Maturity Findings & Improvement Tracker

Tracks improvement actions from assessment findings through to re-assessment.

Available soon

Format: Excel
Size: 109 KB
Length: 12 sheets
Version: 1.3
Updated: 2 Oct 2026

Follow this documentFree account. We can email you when it changes.

What's inside

Instructions
Findings
Actions
Domain Results
Measures
How to Close
Lists
Definitions
Framework References

What changed

1.33 Oct 2026
DM-14 names P23.
1.22 Oct 2026
DM-14 Recovery and continuity names P22.
1.12 Oct 2026
MP-24 names the monthly restore check of the ordering platform (P10 EA-04).

Earlier versions (1)

1.02 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	What this tracker is. The record of what an assessment found and what is being done about it, kept by the Head of Information Security (Internal Security Assessment Procedure, phase PH-7). It starts when the lead decides the results (PH-5) and runs until the next full assessment, at most [[12]] months later (MA-17).
2	On the Measures sheet, set the As-at date: the date every overdue flag and measure is worked out at. For the quarterly progress report, use the quarter's last day. Enter the last day of fieldwork of the last full assessment, and confirm the settings.
3	On the Domain Results sheet, enter the target the sponsor approved for each domain before scoring, with its reason (MA-09). Never change a target to fit the results.
4	On the Findings sheet, copy each practice's decided result from the Assessment Evidence Request Checklist or the Security Programme Maturity Assessment: owner, who rated it, the level the evidence supports, the confidence and whether it is self-assessed. The workbook applies the caps of MA-13 and MA-14. Write what was found, and name any risk outside appetite or recorded unmet obligation that rests on the practice.
5	Read the Findings sheet. Every practice below its domain's target is a finding and needs an action (MA-11). The Action order column gives the order MA-11 sets; the first [[5]] take priority. 'What the next level needs' says what the action must produce.
6	On the Actions sheet, add one row per finding: the practice and its level now. The target level calculates as one level up, never two (MA-12). Write the action, the owner, the due date, the effort and the evidence that will show it is done. Where the action cannot start until another step closes, name that step in 'Waits for'.
7	Add the later steps a domain's target needs, such as Defined to Managed, as their own rows naming the step they follow. Managed can be claimed only after [[6]] months at Defined; the Sequence check flags a due date earlier than that.
8	Take the Actions sheet, with the Target-State Maturity Roadmap, to the approver for approval (PH-8). Then set every approved action to Open.
9	Owners move their actions to In progress, then to Ready for re-assessment with the evidence. Name a re-assessor who is not the owner. Where no one else can judge it, use the options in the Internal Security Assessment Procedure (MA-14).
10	The re-assessor checks the practice against the level aimed for, as the assessment did: evidence in the window, a sample they choose. Enter who, when and the level found, and set Closed or Not achieved. The Closure check flags any action closed without a re-assessment, or by its owner (MA-18).
11	Every quarter, report the Measures sheet to the sponsor: the four headline measures, the actions overdue and the domains at target. Levels on the Findings and Domain Results sheets follow the latest re-assessments.
12	To start your own tracker, delete the contents of the first column and of every yellow cell on the Findings and Actions sheets, and the targets on the Domain Results sheet. The practices and formulas stay. Rows at the foot of the Findings sheet take practices you add.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Limitations: This document helps you judge how well your security practices work. It is not legal advice, and a maturity result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law or a certification asks for an assessment or an audit, confirm with counsel or your certification body what it must include.

A maturity result is not an internal audit, a certification or a statement of compliance, and is never presented as one. It can feed the management review, the internal audit programme and the risk register. An action closed here means the practice reached a level on re-assessment. It is not an audit finding closed, and not evidence of compliance.

MA-14 and MA-18 apply P08's IS-07: "Internal auditors must not audit their own work." Closing your own action is the same as auditing your own work.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State. Its first assessment, ASM-2026-1, led by its Internal Audit Manager, had fieldwork from 7 Sep 2026 to 18 Sep 2026. 2 of 14 domains are at target. The tracker, as at 30 Sep 2026, holds 18 actions, one for each practice below target, and the roadmap's two second steps. Nothing is due yet, and every action is Open.

Domains with no published pack: DM-11 Protection of systems and data and DM-12 Detection and monitoring. Their actions rest on what the practice's next level needs, on the Findings sheet.

Tailoring — small organisation: one person may own most actions. Re-assessment still needs someone else: a colleague from another function, or a reciprocal assessor.

Tailoring — findings from other sources: an internal audit, a supplier review or a regulator may find the same weakness. Keep their findings in their own trackers, and note the link here; one action may answer both.

Tailoring — financial entity under DORA: where the internal audit of the ICT risk management framework finds a weakness in a practice, follow up that finding by the audit's own rules. This tracker can show the practice's level; it does not replace the audit's follow-up.

This workbook is your own record. Keep it with the assessment report and the roadmap.

Findings

One row per practice, from the decided results. A practice below its domain's target is a finding and needs an action (MA-11). Yellow columns are yours; the others calculate.

Row	Practice ID	Domain	Practice	Practice owner	Rated by	Level the evidence supports	Confidence	Self-assessed	Level decided (calc)	Check (calc)	Domain target (calc)	Below target? (calc)	What was found	Risk outside appetite or unmet obligation that rests on it	What the next level needs (calc)	Order key (working)	Action order (MA-11, calc)	Priority (calc)	Level now, after re-assessments (calc)
EXAMPLE	MP-01	Governance and accountability	Accountable person	Chief Operating Officer	Internal Audit Manager	Defined	Seen	No	Defined	OK	Defined	No	The Head of Information Security's role description, approved by the Executive Committee, sets out the role's reporting line and authority. Objectives are not yet reviewed against results each year.						Defined
EXAMPLE	MP-02	Governance and accountability	Management reporting	Head of Information Security	Internal Audit Manager	Defined	Tested	No	Defined	OK	Defined	No	The last four quarterly board reports and their minutes each record decisions, such as the approval of the security measures on 30 Jul 2026 (P12). The decisions are not yet tracked back to the board as a list.						Defined
EXAMPLE	MP-03	Governance and accountability	Security objectives	Head of Information Security	Internal Audit Manager	Defined	Seen	No	Defined	OK	Defined	No	The 2026 security plan has nine milestones with owners and dates, reported to the board each quarter (P03: 7 of 9 on track).						Defined
EXAMPLE	MP-04	Policy	Policy set	Head of Information Security	Internal Audit Manager	Informal	Seen	No	Informal	OK	Defined	Yes	Recent policies were approved at the right level, such as classification on 14 Jul 2026 (P15). There is no cryptography policy, and no register shows when each policy is due for review.	The board recorded NIS2 measure (h), cryptography, as outstanding until its policy is approved (P12, 30 Jul 2026)	A policy set, each policy approved at the level its tier requires, with an owner and a review date, published where staff can read it.	220204	1	Yes	Informal
EXAMPLE	MP-05	Policy	Policy acknowledgement	HR Director	Internal Audit Manager	Defined	Told	No	Informal	Capped by confidence (MA-13)	Defined	Yes	HR said every joiner acknowledges the policies at induction, but could not show the records during fieldwork, so the result is capped at Informal (MA-13).		Records of acknowledgement for the policies staff must follow, taken on joining and after each material change.	1220205	7	No	Informal
EXAMPLE	MP-06	Risk management and exceptions	Risk register	Head of Information Security	Internal Audit Manager	Defined	Tested	No	Defined	OK	Defined	No	Twelve risks, each with an owner and a rating by the written method. R-04 was re-rated on 20 Aug 2026 after the August ransomware incident (P05).						Defined
EXAMPLE	MP-07	Risk management and exceptions	Risk appetite	Head of Information Security	Internal Audit Manager	Defined	Seen	No	Defined	OK	Defined	No	The board approved the appetite on 30 Jul 2026. Both risks outside it, R-01 and R-02, carry a decision to treat them; R-01's funding goes to the board on 29 Oct 2026 (P05 TA-01).						Defined
EXAMPLE	MP-08	Risk management and exceptions	Exceptions	Head of Information Security	Internal Audit Manager	Informal	Tested	No	Informal	OK	Defined	Yes	Four exceptions are open, and one of them expired and is still in use without a renewal decision (P03).		An exception register in which every exception has a risk owner, an approver at the level its rating requires, compensating controls and an expiry date.	1220308	8	No	Informal
EXAMPLE	MP-09	Third-party security	Supplier tiering and contracts	Procurement	Internal Audit Manager	Defined	Seen	No	Defined	OK	Defined	No	Every supplier with access to data or systems is tiered (14 in Tier 1, 22 in Tier 2, 31 in Tier 3, 45 in Tier 4), and the three Tier 1 contracts sampled carry the incident notification clause (P06 CL-07).						Defined
EXAMPLE	MP-10	Third-party security	Supplier assessment	Information Security Manager	Internal Audit Manager	Informal	Seen	No	Informal	OK	Defined	Yes	9 of 14 Tier 1 suppliers were assessed by the end of fieldwork; the other 5 are planned from 20 Oct to 8 Dec 2026 (P06). One High finding is past its deadline.	R-02, payment fraud through a compromised supplier email account, is outside appetite (P05)	An assessment on record before contract for every supplier in the highest tiers, and a periodic review at the interval the tier sets.	220410	2	Yes	Informal
EXAMPLE	MP-11	Legal and regulatory obligations	Obligations known and owned	Head of Information Security	Internal Audit Manager	Defined	Seen	No	Defined	OK	Defined	No	The NIS2 scope assessment, approved by the board on 21 May 2026, records the company as an important entity (P12). The applicability profile approved on 15 Sep 2026 records its GDPR role and that DORA does not apply (P18).						Defined
EXAMPLE	MP-12	Legal and regulatory obligations	Compliance checked	Head of Information Security	Internal Audit Manager	Informal	Seen	No	Informal	OK	Defined	Yes	The board approved the NIS2 measures on 30 Jul 2026, but no check of whether they are in place had been made by the end of fieldwork. The first readiness self-assessment is set for 30 Sep 2026 (P12).		A check against each obligation at least each year, with gaps recorded and assigned.	1220512	9	No	Informal
EXAMPLE	MP-13	Measurement and assessment	Security metrics	Head of Information Security	Internal Audit Manager	Defined	Tested	No	Defined	OK	Defined	No	Every reported metric has an approved definition card and a validator who is not its supplier, and data quality checks ran in the July and August cycles (P11).						Defined
EXAMPLE	MP-14	Measurement and assessment	Assessment and follow-up	Head of Information Security	Internal Audit Manager	Not in place	Seen	No	Not in place	OK	Defined	Yes	No assessment or audit of the security programme had been made before this one (P12).		Someone can describe how it is done and show at least one instance, but there is no agreed written way of doing it, or the records are not kept consistently.	1110614	5	Yes	Not in place
EXAMPLE	MP-15	Assets and information	Asset inventory	Head of IT	Information Security Manager	Informal	Seen	No	Informal	OK	Defined	Yes	Devices and cloud services are listed in IT's tools, in separate lists, with no owner for each and no set process to keep them current.		An inventory of devices, software and cloud services, each with an owner, kept current by a set process.	1220715	10	No	Informal
EXAMPLE	MP-16	Assets and information	Information classification	Head of Information Security	Internal Audit Manager	Defined	Tested	No	Defined	OK	Defined	No	The classification policy was approved on 14 Jul 2026, the information register built on 28 Aug, and the first handling check made on 17 Sep 2026 (P15).						Defined
EXAMPLE	MP-17	Vulnerabilities and patching	Finding and prioritising vulnerabilities	Head of IT	Information Security Manager	Defined	Seen	No	Defined	OK	Defined	No	Scans cover the in-scope systems, and findings are prioritised by the written method. The board receives the share of the most urgent fixes made on time (P03).						Defined
EXAMPLE	MP-18	Vulnerabilities and patching	Fixing on time	Head of IT	Information Security Manager	Informal	Tested	No	Informal	OK	Defined	Yes	The most urgent fixes made on time fell to 81% against a target of 95% (P03). Two of the five findings sampled missed their June deadline with no approved deferral; deferrals have been approved as exceptions only since the patch standard was approved on 3 Sep 2026 (P17).		Written remediation deadlines by priority, records showing fixes against them, and a deferral approved as an exception whenever a deadline is missed.	1220818	11	No	Informal
EXAMPLE	MP-19	Identity and access	Joiners, movers and leavers	Head of IT	Information Security Manager	Defined	Tested	No	Defined	OK	Defined	No	Five leavers sampled from HR records: four had their access removed in time. The fifth was found by the monthly reconciliation and removed, so the practice caught its own failure (MA-05) (P13).						Defined
EXAMPLE	MP-20	Identity and access	Access reviews	Head of Information Security	Internal Audit Manager	Informal	Seen	No	Informal	OK	Defined	Yes	The first review campaign under the procedure started on 1 Sep 2026 and had not closed by the end of fieldwork (P07). Earlier reviews were made by system owners in their own way, with no record of removals. Disagreement recorded: The Head of Information Security held that the earlier reviews count. The lead kept Informal: they left no record of what was removed (MA-02).		Access reviews of the in-scope systems at the interval the procedure sets, with removals made and recorded.	1220920	12	No	Informal
EXAMPLE	MP-21	Identity and access	Privileged access	Head of IT	Information Security Manager	Informal	Seen	No	Informal	OK	Defined	Yes	The privileged account inventory was built on 16 Sep and the standard approved on 18 Sep 2026, but separate administrator accounts went live only on 21 Sep, after fieldwork (P14).		A list of privileged accounts with an owner and approval for each, separate accounts for privileged work, and strong authentication on them.	1220921	13	No	Informal
EXAMPLE	MP-22	Awareness and training	Training	Information Security Manager	Internal Audit Manager	Defined	Tested	No	Defined	OK	Defined	No	A training plan by audience for July 2026 to June 2027, approved on 26 Jun 2026 (P16). Completion records for the ten people sampled were complete.						Defined
EXAMPLE	MP-23	Awareness and training	Behaviour measured	Information Security Manager	Internal Audit Manager	Defined	Seen	No	Defined	OK	Defined	No	The reporting rate of simulated phishing is measured each month from July 2026 (P16). It has no target yet.						Defined
EXAMPLE	MP-24	Protection of systems and data	Backups restored	Head of IT	Information Security Manager	Informal	Seen	No	Informal	OK	Defined	Yes	Critical data is backed up daily, and an offline copy is kept. Since May 2026 IT has restored and checked one backup of the ordering platform each month (P10 EA-04), and the August incident restores worked (P09). No restore test is set for the rest of the critical data, so restoring it is not yet routine.	R-01, ransomware takes online ordering offline, is outside appetite (P05)	A backup schedule for critical data, a copy protected from the systems it backs up, and records of restore tests at the interval set.	221124	3	Yes	Informal
EXAMPLE	MP-25	Protection of systems and data	Secure configuration	Head of IT	Information Security Manager	Informal	Seen	No	Informal	OK	Defined	Yes	Servers are built to a checklist. Office PCs had local administrator rights until the August incident, and their removal is due by 31 Oct 2026 (P09 PIA-01).		Written configuration baselines for the main system types, and records showing new systems are built to them.	1221125	14	No	Informal
EXAMPLE	MP-26	Detection and monitoring	Logging	Information Security Manager	Information Security Manager	Informal	Seen	Yes	Informal	OK	Defined	Yes	Logs from the ordering platform and the firewalls reach the managed provider's store; the warehouse systems' logs stay on the systems. There is no list of the sources required. Self-assessed: no one independent could judge the technical evidence in the time.		A list of the systems whose logs are collected, central collection protected from change, and retention as the organisation has decided.	1221226	15	No	Informal
EXAMPLE	MP-27	Detection and monitoring	Alert handling	Information Security Manager	Information Security Manager	Informal	Seen	Yes	Informal	OK	Defined	Yes	Alerts go to the managed provider and the Information Security Manager, with no written criteria or response times. Self-assessed, for the same reason as MP-26.		Written criteria for the alerts that must be reviewed, a response time, and records of triage.	1221227	16	No	Informal
EXAMPLE	MP-28	Incident response and notification	Incident procedure	Information Security Manager	Internal Audit Manager	Defined	Tested	No	Defined	OK	Managed	Yes	The Q3 incidents followed the procedure's severity levels and roles, and the August ransomware incident had a post-incident review on 27 Aug 2026 (P09).		All of Defined, and: Response measures are reported, and post-incident reviews lead to changes that are tracked to closure.	1311328	17	No	Defined
EXAMPLE	MP-29	Incident response and notification	Notification readiness	Head of Information Security	Internal Audit Manager	Informal	Seen	No	Informal	OK	Managed	Yes	The notification procedure was adopted on 15 Sep 2026; its first readiness check, on 18 Sep 2026, was Not ready (P18). The re-check on 25 Sep 2026 falls after fieldwork.		A record of which regimes apply, a written way of deciding whether to report, named people with tested access to each authority's channel, and records of decisions made.	1211329	6	No	Informal
EXAMPLE	MP-30	Incident response and notification	Exercises	Information Security Manager	Internal Audit Manager	Defined	Seen	No	Defined	OK	Managed	Yes	The tabletop of 18 Mar 2026 has an after-action report, approved on 31 Mar 2026, with an owner for each lesson (P10). Raised from Informal at validation, when the owner added the after-action report on 23 Sep 2026.		All of Defined, and: Lessons are tracked to closure and reported, and the programme varies scenarios and participants from year to year.	1311330	18	No	Defined
EXAMPLE	MP-31	Recovery and continuity	Recovery plans	Head of IT	Information Security Manager	Defined	Seen	No	Defined	OK	Defined	No	The 5 critical services have recovery objectives agreed by their business owners, and a recovery plan each.						Defined
EXAMPLE	MP-32	Recovery and continuity	Recovery tested	Head of IT	Information Security Manager	Informal	Tested	No	Informal	OK	Defined	Yes	2 of the 5 critical services were restored within their objectives in a test in the last 12 months (P03). The ordering platform cannot yet be restored within 24 hours; P05's TA-01 would rebuild its recovery.	R-01, ransomware takes online ordering offline, is outside appetite (P05)	Recovery tests at the interval set, with the time achieved recorded against the objective.	221432	4	Yes	Informal

Actions

One row per action, each moving one practice one level (MA-12). An action closes only when someone other than its owner re-assesses the practice at the level aimed for (MA-18). Due status is worked out at the As-at date on the Measures sheet.

Row	Action ID	Practice ID	Practice (calc)	Domain (calc)	Level from	Level to (calc, one up)	Step (calc)	Order (MA-11, calc)	Priority (calc)	Action	Action owner	Due	Effort (S, M, L)	External spend (EUR)	Waits for (in this tracker)	Waits for (outside this tracker)	Evidence that will show it is done	Status	Closure check (MA-18, calc)	Due status (calc)	Earliest Managed claim (MA-12, calc)	Sequence check (calc)	Notes
EXAMPLE	MF-01	MP-04	Policy set	Policy	Informal	Defined	First step	1	Yes	Approve a cryptography policy, and keep a policy register with an approval and review date for every policy	Head of Information Security	18 Dec 2026	M	0			The register, and the cryptography policy with its approval	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-02	MP-10	Supplier assessment	Third-party security	Informal	Defined	First step	2	Yes	Assess the five remaining Tier 1 suppliers on P06's plan, and agree a date for the overdue High finding	Information Security Manager	8 Dec 2026	M	0			Five assessments on record, and the finding's agreed date	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-03	MP-24	Backups restored	Protection of systems and data	Informal	Defined	First step	3	Yes	Protect the backup copy from the systems it backs up, and restore critical data in a test each quarter	Head of IT	29 Jan 2027	M	9,000			The restore test records of two quarters	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-04	MP-32	Recovery tested	Recovery and continuity	Informal	Defined	First step	4	Yes	Test the recovery of every critical service against its objective once the ordering platform's recovery is rebuilt	Head of IT	26 Mar 2027	L	0	MF-03	P05 TA-01	A recovery test record for each critical service, with the time achieved	Open	Not ready for re-assessment	Not due		Starts after MF-03
EXAMPLE	MF-05	MP-14	Assessment and follow-up	Measurement and assessment	Not in place	Informal	First step	5	Yes	Set the 2027 assessment in the plan, and report progress on this assessment's actions to the Executive Committee each quarter	Head of Information Security	18 Dec 2026	S	0			The 2027 assessment in the plan, and the first quarterly progress report	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-06	MP-29	Notification readiness	Incident response and notification	Informal	Defined	First step	6	No	Close P18's open readiness actions and rehearse a report in the October tabletop	Head of Information Security	31 Oct 2026	S	0			A readiness check at Ready, and the tabletop's record of the rehearsed report	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-07	MP-05	Policy acknowledgement	Policy	Informal	Defined	First step	7	No	Keep policy acknowledgements in the HR system for every joiner and after each material change	HR Director	18 Dec 2026	S	0	MF-01		Acknowledgement records for ten people chosen by the assessor	Open	Not ready for re-assessment	Not due		Starts after MF-01
EXAMPLE	MF-08	MP-08	Exceptions	Risk management and exceptions	Informal	Defined	First step	8	No	Decide the expired exception, and check the exception register for expiries each month	Head of Information Security	30 Oct 2026	S	0			The decision, and three monthly checks	Open	Not ready for re-assessment	Due soon		OK
EXAMPLE	MF-09	MP-12	Compliance checked	Legal and regulatory obligations	Informal	Defined	First step	9	No	Repeat the NIS2 readiness self-assessment each half year, with gaps assigned	Head of Information Security	31 Mar 2027	S	0			Two readiness self-assessments with their gaps	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-10	MP-15	Asset inventory	Assets and information	Informal	Defined	First step	10	No	Build one inventory of devices, software and services with an owner for each, and keep it current from purchasing and discovery	Head of IT	30 Jun 2027	L	12,000			The inventory, and the process that keeps it current	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-11	MP-18	Fixing on time	Vulnerabilities and patching	Informal	Defined	First step	11	No	Bring the most urgent fixes back to deadline, with every miss deferred as an exception	Head of IT	29 Jan 2027	M	0			Five sampled findings fixed on time or deferred with approval	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-12	MP-20	Access reviews	Identity and access	Informal	Defined	First step	12	No	Complete two review campaigns under the procedure, with removals recorded	Head of Information Security	31 Mar 2027	M	0			Two campaign records with their removals	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-13	MP-21	Privileged access	Identity and access	Informal	Defined	First step	13	No	Move every administrator to separate accounts with strong authentication, as P14's Tier 1 plan sets	Head of IT	18 Dec 2026	M	0			The account list, and three approval records	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-14	MP-25	Secure configuration	Protection of systems and data	Informal	Defined	First step	14	No	Write configuration baselines for servers and office PCs, and build new systems to them	Head of IT	30 Jun 2027	M	0			The baselines, and three build records	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-15	MP-26	Logging	Detection and monitoring	Informal	Defined	First step	15	No	List the log sources required and collect them all centrally, protected from change	Information Security Manager	10 Sep 2027	L	38,000			The source list, and three sources reaching the store	Open	Not ready for re-assessment	Not due		OK
EXAMPLE	MF-16	MP-27	Alert handling	Detection and monitoring	Informal	Defined	First step	16	No	Write alert criteria and response times with the managed provider, and record triage	Information Security Manager	10 Sep 2027	M	0	MF-15		The criteria, and five triage records	Open	Not ready for re-assessment	Not due		Starts after MF-15
EXAMPLE	MF-17	MP-28	Incident procedure	Incident response and notification	Defined	Managed	First step	17	No	Report incident response measures each month, and have post-incident actions checked by internal audit	Information Security Manager	30 Jun 2027	M	0			Six months of measures, and internal audit's checks	Open	Not ready for re-assessment	Not due	18 Mar 2027	OK
EXAMPLE	MF-18	MP-30	Exercises	Incident response and notification	Defined	Managed	First step	18	No	Track exercise lessons to closure and report them, and vary scenarios and participants each year	Information Security Manager	30 Jun 2027	S	0			The lessons log closed and reported, and the 2027 programme	Open	Not ready for re-assessment	Not due	18 Mar 2027	OK
EXAMPLE	RS-01	MP-14	Assessment and follow-up	Measurement and assessment	Informal	Defined	Later step		No	The 2027 assessment follows up this one's findings.	Head of Information Security	17 Sep 2027	S	0	MF-05		A planned assessment or internal audit at least each year, its findings in a tracker with owners and dates, and closure checked by someone other than the action owner.	Open	Not ready for re-assessment	Not due		Starts after MF-05	Second step in the Target-State Maturity Roadmap.
EXAMPLE	RS-02	MP-29	Notification readiness	Incident response and notification	Defined	Managed	Later step		No	Six months of decisions and reports on time, measured, with readiness re-checked.	Head of Information Security	30 Jun 2027	S	0	MF-06		All of Defined, and: Decisions and reports on time are measured, and readiness is re-checked at a set interval.	Open	Not ready for re-assessment	Not due	30 Apr 2027	Starts after MF-06	Second step in the Target-State Maturity Roadmap.

Domain Results

Domain results

Each domain's level is the lowest level among its practices that apply (MA-06), and its gap the target minus that level, counted in levels (MA-10). 'At the assessment' uses the decided results; 'now' uses the latest re-assessments on the Actions sheet. No overall score, percentage or weighting (MA-07).

EXAMPLE: the results of ASM-2026-1 and the targets approved on 21 Aug 2026, before scoring.

Domain ID	Domain	Practices	Level at the assessment (lowest)	Target	Gap at the assessment	Level now (lowest)	Gap now	Actions	Reason for the target
DM-01	Governance and accountability	3	Defined	Defined	0	Defined	0	0	Default. NIS2 makes the management body answerable for the security measures (P12).
DM-02	Policy	2	Informal	Defined	1	Informal	1	2	Default. The board recorded the cryptography policy as outstanding on 30 Jul 2026 (P12, measure (h)).
DM-03	Risk management and exceptions	3	Informal	Defined	1	Informal	1	1	Default.
DM-04	Third-party security	2	Informal	Defined	1	Informal	1	1	Default. Supplier payment fraud, R-02, is outside appetite (P05).
DM-05	Legal and regulatory obligations	2	Informal	Defined	1	Informal	1	1	Default.
DM-06	Measurement and assessment	2	Not in place	Defined	2	Not in place	2	2	Default. NIS2 asks for policies and procedures to assess whether the security measures are effective.
DM-07	Assets and information	2	Informal	Defined	1	Informal	1	1	Default.
DM-08	Vulnerabilities and patching	2	Informal	Defined	1	Informal	1	1	Default.
DM-09	Identity and access	3	Informal	Defined	1	Informal	1	2	Default.
DM-10	Awareness and training	2	Defined	Defined	0	Defined	0	0	Default.
DM-11	Protection of systems and data	2	Informal	Defined	1	Informal	1	2	Default. Ransomware taking ordering offline, R-01, is outside appetite (P05).
DM-12	Detection and monitoring	2	Informal	Defined	1	Informal	1	2	Default.
DM-13	Incident response and notification	3	Informal	Managed	2	Informal	2	4	Incidents test the programme most often, NIS2's reporting deadlines rest on the response, and R-01 is outside appetite. Response must be measured and checked by someone other than the team that runs it.
DM-14	Recovery and continuity	2	Informal	Defined	1	Informal	1	1	Default. R-01 is outside appetite (P05).

A gap of 0 means the domain is at or above its target. "Not all judged": a practice has no level yet. "Left out (MA-08)": every practice is Not applicable; say why in the report. Changing a target after scoring breaks MA-09.

The packs that show how to raise each domain

Domain ID	Domain	Packs
DM-01	Governance and accountability	P03 Board Cybersecurity Reporting
DM-02	Policy	P04 Security Policy Management
DM-03	Risk management and exceptions	P05 Information Security Risk Management; P02 Security Exception, Waiver & Segregation of Duties
DM-04	Third-party security	P06 Third-Party Security Risk Management
DM-05	Legal and regulatory obligations	P12 NIS2 Implementation & Readiness; P08 ISO 27001 Implementation & Certification Readiness
DM-06	Measurement and assessment	P11 Cybersecurity Metrics & Reporting Programme; P19 Security Maturity & Internal Assessment (this pack)
DM-07	Assets and information	P15 Information Classification & Handling
DM-08	Vulnerabilities and patching	P01 Vulnerability & Exposure Management; P17 Patch Management
DM-09	Identity and access	P13 Joiner-Mover-Leaver & Access Provisioning; P07 User Access Review; P14 Privileged Access Management
DM-10	Awareness and training	P16 Security Awareness Programme
DM-11	Protection of systems and data	No published pack covers this domain yet. Its actions rest on the practice's own evidence.
DM-12	Detection and monitoring	No published pack covers this domain yet. Its actions rest on the practice's own evidence.
DM-13	Incident response and notification	P09 Security Incident Management; P18 Regulatory Incident Notification & Reporting; P10 Cyber Incident Exercises & Tabletop Scenario Library
DM-14	Recovery and continuity	P22 Cyber Resilience & Recovery; P23 Backup & Restore Assurance

Measures

Measures and settings

Every figure is worked out from the Findings, Actions and Domain Results sheets at the As-at date. Report them to the sponsor each quarter. Counts are written "n of m"; nothing is added across domains into a score (MA-07).

Settings

As-at date	30 Sep 2026	Every overdue flag and measure is worked out at this date. For the quarterly report, the quarter's last day.
Period start (calc)	1 Jul 2026	The first day of the calendar quarter of the As-at date.
Last day of fieldwork, last full assessment	18 Sep 2026	MAM-04 counts from this date; the next full assessment is due within the cycle (MA-17).
Actions that take priority in one cycle	5	MA-11. The first actions in MA-11's order take priority.
Months at Defined before Managed can be claimed	6	MA-12. Sets the earliest Managed claim on the Actions sheet.
Months between full assessments (at most)	12	MA-17.
Due soon (days before the due date)	30	An open action due within this many days of the As-at date shows Due soon.
Next full assessment's fieldwork ends by (calc)	17 Sep 2027	MA-17: the last day of the cycle. Re-assess a domain sooner after a significant incident or major change.

Headline measures

Measure	Result	Target	Status	What it means
MAM-01 Domains at target	2 of 14	Rising each cycle	—	Domains at or above their target level, out of the domains assessed. Uses each domain's level now, after re-assessments.
MAM-02 Priority actions on time	None due yet	All	—	Priority actions closed by their due date, re-assessed, out of those due in the period. The period is the quarter of the As-at date. On time means closed on re-assessment by the due date (MA-18).
MAM-03 Self-assessed results	2 of 32	None; never more than a third	Within a third	Practice results marked self-assessed, out of all results. Above a third, the sponsor decides whether to commission an independent assessment and records the decision (Internal Security Assessment Procedure, IT-3).
MAM-04 Months since the last full assessment	0	[[12]] or fewer	On target	Months from the end of the last full assessment's fieldwork to the period end. Whole months.

EXAMPLE, as at 30 Sep 2026: MAM-01 2 of 14; MAM-02 None due yet; MAM-03 2 of 32; MAM-04 0.

Actions

Count	Result	What it counts
Actions in the tracker	20	Every row with an action ID: first steps and later steps.
Practices below target (findings)	18	Each needs one first-step action (MA-11).
Findings with no first-step action	0	Should be 0. Add an action for each.
Priority actions	5 of 20	MA-11: the first [[5]] in order.
Open	20 of 20	The action is agreed, with an owner, a due date and the evidence that will show it is done. Work has not started.
In progress	0 of 20	Work has started. The practice is not yet at the level the action aims for.
Ready for re-assessment	0 of 20	The owner says the work is done and the evidence is ready. The action is not closed: the level has not been checked yet.
Closed	0 of 20	A re-assessment by someone other than the action owner found the practice at the level the action aimed for, or higher (MA-18).
Not achieved	0 of 20	A re-assessment found the practice below the level the action aimed for. Agree what is missing and a new due date, or record the approver's decision to stop.
Overdue	0 of 20	Due before the As-at date and not closed.
Due soon	1 of 20	Due within the days set above.
Closed without a valid re-assessment (MA-18)	0	Should be 0. Re-open the action and arrange a re-assessment by someone other than its owner.
Waiting for another step	5	Actions that cannot start until the step they name is closed.
Sequence problems (MA-12)	0	Should be 0. A later step must fall after the step it follows, and Managed after its months at Defined.

Actions due each quarter

Quarter	From	To	Due	Priority due
Q3 2026 (this quarter)	1 Jul 2026	30 Sep 2026	0	0
Q4 2026	1 Oct 2026	31 Dec 2026	7	3
Q1 2027	1 Jan 2027	31 Mar 2027	5	2
Q2 2027	1 Apr 2027	30 Jun 2027	5	0
Q3 2027	1 Jul 2027	30 Sep 2027	3	0
Later	1 Oct 2027		0	0

Counts of actions by due date, for the quarterly progress report. Actions due earlier than this quarter are in the Overdue count above until they close.

Quarterly progress record

Item	Entry
Reported to the sponsor by (name, role) and date	[[Name, role, YYYY-MM-DD]]
Actions overdue, and why	[[e.g. none; or the action, the reason and the new date agreed]]
Re-assessments that found a lower level, and what follows	[[e.g. none; or the practice, the level found and the new action]]
Decisions asked of the approver	[[e.g. a new date, more effort, or stopping an action]]

How to Close

How an action moves, and when it closes

An action closes when the level has moved, checked by someone other than its owner. Finishing the work is not enough.

The states of an action

State	What it means	Who sets it
Open	The action is agreed, with an owner, a due date and the evidence that will show it is done. Work has not started.	Head of Information Security, when the approver approves the plan
In progress	Work has started. The practice is not yet at the level the action aims for.	The action owner
Ready for re-assessment	The owner says the work is done and the evidence is ready. The action is not closed: the level has not been checked yet.	The action owner, who also names the re-assessor with the assessment lead
Closed	A re-assessment by someone other than the action owner found the practice at the level the action aimed for, or higher (MA-18).	The re-assessor, who is not the action owner
Not achieved	A re-assessment found the practice below the level the action aimed for. Agree what is missing and a new due date, or record the approver's decision to stop.	The re-assessor, who is not the action owner

The rules the tracker follows

Rule	What it says
MA-10	A domain's gap is its target level minus its current level, counted in levels. A domain at or above its target has no gap.
MA-11	Every practice below its domain's target gets an action. Actions take priority first where a risk outside appetite, or an obligation the organisation has recorded as not met, rests on the practice; then the practice at the lower level; then the domain with the larger gap; then domain and practice order. Up to [[5]] actions take priority in one cycle.
MA-12	A practice moves up one level per action. Managed can be claimed only after the practice has run at Defined, with records, for at least [[6]] months. A roadmap never plans a jump of two levels in one step.
MA-14	No one rates a practice they own or run (P08 IS-07). Where no independent assessor is available for a practice, the result is marked self-assessed and cannot be above Defined until someone independent checks the evidence.
MA-15	Results are compared over time only when the model, the scope and the evidence window are the same. Any change is a break in series, marked in the report as P11's MR-09 marks a changed metric.
MA-17	A full assessment runs at least every [[12]] months. A domain is re-assessed sooner after a significant incident, a major change to the systems or the organisation, or a new obligation that rests on it.
MA-18	An action closes only when a re-assessment, by someone other than the action's owner, shows that the practice reached the level the action aimed for.
MA-19	A maturity result is not an internal audit, a certification or a statement of compliance, and is never presented as one. It can feed the management review, the internal audit programme and the risk register.

Mistakes to avoid

Mistake	What goes wrong	The fix
PF-06	Planning to jump from Not in place to Managed in one step.	Move one level per action, and claim Managed only after [[6]] months at Defined (MA-12).
PF-07	Closing an action when the work is done, not when the level moved.	Close only on re-assessment by someone other than the owner (MA-18).
PF-08	Comparing this year's result with last year's after the model changed.	Mark the break in series and compare only like with like (MA-15).

When a re-assessment finds a lower level

Step	What to do
1	Check that the re-assessment used the same practice wording, evidence window and sampling as the assessment. If it did not, the two results cannot be compared: mark a break in series (MA-15).
2	If they are comparable, the lower level is the result. Record it in 'Level found' and set the action to Not achieved. The practice's level on the Findings and Domain Results sheets follows this re-assessment.
3	Ask what changed: a person left, a tool was replaced, a process was dropped under pressure, or the first result rested on thin evidence.
4	Agree a new action, one level up from the level found (MA-12). If the domain's level falls, the gap grows: the action may now take priority (MA-11).
5	Where the fall followed a significant incident or a major change, re-assess the rest of the domain too, without waiting for the next full assessment (MA-17).
6	Report the fall in the next quarterly progress report, with the reason and the new action. Do not hide it in a total.

What the re-assessor checks

Check	What it means
The level aimed for	The evidence the Findings sheet's 'What the next level needs' names, in full. For Defined, the practice's written way of doing it and records that it was done routinely; for Managed, a measure with a target, an independent check and an improvement made because of them.
The window	Records dated since the action started, and enough of them to show the practice is routine, not done once for the re-assessment (MA-04).
The sample	Records the re-assessor chooses from the full list, [[3]] or all of them if fewer (MA-05).
The confidence	Seen at least for Defined; Tested for Managed (MA-13).
Independence	The re-assessor is not the action owner and does not run the practice (MA-14, MA-18). Where that cannot be arranged, the result is self-assessed and capped at Defined, and the action stays at Ready for re-assessment until someone independent checks it.

Lists

Level	Answer	Confidence	ConfidenceCap	YesNo	State	Effort	EffortDays	Domain	PracticeID	LevelNeeds	PracticeDefined	PracticeManaged
Not in place	Not in place	Told	2	Yes	Open	S	Small: [[up to 5]] person-days	Governance and accountability	MP-01	Nothing. This is the level when there is no evidence that the practice happens, or it happens only by chance.	A role description or appointment, approved by management, that names the person accountable for security, their reporting line and their authority.	Their objectives are reviewed each year against results by the person they report to, and the role was changed at least once because of a review.
Informal	Informal	Seen	3	No	In progress	M	Medium: [[6 to 20]] person-days	Policy	MP-02	Someone can describe how it is done and show at least one instance, but there is no agreed written way of doing it, or the records are not kept consistently.	A security report to the board or its equivalent at least every quarter, and minutes that record the decisions taken on it.	The report's measures have targets, and the decisions and actions it leads to are tracked to closure and reported back.
Defined	Defined	Tested	4		Ready for re-assessment	L	Large: [[21 to 60]] person-days	Risk management and exceptions	MP-03	The practice's Defined evidence, seen by the assessor: a written, agreed way of doing it, and records in the evidence window showing it was done routinely. Where the assessor checks a sample, every sampled record must pass (MA-05).	Written security objectives for the year, approved by management, each with an owner, a date and how it will be measured.	Progress is reported at least each quarter, and an objective that will be missed leads to a recorded decision.
Managed	Managed				Closed			Third-party security	MP-04	All of Defined, and the practice's Managed evidence: a measure with a target that is reported, a check by someone other than the person who does the work, and a record of at least one improvement made because of them.	A policy set, each policy approved at the level its tier requires, with an owner and a review date, published where staff can read it.	Reviews are measured as on time or late and reported, and policy breaches and exceptions are used to revise the policies.
	Not applicable				Not achieved			Legal and regulatory obligations	MP-05		Records of acknowledgement for the policies staff must follow, taken on joining and after each material change.	The acknowledgement rate is measured and reported, and those who have not acknowledged are followed up to a deadline.
								Measurement and assessment	MP-06		A written risk method, a register in which every risk has an owner and a rating made by that method, and a review of the register at the interval the method sets.	Treatment progress and risks outside appetite are measured and reported, and the method was changed at least once because of what the reviews found.
								Assets and information	MP-07		An appetite statement approved by the approver, and a decision recorded at the right level for every risk outside it: treat, or accept with the reason.	Appetite is reviewed each year, and the number of risks outside it, and their age, is reported to management each quarter.
								Vulnerabilities and patching	MP-08		An exception register in which every exception has a risk owner, an approver at the level its rating requires, compensating controls and an expiry date.	Expired and renewed exceptions are counted and reported, and an exception renewed more than the rules allow goes to the next level up.
								Identity and access	MP-09		A supplier register in which every supplier with access to data or systems has a tier, and the contracts of the highest tier carry the security clauses the tier requires.	The share of high-tier suppliers whose contracts carry the required clauses is measured, and gaps are closed at renewal to a plan.
								Awareness and training	MP-10		An assessment on record before contract for every supplier in the highest tiers, and a periodic review at the interval the tier sets.	Overdue reviews are counted and reported, and assessment findings are tracked to closure with the supplier.
								Protection of systems and data	MP-11		A register of the security obligations that apply, each with an owner and the date it was last confirmed, including whether NIS2, DORA or the GDPR apply and in which role.	The register is reviewed at least each year and whenever the business changes, and a new obligation reaches the register within a set time.
								Detection and monitoring	MP-12		A check against each obligation at least each year, with gaps recorded and assigned.	Gaps are tracked to closure and reported, and the checks are made by someone other than the obligation's owner.
								Incident response and notification	MP-13		A written definition for every reported metric, a named owner, and data quality checks recorded before each report.	Metrics are reviewed each year against the decisions they serve, and failed data checks are used to fix their sources.
								Recovery and continuity	MP-14		A planned assessment or internal audit at least each year, its findings in a tracker with owners and dates, and closure checked by someone other than the action owner.	Overdue findings are counted and reported to management, and the assessment method was improved at least once because of what an assessment showed.
									MP-15		An inventory of devices, software and cloud services, each with an owner, kept current by a set process.	Completeness is checked against another source, such as network discovery or purchasing records, and differences are measured and fixed.
									MP-16		A classification scheme approved by management, handling rules for each level, and records showing information is labelled and handled by them.	Handling is checked on a sample at a set interval, and the results are reported and used to change the rules or the training.
									MP-17		Scan coverage of the in-scope assets on record, and a written prioritisation method applied to every finding.	Coverage is measured against the inventory and reported, and the method was adjusted because of what the measures showed.
									MP-18		Written remediation deadlines by priority, records showing fixes against them, and a deferral approved as an exception whenever a deadline is missed.	Fixes within deadline are measured and reported, and fixes are verified by a rescan before closure.
									MP-19		A written process with approval before access, and records showing leavers' access removed within the time it sets.	Removal times are measured and reported, and the process was changed because of a late removal.
									MP-20		Access reviews of the in-scope systems at the interval the procedure sets, with removals made and recorded.	Completion and removal rates are measured and reported, and reviews are checked by someone other than the reviewer.
									MP-21		A list of privileged accounts with an owner and approval for each, separate accounts for privileged work, and strong authentication on them.	Privileged activity is logged and reviewed, and the number of privileged accounts is measured and reported.
									MP-22		A training plan by audience, records of completion, and additional training for roles at higher risk.	Completion is measured and followed up, and the plan is changed each year from incidents and risks.
									MP-23		A written measure of behaviour, such as the reporting rate of suspicious emails, collected at a set interval.	The measure has a target, it is reported, and the programme was changed because of it.
									MP-24		A backup schedule for critical data, a copy protected from the systems it backs up, and records of restore tests at the interval set.	Restore success and time are measured and reported, and failed restores lead to recorded changes.
									MP-25		Written configuration baselines for the main system types, and records showing new systems are built to them.	Drift from the baseline is detected and measured, and the baselines are reviewed at a set interval.
									MP-26		A list of the systems whose logs are collected, central collection protected from change, and retention as the organisation has decided.	Missing log sources are detected and reported, and the list is reviewed when systems change.
									MP-27		Written criteria for the alerts that must be reviewed, a response time, and records of triage.	Triage times and missed alerts are measured and reported, and the criteria are tuned from incidents and false positives.
									MP-28		An approved incident procedure with severity levels and named roles, and incident records that follow it.	Response measures are reported, and post-incident reviews lead to changes that are tracked to closure.
									MP-29		A record of which regimes apply, a written way of deciding whether to report, named people with tested access to each authority's channel, and records of decisions made.	Decisions and reports on time are measured, and readiness is re-checked at a set interval.
									MP-30		An exercise programme, at least one exercise held in the evidence window, and its lessons recorded with owners.	Lessons are tracked to closure and reported, and the programme varies scenarios and participants from year to year.
									MP-31		A list of critical services with recovery time objectives agreed by their business owners, and a recovery plan for each.	The objectives are reviewed each year, and plans are updated after each test or real recovery.
									MP-32		Recovery tests at the interval set, with the time achieved recorded against the objective.	Results are reported, and every missed objective leads to a recorded change.

Definitions

Definitions

Term	Meaning in this workbook
Finding	A practice below its domain's target, written as what was found, what the level needs, and the evidence seen.
Action	The work that will move one practice up one level, with an owner, a due date and the evidence that will show it is done.
Re-assessment	Checking a practice again after its action closes, by someone other than the action's owner, to confirm the level moved (MA-18).
Practice	One thing the programme does, stated as a question with the evidence each level needs (MP-01 to MP-32). Practices are what the assessor rates.
Domain	One area of the security programme, such as risk management or identity and access, made up of two to three practices (DM-01 to DM-14).
Level	One of the four levels of the scale: Not in place, Informal, Defined or Managed. The scale is P01-A09's, and P11 uses it too.
Not in place	The practice does not exist, or happens only by chance.
Informal	It happens, but depends on particular people and is not written down or not done consistently.
Defined	It is written down, agreed and done routinely, and leaves a record.
Managed	As Defined, and it is also measured, checked by someone else and improved.
Domain level	The lowest level among a domain's practices that apply. One weak practice limits the domain, and an average would hide it (MA-06).
Target	The level management decides a domain should reach, set before the evidence is scored, with the reason for it (MA-09).
Gap	The number of levels between a domain's level and its target: 0 when the target is met, up to 3 (MA-10).
Pressing	Said of a practice on which a risk outside appetite, or an obligation the organisation has recorded as not met, rests. Its action takes priority (MA-11).
Confidence	How a result was evidenced: Told, Seen or Tested (MA-13).
Self-assessed	A result given by someone who owns or does the practice. It is marked as such and cannot be above Defined until someone independent checks the evidence (MA-14).
Break in series	A change to the model, the scope or the evidence window that means a result cannot be compared with an earlier one. It is marked, as P11's MR-09 marks a change to a metric (MA-15).
Open	The action is agreed, with an owner, a due date and the evidence that will show it is done. Work has not started.
In progress	Work has started. The practice is not yet at the level the action aims for.
Ready for re-assessment	The owner says the work is done and the evidence is ready. The action is not closed: the level has not been checked yet.
Closed	A re-assessment by someone other than the action owner found the practice at the level the action aimed for, or higher (MA-18).
Not achieved	A re-assessment found the practice below the level the action aimed for. Agree what is missing and a new due date, or record the approver's decision to stop.
Level decided	The level after the caps of MA-13 and MA-14: the practice's result at the assessment.
Level now	The level found at the practice's latest re-assessment, or the level decided if it has not been re-assessed.
First step	An action that starts from the practice's decided level. Its order and priority come from MA-11.
Later step	An action that starts from a level the practice has not reached yet, such as Defined to Managed. It names the step it follows and starts when that step closes.
Action order	The order MA-11 sets: practices on which a risk outside appetite or a recorded unmet obligation rests; then the lower level; then the larger domain gap; then domain and practice order.
Earliest Managed claim	The date [[6]] months after the practice was last shown at Defined: the end of fieldwork for a first step, or the re-assessment (or, before it, the due date) of the step it follows (MA-12).
Effort	S Small, [[up to 5]] person-days; M Medium, [[6 to 20]] person-days; L Large, [[21 to 60]] person-days. The bands of the Target-State Maturity Roadmap.
As-at date	The date every overdue flag, days-overdue figure and measure is worked out at.
Head of Information Security	Owns the security programme being assessed, coordinates the evidence, proposes the improvement plan from the findings, and owns the tracker. Rates no practice they own or run.
Assessment lead	The person who plans the assessment, assigns assessors, decides each result and writes the report. Independent of the practices they rate.
Assessment sponsor	The member of management who commissions the assessment, approves its scope and targets, and receives the report.
(calc), (working)	A column or cell the workbook calculates. Do not type or paste over it. Working columns hold intermediate values other formulas read.
MA-nn, MP-nn, DM-nn, MAM-nn	The rules, practices, domains and headline measures of the Security Maturity Model & Scoring Method. MF-nn are this cycle's actions; RS-nn the later steps of the Target-State Maturity Roadmap. PH-n and IT-n are the phases and independence triggers of the Internal Security Assessment Procedure.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, after its first assessment, ASM-2026-1, as at 30 Sep 2026. Delete before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 10.1 — Continual improvement	Actions sheet: improvements planned from the assessment's findings, tracked to closure and checked
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	Findings sheet: the improvements identified from this evaluation, in the order the rules set
NIS2 — Directive (EU) 2022/2555	Article 21(4) — an entity that finds that it does not comply with the measures in paragraph 2 takes, “without undue delay, all necessary, appropriate and proportionate corrective measures”	Actions sheet: each shortfall found turned into an action with an owner and a date, and tracked until a re-assessment shows it corrected. Where a shortfall concerns a measure of Article 21(2), the tracker is a record of the corrective measures taken
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	Applies to the providers its Article 1 names. For them, the Annex point below; for others, a useful guide only
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 2.3.3 — the results of the independent reviews, including the results of compliance monitoring (point 2.2) and of monitoring and measurement (point 7), are reported to the management bodies; “Corrective actions shall be taken or residual risk accepted according to the relevant entities’ risk acceptance criteria.”	Measures sheet: progress reported to management each quarter, and each finding either acted on or, where the approver decides to stop an action, the residual risk accepted by the entity's criteria. For the providers Article 1 names, the results can feed the independent review; the tracker is not that review
DORA — Regulation (EU) 2022/2554	Article 6(5) — the ICT risk management framework is documented and reviewed at least once a year (periodically for microenterprises), upon major ICT-related incidents, and following supervisory instructions or conclusions from digital operational resilience testing or audit processes; “It shall be continuously improved on the basis of lessons derived from implementation and monitoring.” A report on the review is submitted to the competent authority on request	Actions and Measures sheets, for financial entities: improvements drawn from an assessment and followed through, which can inform the yearly review of the ICT risk management framework
DORA — Regulation (EU) 2022/2554	Article 6(7) — “Based on the conclusions from the internal audit review, financial entities shall establish a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings.”	Actions sheet, for financial entities: the same follow-up discipline (owner, date, verification by someone else) as a formal follow-up process. It does not replace the follow-up of internal audit findings, which the audit's own process governs
DORA — Delegated Regulation (EU) 2024/1774	Article 28(6) — “Based on the outcome of the audit referred to in paragraph 5, the financial entities referred to in paragraph 1 shall ensure the timely verification and remediation of critical ICT audit findings.”	Actions sheet, for entities under the simplified framework: closure only on verification. The audit's critical findings are followed up under the audit's own rules
GDPR — Regulation (EU) 2016/679	Article 24(1) — the controller implements appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing is performed in accordance with the Regulation; “Those measures shall be reviewed and updated where necessary.”	Actions sheet: measures reviewed and updated where the assessment found them wanting, with a record that shows it
GDPR — Regulation (EU) 2016/679	Article 32(1)(d) — the security measures include, as appropriate, “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing”	Findings and Actions sheets: the results of assessing the effectiveness of security measures, and what was done about them

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.