house |
MF-07 | MP-05 Policy acknowledgement Informal to Defined | Keep policy acknowledgements in the HR system for every joiner and after each material change | HR Director 18 Dec 2026 | Small In-house |
MF-08 | MP-08 Exceptions Informal to Defined | Decide the expired exception, and check the exception register for expiries each month | Head of Information Security 30 Oct 2026 | Small In-house |
MF-09 | MP-12 Compliance checked Informal to Defined | Repeat the NIS2 readiness self-assessment each half year, with gaps assigned | Head of Information Security 31 Mar 2027 | Small In-house |
MF-10 | MP-15 Asset inventory Informal to Defined | Build one inventory of devices, software and services with an owner for each, and keep it current from purchasing and discovery | Head of IT 30 Jun 2027 | Large €12,000 |
MF-11 | MP-18 Fixing on time Informal to Defined | Bring the most urgent fixes back to deadline, with every miss deferred as an exception | Head of IT 29 Jan 2027 | Medium In-house |
MF-12 | MP-20 Access reviews Informal to Defined | Complete two review campaigns under the procedure, with removals recorded | Head of Information Security 31 Mar 2027 | Medium In-house |
MF-13 | MP-21 Privileged access Informal to Defined | Move every administrator to separate accounts with strong authentication, as P14's Tier 1 plan sets | Head of IT 18 Dec 2026 | Medium In-house |
MF-14 | MP-25 Secure configuration Informal to Defined | Write configuration baselines for servers and office PCs, and build new systems to them | Head of IT 30 Jun 2027 | Medium In-house |
MF-15 | MP-26 Logging Informal to Defined | List the log sources required and collect them all centrally, protected from change | Information Security Manager 10 Sep 2027 | Large €38,000 |
MF-16 | MP-27 Alert handling Informal to Defined | Write alert criteria and response times with the managed provider, and record triage | Information Security Manager 10 Sep 2027 | Medium In-house |
MF-17 | MP-28 Incident procedure Defined to Managed | Report incident response measures each month, and have post-incident actions checked by internal audit | Information Security Manager 30 Jun 2027 | Medium In-house |
MF-18 | MP-30 Exercises Defined to Managed | Track exercise lessons to closure and report them, and vary scenarios and participants each year | Information Security Manager 30 Jun 2027 | Small In-house |
Some actions wait on others: MF-04 on MF-03 and P05's TA-01, the rebuild of the ordering platform's recovery, whose funding goes to the board on 29 Oct 2026; MF-07 on MF-01; MF-16 on MF-15.
Later steps (EXAMPLE)
Two domains need a second step after this cycle's action. Managed is claimed only after a practice has run at Defined, with records, for [[6]] months (MA-12). The Target-State Maturity Roadmap sequences every step by quarter.
Step | Practice | After | Owner, due | Why |
|---|---|---|---|---|
RS-01 | MP-14 Assessment and follow-up Informal to Defined | MF-05 | Head of Information Security 17 Sep 2027 | The 2027 assessment follows up this one's findings. |
RS-02 | MP-29 Notification readiness Defined to Managed | MF-06 | Head of Information Security 30 Jun 2027 | Six months of decisions and reports on time, measured, with readiness re-checked. |
External spend in the plan: MF-03 €9,000, MF-10 €12,000 and MF-15 €38,000, €59,000 in all, with €18,000 a year after it. The rest is done in-house. Effort bands: Small, up to 5 person-days; Medium, 6 to 20 person-days; Large, 21 to 60 person-days.
7. Limits of this assessment (EXAMPLE)
Limit | In this assessment |
|---|---|
Self-assessed results | 2 of 32: MP-26 Logging and MP-27 Alert handling. Rated by their owner, the Information Security Manager, because no one independent could judge the technical evidence in the time. Marked, and no higher than Defined (MA-14); both are Informal, so the cap did not change them. |
Rated on an interview alone | MP-05 Policy acknowledgement, capped at Informal (MA-13). The records could support more if shown. |
Defined on documents, not a sample | 9 practices are Defined on Seen evidence, with no sample checked: MP-01, MP-03, MP-07, MP-09, MP-11, MP-17, MP-23, MP-30 and MP-31. Seen supports Defined; a sample would make the result firmer. |
Evidence after fieldwork | Not counted (MA-04): MP-21 Privileged access and MP-29 Notification readiness, whose changes landed after 18 Sep 2026. They count when the actions are re-assessed (MA-18). |
Domains with no published pack | Protection of systems and data (DM-11) and Detection and monitoring (DM-12). Their practices are generic and set the minimum evidence for each level. |
What the result does not say | This report gives the maturity of the security programme: how reliably each practice is done, judged on evidence against the organisation's own model. It is not an internal audit, a certification or a statement that the organisation complies with any law or standard. It does not say how exposed the organisation is to attack today; read it beside the risk register. Its results can feed the management review, the internal audit programme and the risk register. |
8. Decisions requested (EXAMPLE)
The Chief Operating Officer asks the board, on 29 Oct 2026, to take three decisions (MA-16).
Decision | What is asked | Recommendation |
|---|---|---|
1. Targets | Approve the target for every domain in section 3: Defined for thirteen domains, and Managed for incident response and notification. | Approve. The assessment sponsor set them on 21 Aug 2026, before scoring (MA-09). |
2. Plan | Approve the 18 actions and two later steps in section 6, with their owners and dates. | Approve, with progress reported each quarter by the Head of Information Security. |
3. Investment | Choose one of the options below. | Option B. |
The investment options (EXAMPLE)
Each option is costed from the roadmap. Option A drops every item with external spend, and every item that waits on one.
Option | What it funds | One-off | Each year | What it leaves |
|---|---|---|---|---|
A. Within the current budget | 15 of the 20 roadmap items: those done in-house. | None | None | The practices Backups restored, Recovery tested, Asset inventory, Logging and Alert handling stay below target, and R-01's recovery work has no protected copies to restore from. |
B. Close the gaps by the 2027 assessment Recommended | All 20 roadmap items. | €59,000 | €18,000 | Detection reaches Defined only a week before the 2027 assessment's fieldwork ends. |
C. B, with a managed detection service | All 20 roadmap items, and a managed detection service (€60,000 to set up), with MF-15 and MF-16 due by 10 Mar 2027 instead of 10 Sep 2027. | €119,000 | €95,000 | Costs about five times B each year, for detection six months sooner. |
Decision record — EXAMPLE | |||
Decided by the approver (MA-16) | The board (a board of seven: the chair, the chief executive, the chief financial officer and four non-executive directors) | Meeting date | 29 Oct 2026 |
Decision on the targets and the plan | To be recorded at the meeting of 29 Oct 2026 | ||
Option chosen | To be recorded; option B is recommended | Minute reference | To be recorded at the meeting of 29 Oct 2026 |
Recorded by | The assessment sponsor, the Chief Operating Officer, after the meeting | ||
Related documents
Document | Relationship |
|---|---|
Security Maturity Model & Scoring Method | The scale, domains, practices and rules MA-01 to MA-19 the report applies |
Internal Security Assessment Procedure | How the assessment is planned, run and validated before the report is written (PH-1 to PH-6), and who may assess what |
Security Programme Maturity Assessment | The questionnaire: every result, confidence and note in sections 3 and 4 |
Maturity Findings & Improvement Tracker | The findings and actions in sections 4 and 6, tracked to re-assessment (MA-18) |
Target-State Maturity Roadmap | The later steps and the investment options in sections 6 and 8 |
Maturity Results Executive Summary Deck | The five slides that put sections 1 and 8 to the approver |
ISO 27001 Implementation & Certification Readiness (P08) | The internal audit programme, which a result can feed (MA-19) |
Information Security Risk Management (P05) | The risk register, which says which risks are outside appetite (MA-11) |
Adapting this template
Guidance — delete before approval
Small organisation: the report can be shorter, but keep sections 3, 4, 7 and 8 in full: they are what the approver relies on. Where one person runs security, say in section 2 who assessed instead, and count the self-assessed results in section 7. If more than a third would be self-assessed, the Internal Security Assessment Procedure has the sponsor decide whether to commission an independent assessment, and record the decision (IT-3).
Re-assessment of one domain after an incident or a change (MA-17): use sections 2 to 5 and 7 for that domain, and say in section 5 whether the result is comparable with the last full assessment (MA-15).
Regulated entity (NIS2, DORA): use the table "Where a law asks management to act on an evaluation" to show where the report feeds your duties, and keep each approved report with its minute. A financial entity's internal audit under DORA Article 6(6) remains a separate duty for independent auditors.
Group or several business units: report each unit's profile separately. Never combine units into one level by averaging; where one view is needed, use the lowest level, as for a domain (MA-06).
Charts: a bar for each domain showing its level and its target is fine. Do not join the domains into a radar shape, total them, or colour them into a single status (MA-07).
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR).
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | The whole report: the results of monitoring, measurement, analysis and evaluation, reported and retained |
ISO/IEC 27001:2022 | Clause 9.3.2 — Management review inputs | Sections 1, 3 and 5: results as an input to the management review |
ISO/IEC 27001:2022 | Clause 10.2 — Nonconformity and corrective action | Sections 4 and 6: gaps, the actions to close them, and their re-assessment (MA-18) |
NIST CSF 2.0 | ID.IM-01 — “Improvements are identified from evaluations” | Sections 4 and 6: improvements identified from the evaluation, in priority order |
NIS2 — Directive (EU) 2022/2555 | Article 20(1) — management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements | Sections 1, 3 and 8: the management body sees how the measures work and decides on the plan |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | The whole report: the record of an assessment of whether the security measures are effective |
NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Who the Implementing Regulation binds; for other entities its Annex is a guide only |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.2.1 — regularly review compliance with the network and information system security policies, topic-specific policies, rules and standards; “The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.” | Sections 1 and 3: reporting the status of security to the management body (a maturity result, not a compliance review) |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.2.2 — an effective compliance reporting system, appropriate to the entity’s structures, operating environments and threat landscapes, “capable to provide to the management bodies an informed view of the current state of the relevant entities’ management of risks” | Section 3: a view of how risks are managed, domain by domain, for the management body |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.3.3 — the results of the independent reviews, including the results of compliance monitoring (point 2.2) and of monitoring and measurement (point 7), are reported to the management bodies; “Corrective actions shall be taken or residual risk accepted according to the relevant entities’ risk acceptance criteria.” | Sections 4, 6 and 8: findings, corrective actions and decisions that an independent review's reporting can draw on; the report is not that review |
DORA — Regulation (EU) 2022/2554 | Article 5(2) — the management body defines, approves, oversees and is responsible for the ICT risk management framework, bears ultimate responsibility for ICT risk and sets the risk tolerance | Section 8: the management body's decision on the plan and the investment |
DORA — Regulation (EU) 2022/2554 | Article 6(5) — the ICT risk management framework is documented and reviewed at least once a year (periodically for microenterprises), upon major ICT-related incidents, and following supervisory instructions or conclusions from digital operational resilience testing or audit processes; “It shall be continuously improved on the basis of lessons derived from implementation and monitoring.” A report on the review is submitted to the competent authority on request | Sections 3, 4 and 6: results the yearly review of the framework can use |
DORA — Regulation (EU) 2022/2554 | Article 6(6) — “The ICT risk management framework of financial entities, other than microenterprises, shall be subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan.” The auditors possess sufficient knowledge, skills and expertise in ICT risk and appropriate independence, and the frequency and focus of ICT audits are commensurate to the entity’s ICT risk | Legal note and section 7: the report is not the internal audit, and can inform it (MA-19) |
DORA — Delegated Regulation (EU) 2024/1774 | Article 27(2) — the report on the review of the ICT risk management framework (DORA Article 6(5)) contains, among other things, an executive-level summary of the ICT risk profile, threat landscape, “the assessed effectiveness of its controls” and security posture; the date of the management body’s approval; the reason for the review; the function responsible; the findings, with an assessment of the severity of weaknesses, deficiencies and gaps; the measures to address them, with expected dates, responsible functions and resource impact; the criteria for accepting residual risk where gaps are not remedied; planned developments; and the state of corrective measures from past reviews | Sections 3, 4 and 6: assessed effectiveness, gaps and measures with dates and owners, for the review report |
DORA — Delegated Regulation (EU) 2024/1774 | Article 41(2) — the review report of the simplified framework contains, among other things, “a self-assessment of the severity of the weaknesses, deficiencies, and gaps identified”, the remedying measures with expected implementation dates, including follow-up of gaps from previous reports not yet remedied, and overall conclusions with planned developments | Sections 4 and 6: gaps and remedying measures with dates, for the simplified review report |
GDPR — Regulation (EU) 2016/679 | Article 32(1)(d) — the security measures include, as appropriate, “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing” | The whole report: one evaluation in the process for assessing whether the measures protecting personal data work |
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.
Definitions
Term | Meaning in this template |
|---|---|
Action | The work that will move one practice up one level, with an owner, a due date and the evidence that will show it is done. |
Assessment lead | The person who plans the assessment, assigns assessors, decides each result and writes the report. Independent of the practices they rate. |
Break in series | A change to the model, the scope or the evidence window that means a result cannot be compared with an earlier one. It is marked, as P11's MR-09 marks a change to a metric (MA-15). |
Confidence | How a result was evidenced: Told, Seen or Tested (MA-13). |
Domain | One area of the security programme, such as risk management or identity and access, made up of two to three practices (DM-01 to DM-14). |
Domain level | The lowest level among a domain's practices that apply. One weak practice limits the domain, and an average would hide it (MA-06). |
Evidence | A document or record that shows a practice is done as the level requires. Interviews explain evidence; they are not evidence of Defined or Managed on their own (MA-02). |
Evidence window | The period records must fall in to count: the [[12]] months up to the last day of fieldwork, or the practice's own last cycle where it runs less often than that (MA-04). |
Finding | A practice below its domain's target, written as what was found, what the level needs, and the evidence seen. |
Gap | The number of levels between a domain's level and its target: 0 when the target is met, up to 3 (MA-10). |
Level | One of the four levels of the scale: Not in place, Informal, Defined or Managed. The scale is P01-A09's, and P11 uses it too. |
Maturity | How reliably a security practice is done: whether it happens at all, whether it depends on particular people, whether it is written down and leaves a record, and whether it is measured, checked and improved. It describes how the practice works, not how exposed the organisation is today. |
Practice | One thing the programme does, stated as a question with the evidence each level needs (MP-01 to MP-32). Practices are what the assessor rates. |
Pressing | Said of a practice on which a risk outside appetite, or an obligation the organisation has recorded as not met, rests. Its action takes priority (MA-11). |
Re-assessment | Checking a practice again after its action closes, by someone other than the action's owner, to confirm the level moved (MA-18). |
Sample | The records the assessor chooses, not the practice owner, to check that a practice is done as its level requires (MA-05). |
Self-assessed | A result given by someone who owns or does the practice. It is marked as such and cannot be above Defined until someone independent checks the evidence (MA-14). |
Sponsor | The member of management who commissions the assessment, approves its scope and targets, and receives the report. |
Target | The level management decides a domain should reach, set before the evidence is scored, with the reason for it (MA-09). |