Security Maturity Model & Scoring Method

Defines maturity levels with observable evidence criteria per domain so assessors score consistently.

Available soon

Format: Word
Size: 76 KB
Length: 28 pages
Version: 1.2
Updated: 2 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.23 Oct 2026
DM-14 names P23.
1.12 Oct 2026
DM-14 Recovery and continuity names P22.
1.02 Oct 2026
Published.

Preview

The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.

Purpose

This model is how [[Organisation Name]] judges how mature its security programme is: how reliably each security practice is done, whether it depends on particular people, whether it is written down and leaves a record, and whether it is measured, checked and improved. It turns what an assessor sees into a level for each practice and each domain, compares it with a target set in advance, and shows which gaps to close first.

It exists so that two assessors looking at the same evidence give the same level. Every practice has written evidence for each level, every result states how it was evidenced, and no one rates their own work. The result is a profile in words: each domain's level, its target and the gap between them. There is no overall score.

It sets the scale, the 14 domains (DM-01 to DM-14), the 32 practices (MP-01 to MP-32) and the rules MA-01 to MA-19. Every other document in the Security Maturity & Internal Assessment pack cites them by ID: the Internal Security Assessment Procedure runs an assessment, the Security Programme Maturity Assessment records the answers, the Assessment Evidence Request Checklist says what to ask for, the Maturity Findings & Improvement Tracker tracks findings to re-assessment, the Maturity Assessment Report Template reports the result, the Target-State Maturity Roadmap sequences the improvements and the Maturity Results Executive Summary Deck puts them to the approver.

Guidance — delete before approval

Replace every value in [[double brackets]] before approval, and name roles, not people.

The scale is the one the Vulnerability & Exposure Management pack (P01) uses in its maturity assessment, and the Cybersecurity Metrics & Reporting Programme pack (P11) uses too. Do not reword a level here: change it in all three, or not at all.

Legal note

This document helps you judge how well your security practices work. It is not legal advice, and a maturity result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law or a certification asks for an assessment or an audit, confirm with counsel or your certification body what it must include.

What a maturity result is and is not

A maturity result is not an internal audit, a certification or a statement of compliance, and is never presented as one. It can feed the management review, the internal audit programme and the risk register (MA-19).

In particular, an assessment under this model is not the internal audit of the information security management system that ISO/IEC 27001 asks for (the ISO 27001 Implementation & Certification Readiness pack, P08, covers that), not the internal audit of the ICT risk management framework that DORA Article 6(6) asks of financial entities, and not the independent review of the NIS2 Implementing Regulation's Annex point 2.3. Each has its own rules on independence, competence and scope. A result can feed each of them: the audit programme can use it to choose what to audit, the management review can take it as an input, and the risk register can use its findings.

Where laws ask for this kind of assessment

Several laws ask an organisation to assess whether its security measures work. This model can be part of how you do that. The table says what each asks and how a result can feed it; it does not say that a result meets it.

Law	What it asks	How a result can feed it
NIS2 Article 21(2)(f)	Policies and procedures to assess the effectiveness of the security measures.	This model and the procedure are such a procedure. Whether they are enough for your authority is for counsel.
NIS2 Implementing Regulation, Annex points 7.1, 7.2 and 1.1.1(j) (the providers its Article 1 names)	A policy and procedures to assess effectiveness; what is measured, how, when and by whom; indicators of the entity's maturity level in the security policy.	The domains, practices and evidence rules answer what, how and by whom. The domain levels can be the maturity indicators the policy names.
DORA Article 6(5) and 6(6) (financial entities)	A yearly review of the ICT risk management framework, and an internal audit of it by independent auditors.	Results can inform the review and the auditors' planning. An assessment is not the internal audit Article 6(6) requires.
DORA Article 13(4)	Monitoring the effectiveness of the resilience strategy, to enhance cyber maturity.	Results compared over time, under MA-15, show whether maturity is moving.
GDPR Article 32(1)(d)	A process for regularly testing, assessing and evaluating the effectiveness of the security of processing.	The practices that protect personal data, assessed each cycle, are part of that process.

Scope

The model covers the whole security programme, in 14 domains grouped under the six functions of the NIST Cybersecurity Framework 2.0. It applies to every assessment run under the Internal Security Assessment Procedure, whether of the whole programme or of one domain re-assessed after an incident or a change (MA-17).

It rates practices, not technology. It asks whether a practice is done, reliably and with evidence; it does not test whether a firewall rule is correct or a system is free of vulnerabilities. Read it beside the risk register: maturity describes how a practice works, not how exposed the organisation is today (MA-01).

Six roles use it. The assessment sponsor approves the scope and the targets; the assessment lead assigns assessors and decides each result; assessors propose levels from evidence; practice owners provide the evidence; the Head of Information Security owns the programme and rates none of it; and the approver approves the targets and the plan. The Internal Security Assessment Procedure sets out each role in full.

The rules

These 19 rules are the method. The sections that follow explain each one; the rest of the pack quotes them by number.

MA-01 Every practice is rated on P01-A09's four levels (Not in place, Informal, Defined, Managed), and nothing else. A level describes how the practice works, not how exposed the organisation is.

MA-02 Evidence decides the level. An interview alone supports Informal at most. A written procedure with no records of it being done supports Informal at most, because Defined needs the practice to be done routinely and leave a record.

MA-03 Levels build on each other. Managed needs everything Defined needs, and more; a practice that is measured but not written down is Informal.

MA-04 Records count only if they fall in the evidence window: the [[12]] months up to the last day of fieldwork, or the practice's own last cycle where it runs less often.

MA-05 Where the assessor checks recurring records, the sample is [[3]], or all of them if there are fewer, chosen by the assessor, not by the practice owner; a result is Tested only on such a sample. A sampled record that fails means the level is not met, unless the practice itself caught and corrected the failure and recorded it.

MA-06 A domain's level is the lowest level among its practices that apply. No average, no rounding.

MA-07 There is no overall score, no percentage and no weighting. The result is each domain's level and target, in words, and the gap between them.

MA-08 A practice is Not applicable only for a reason the sponsor approves and the report states, never because it is weak. A domain with every practice Not applicable is left out of the result, and the report says why.

MA-09 The sponsor approves a target level for every domain before any evidence is scored, with a reason: an obligation that rests on it, a risk outside appetite, or a business need. Defined is the default target. Managed is a target only where one of those reasons asks for measurement and independent checking.

MA-10 A domain's gap is its target level minus its current level, counted in levels. A domain at or above its target has no gap.

MA-11 Every practice below its domain's target gets an action. Actions take priority first where a risk outside appetite, or an obligation the organisation has recorded as not met, rests on the practice; then the practice at the lower level; then the domain with the larger gap; then domain and practice order. Up to [[5]] actions take priority in one cycle.

MA-12 A practice moves up one level per action. Managed can be claimed only after the practice has run at Defined, with records, for at least [[6]] months. A roadmap never plans a jump of two levels in one step.

MA-13 Every result states how it was evidenced: Told, Seen or Tested. A level above Informal needs at least Seen; Managed needs Tested.

MA-14 No one rates a practice they own or run (P08 IS-07). Where no independent assessor is available for a practice, the result is marked self-assessed and cannot be above Defined until someone independent checks the evidence.

MA-15 Results are compared over time only when the model, the scope and the evidence window are the same. Any change is a break in series, marked in the report as P11's MR-09 marks a changed metric.

MA-16 The report goes to the approver (the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management), who approves the targets and the improvement plan. The practice owners see the draft results first and may add evidence within [[5]] working days; the assessment lead decides, and records any disagreement.

MA-17 A full assessment runs at least every [[12]] months. A domain is re-assessed sooner after a significant incident, a major change to the systems or the organisation, or a new obligation that rests on it.

MA-18 An action closes only when a re-assessment, by someone other than the action's owner, shows that the practice reached the level the action aimed for.

MA-19 A maturity result is not an internal audit, a certification or a statement of compliance, and is never presented as one. It can feed the management review, the internal audit programme and the risk register.

Guidance — delete before approval

MA-04, MA-05, MA-11, MA-12, MA-16 and MA-17 carry defaults in [[double brackets]]: an evidence window of 12 months, a sample of 3, 5 priority actions per cycle, 6 months at Defined before Managed, and a full assessment every 12 months. You may change them before the first assessment. A change after it is a break in series (MA-15).

MA-06, MA-07 and MA-14 may not be loosened. A domain averaged from its practices, or a single maturity figure, hides the weakness the assessment exists to find.

The scale

The four levels

Every practice is rated on these four levels, and nothing else (MA-01). The levels are words. They are not numbers to add, average or weight (MA-07).

Level	What it means
Not in place	The practice does not exist, or happens only by chance.
Informal	It happens, but depends on particular people and is not written down or not done consistently.
Defined	It is written down, agreed and done routinely, and leaves a record.
Managed	As Defined, and it is also measured, checked by someone else and improved.

What the assessor must see for each level

Levels build on each other (MA-03). For any practice, the assessor needs:

Level	Evidence needed
Not in place	Nothing. This is the level when there is no evidence that the practice happens, or it happens only by chance.
Informal	Someone can describe how it is done and show at least one instance, but there is no agreed written way of doing it, or the records are not kept consistently.
Defined	The practice's Defined evidence, seen by the assessor: a written, agreed way of doing it, and records in the evidence window showing it was done routinely. Where the assessor checks a sample, every sampled record must pass (MA-05).
Managed	All of Defined, and the practice's Managed evidence: a measure with a target that is reported, a check by someone other than the person who does the work, and a record of at least one improvement made because of them.

Each practice in the next sections says what its own Defined evidence is, and what Managed adds. Not in place and Informal are the same for every practice.

How a result was evidenced

Every result states how it was evidenced, and the confidence limits the level (MA-13).

Confidence	What it means	Supports up to
Told	Described in an interview, with nothing shown.	Informal
Seen	A document or record was shown, and it says what the practice needs.	Defined
Tested	The assessor chose a sample of records and checked each one against the practice.	Managed

A practice owner's description is useful: it tells the assessor what to ask for. It is not evidence of Defined or Managed on its own (MA-02).

When a practice is Not applicable

MA-08 sets when a practice does not apply. Typical reasons are a duty that does not apply, such as a notification regime the organisation is outside, or a service the organisation does not run. A weak practice is never Not applicable: it is Not in place or Informal, and the result says so.

The domains

Each domain is one area of the programme, made up of two or three practices. They follow the order of the NIST Cybersecurity Framework 2.0 functions. The last column names the published packs that show how to raise the domain.

Domain	Function	What it asks	Packs that show how to raise it
DM-01 Governance and accountability	Govern	Who is accountable for security, what management receives, and what it decides.	Board Cybersecurity Reporting (P03)
DM-02 Policy	Govern	Whether the rules people must follow are written, approved, known and kept current.	Security Policy Management (P04)
DM-03 Risk management and exceptions	Govern	Whether security risks are assessed, owned and treated within an approved appetite, and exceptions are controlled.	Information Security Risk Management (P05) and Security Exception, Waiver & Segregation of Duties (P02)
DM-04 Third-party security	Govern	Whether suppliers are tiered by risk, bound by contract, and assessed before and during the relationship.	Third-Party Security Risk Management (P06)
DM-05 Legal and regulatory obligations	Govern	Whether the obligations that apply are known, owned and checked.	NIS2 Implementation & Readiness (P12) and ISO 27001 Implementation & Certification Readiness (P08)
DM-06 Measurement and assessment	Govern	Whether the programme measures itself and assesses itself, and acts on what it finds.	Cybersecurity Metrics & Reporting Programme (P11) and this pack
DM-07 Assets and information	Identify	Whether the organisation knows what it has and how sensitive its information is.	Information Classification & Handling (P15)
DM-08 Vulnerabilities and patching	Identify	Whether weaknesses are found, prioritised and fixed on time.	Vulnerability & Exposure Management (P01) and Patch Management (P17)
DM-09 Identity and access	Protect	Whether access is granted, reviewed and removed on rules, and privileged access is controlled.	Joiner-Mover-Leaver & Access Provisioning (P13), User Access Review (P07) and Privileged Access Management (P14)
DM-10 Awareness and training	Protect	Whether people know what to do, and whether their behaviour changes.	Security Awareness Programme (P16)
DM-11 Protection of systems and data	Protect	Whether systems are configured securely and data can be restored.	No published pack yet. The practices are generic.
DM-12 Detection and monitoring	Detect	Whether attacks and failures are seen in time.	No published pack yet. The practices are generic.
DM-13 Incident response and notification	Respond	Whether incidents are handled to a plan, reported on time, and rehearsed.	Security Incident Management (P09), Regulatory Incident Notification & Reporting (P18) and Cyber Incident Exercises & Tabletop Scenario Library (P10)
DM-14 Recovery and continuity	Recover	Whether critical services can be restored within the time the business needs.	Cyber Resilience & Recovery (P22) and Backup & Restore Assurance (P23)

Protection of systems and data (DM-11) and Detection and monitoring (DM-12) have no published pack yet. Their practices are generic: they set the minimum evidence each level needs, without a detailed method behind them. Use your own procedures, or a specialist, for the detail.

The practices and the evidence each level needs

Each practice is a question the assessor answers from evidence. The Defined column is the evidence that level needs; the Managed column is what that level adds to all of Defined (MA-03). The last column is how the assessor decides whether the evidence shows the level, including the common cases where it does not.

Guidance — delete before approval

What to ask each practice owner for, and how much, is in the Assessment Evidence Request Checklist. Its requests follow the practices here, one for one.

DM-01 Governance and accountability

Practice	Defined needs	Managed adds	Judging the evidence
MP-01 Accountable person Is one person accountable for security, with the authority and time for it set in writing?	A role description or appointment, approved by management, that names the person accountable for security, their reporting line and their authority.	Their objectives are reviewed each year against results by the person they report to, and the role was changed at least once because of a review.	The named person must hold the role today. A role description for a vacant post, or one never approved, is Informal at most.
MP-02 Management reporting Does management receive security reporting at a set interval, and take decisions on it?	A security report to the board or its equivalent at least every quarter, and minutes that record the decisions taken on it.	The report's measures have targets, and the decisions and actions it leads to are tracked to closure and reported back.	Minutes that note a report was received, with no decision or question recorded across the window, are Informal: reporting happens, governance does not yet.
MP-03 Security objectives Are security objectives set each year, with owners and dates?	Written security objectives for the year, approved by management, each with an owner, a date and how it will be measured.	Progress is reported at least each quarter, and an objective that will be missed leads to a recorded decision.	A strategy document without dated, owned objectives is Informal.

Practice

Defined needs

Managed adds

Judging the evidence

MP-01 Accountable person

Is one person accountable for security, with the authority and time for it set in writing?

A role description or appointment, approved by management, that names the person accountable for security, their reporting line and their authority.

Their objectives are reviewed each year against results by the person they report to, and the role was changed at least once because of a review.

The named person must hold the role today. A role description for a vacant post, or one never approved, is Informal at most.

MP-02 Management reporting

Does management receive security reporting at a set interval, and take decisions on it?

A security report to the board or its equivalent at least every quarter, and minutes that record the decisions taken on it.

The report's measures have targets, and the decisions and actions it leads to are tracked to closure and reported back.

Minutes that note a report was received, with no decision or question recorded across the window, are Informal: reporting happens, governance does not yet.

MP-03 Security objectives

Are security objectives set each year, with owners and dates?

Written security objectives for the year, approved by management, each with an owner, a date and how it will be measured.

Progress is reported at least each quarter, and an objective that will be missed leads to a recorded decision.

A strategy document without dated, owned objectives is Informal.

DM-02 Policy

Practice	Defined needs	Managed adds	Judging the evidence
MP-04 Policy set Are security policies approved at the right level, published, and reviewed on schedule?	A policy set, each policy approved at the level its tier requires, with an owner and a review date, published where staff can read it.	Reviews are measured as on time or late and reported, and policy breaches and exceptions are used to revise the policies.	A policy past its review date without a recorded extension counts against Defined. A sample in which any policy has no approval record is not Defined.
MP-05 Policy acknowledgement Do the people who must follow a policy confirm they have read it?	Records of acknowledgement for the policies staff must follow, taken on joining and after each material change.	The acknowledgement rate is measured and reported, and those who have not acknowledged are followed up to a deadline.	A sampled joiner with no acknowledgement within the time the policy sets means Defined is not met.

Practice

Defined needs

Managed adds

Judging the evidence

MP-04 Policy set

Are security policies approved at the right level, published, and reviewed on schedule?

A policy set, each policy approved at the level its tier requires, with an owner and a review date, published where staff can read it.

Reviews are measured as on time or late and reported, and policy breaches and exceptions are used to revise the policies.

A policy past its review date without a recorded extension counts against Defined. A sample in which any policy has no approval record is not Defined.

MP-05 Policy acknowledgement

Do the people who must follow a policy confirm they have read it?

Records of acknowledgement for the policies staff must follow, taken on joining and after each material change.

The acknowledgement rate is measured and reported, and those who have not acknowledged are followed up to a deadline.

A sampled joiner with no acknowledgement within the time the policy sets means Defined is not met.

DM-03 Risk management and exceptions

Practice	Defined needs	Managed adds	Judging the evidence
MP-06 Risk register Are security risks assessed by a written method, recorded with owners, and reviewed?	A written risk method, a register in which every risk has an owner and a rating made by that method, and a review of the register at the interval the method sets.	Treatment progress and risks outside appetite are measured and reported, and the method was changed at least once because of what the reviews found.	A register whose ratings cannot be traced to the method, or whose risks have no named owner, is Informal.
MP-07 Risk appetite Is there an approved risk appetite, and are risks outside it escalated to the right level?	An appetite statement approved by the approver, and a decision recorded at the right level for every risk outside it: treat, or accept with the reason.	Appetite is reviewed each year, and the number of risks outside it, and their age, is reported to management each quarter.	A risk outside appetite with no recorded decision at the level the method sets means Defined is not met.
MP-08 Exceptions Is every security exception approved at the right level, time-limited and tracked?	An exception register in which every exception has a risk owner, an approver at the level its rating requires, compensating controls and an expiry date.	Expired and renewed exceptions are counted and reported, and an exception renewed more than the rules allow goes to the next level up.	An expired exception still in use without a renewal decision means Defined is not met.

Practice

Defined needs

Managed adds

Judging the evidence

MP-06 Risk register

Are security risks assessed by a written method, recorded with owners, and reviewed?

A written risk method, a register in which every risk has an owner and a rating made by that method, and a review of the register at the interval the method sets.

Treatment progress and risks outside appetite are measured and reported, and the method was changed at least once because of what the reviews found.

A register whose ratings cannot be traced to the method, or whose risks have no named owner, is Informal.

MP-07 Risk appetite

Is there an approved risk appetite, and are risks outside it escalated to the right level?

An appetite statement approved by the approver, and a decision recorded at the right level for every risk outside it: treat, or accept with the reason.

Appetite is reviewed each year, and the number of risks outside it, and their age, is reported to management each quarter.

A risk outside appetite with no recorded decision at the level the method sets means Defined is not met.

MP-08 Exceptions

Is every security exception approved at the right level, time-limited and tracked?

An exception register in which every exception has a risk owner, an approver at the level its rating requires, compensating controls and an expiry date.

Expired and renewed exceptions are counted and reported, and an exception renewed more than the rules allow goes to the next level up.

An expired exception still in use without a renewal decision means Defined is not met.

DM-04 Third-party security

Practice	Defined needs	Managed adds	Judging the evidence
MP-09 Supplier tiering and contracts Are suppliers tiered by risk, with security terms in the contracts of those that matter?	A supplier register in which every supplier with access to data or systems has a tier, and the contracts of the highest tier carry the security clauses the tier requires.	The share of high-tier suppliers whose contracts carry the required clauses is measured, and gaps are closed at renewal to a plan.	A high-tier supplier with no security clause and no recorded plan to add one means Defined is not met.
MP-10 Supplier assessment Are higher-risk suppliers assessed before contract and reviewed during it?	An assessment on record before contract for every supplier in the highest tiers, and a periodic review at the interval the tier sets.	Overdue reviews are counted and reported, and assessment findings are tracked to closure with the supplier.	A questionnaire sent and never assessed is Informal.

Practice

Defined needs

Managed adds

Judging the evidence

MP-09 Supplier tiering and contracts

Are suppliers tiered by risk, with security terms in the contracts of those that matter?

A supplier register in which every supplier with access to data or systems has a tier, and the contracts of the highest tier carry the security clauses the tier requires.

The share of high-tier suppliers whose contracts carry the required clauses is measured, and gaps are closed at renewal to a plan.

A high-tier supplier with no security clause and no recorded plan to add one means Defined is not met.

MP-10 Supplier assessment

Are higher-risk suppliers assessed before contract and reviewed during it?

An assessment on record before contract for every supplier in the highest tiers, and a periodic review at the interval the tier sets.

Overdue reviews are counted and reported, and assessment findings are tracked to closure with the supplier.

A questionnaire sent and never assessed is Informal.

DM-05 Legal and regulatory obligations

Practice	Defined needs	Managed adds	Judging the evidence
MP-11 Obligations known and owned Are the laws, regulations and contracts that set security duties identified, with an owner for each?	A register of the security obligations that apply, each with an owner and the date it was last confirmed, including whether NIS2, DORA or the GDPR apply and in which role.	The register is reviewed at least each year and whenever the business changes, and a new obligation reaches the register within a set time.	A NIS2 or DORA classification that was never recorded or approved means Defined is not met for an organisation that may be in scope.
MP-12 Compliance checked Is compliance with those obligations checked, and are gaps acted on?	A check against each obligation at least each year, with gaps recorded and assigned.	Gaps are tracked to closure and reported, and the checks are made by someone other than the obligation's owner.	A check done once, for a certification or a customer, and not repeated is Informal.

Practice

Defined needs

Managed adds

Judging the evidence

MP-11 Obligations known and owned

Are the laws, regulations and contracts that set security duties identified, with an owner for each?

A register of the security obligations that apply, each with an owner and the date it was last confirmed, including whether NIS2, DORA or the GDPR apply and in which role.

The register is reviewed at least each year and whenever the business changes, and a new obligation reaches the register within a set time.

A NIS2 or DORA classification that was never recorded or approved means Defined is not met for an organisation that may be in scope.

MP-12 Compliance checked

Is compliance with those obligations checked, and are gaps acted on?

A check against each obligation at least each year, with gaps recorded and assigned.

Gaps are tracked to closure and reported, and the checks are made by someone other than the obligation's owner.

A check done once, for a certification or a customer, and not repeated is Informal.

DM-06 Measurement and assessment

Practice	Defined needs	Managed adds	Judging the evidence
MP-13 Security metrics Are security metrics defined, owned and checked before they are reported?	A written definition for every reported metric, a named owner, and data quality checks recorded before each report.	Metrics are reviewed each year against the decisions they serve, and failed data checks are used to fix their sources.	Metrics produced by tools and reported as supplied are Informal at most.
MP-14 Assessment and follow-up Is the programme assessed at a set interval, and are findings tracked to closure?	A planned assessment or internal audit at least each year, its findings in a tracker with owners and dates, and closure checked by someone other than the action owner.	Overdue findings are counted and reported to management, and the assessment method was improved at least once because of what an assessment showed.	An assessment whose findings have no owners or dates is Informal. A first assessment can be Defined only once its findings have been followed up and their closure checked, which the next assessment shows.

Practice

Defined needs

Managed adds

Judging the evidence

MP-13 Security metrics

Are security metrics defined, owned and checked before they are reported?

A written definition for every reported metric, a named owner, and data quality checks recorded before each report.

Metrics are reviewed each year against the decisions they serve, and failed data checks are used to fix their sources.

Metrics produced by tools and reported as supplied are Informal at most.

MP-14 Assessment and follow-up

Is the programme assessed at a set interval, and are findings tracked to closure?

A planned assessment or internal audit at least each year, its findings in a tracker with owners and dates, and closure checked by someone other than the action owner.

Overdue findings are counted and reported to management, and the assessment method was improved at least once because of what an assessment showed.

An assessment whose findings have no owners or dates is Informal. A first assessment can be Defined only once its findings have been followed up and their closure checked, which the next assessment shows.

DM-07 Assets and information

Practice	Defined needs	Managed adds	Judging the evidence
MP-15 Asset inventory Is there an inventory of hardware, software and services, with an owner for each?	An inventory of devices, software and cloud services, each with an owner, kept current by a set process.	Completeness is checked against another source, such as network discovery or purchasing records, and differences are measured and fixed.	An inventory last updated outside the evidence window is Informal.
MP-16 Information classification Is information classified, and handled as its level requires?	A classification scheme approved by management, handling rules for each level, and records showing information is labelled and handled by them.	Handling is checked on a sample at a set interval, and the results are reported and used to change the rules or the training.	A scheme published but never applied to real information is Informal.

Practice

Defined needs

Managed adds

Judging the evidence

MP-15 Asset inventory

Is there an inventory of hardware, software and services, with an owner for each?

An inventory of devices, software and cloud services, each with an owner, kept current by a set process.

Completeness is checked against another source, such as network discovery or purchasing records, and differences are measured and fixed.

An inventory last updated outside the evidence window is Informal.

MP-16 Information classification

Is information classified, and handled as its level requires?

A classification scheme approved by management, handling rules for each level, and records showing information is labelled and handled by them.

Handling is checked on a sample at a set interval, and the results are reported and used to change the rules or the training.

A scheme published but never applied to real information is Informal.

DM-08 Vulnerabilities and patching

Practice	Defined needs	Managed adds	Judging the evidence
MP-17 Finding and prioritising vulnerabilities Are all in-scope systems scanned, and are findings prioritised by a written method?	Scan coverage of the in-scope assets on record, and a written prioritisation method applied to every finding.	Coverage is measured against the inventory and reported, and the method was adjusted because of what the measures showed.	Prioritisation by scanner score alone, without the organisation's own method, is Informal.
MP-18 Fixing on time Are vulnerabilities fixed and patches applied within set deadlines, with deferrals approved?	Written remediation deadlines by priority, records showing fixes against them, and a deferral approved as an exception whenever a deadline is missed.	Fixes within deadline are measured and reported, and fixes are verified by a rescan before closure.	A missed deadline with no approved deferral in the sample means Defined is not met.

Practice

Defined needs

Managed adds

Judging the evidence

MP-17 Finding and prioritising vulnerabilities

Are all in-scope systems scanned, and are findings prioritised by a written method?

Scan coverage of the in-scope assets on record, and a written prioritisation method applied to every finding.

Coverage is measured against the inventory and reported, and the method was adjusted because of what the measures showed.

Prioritisation by scanner score alone, without the organisation's own method, is Informal.

MP-18 Fixing on time

Are vulnerabilities fixed and patches applied within set deadlines, with deferrals approved?

Written remediation deadlines by priority, records showing fixes against them, and a deferral approved as an exception whenever a deadline is missed.

Fixes within deadline are measured and reported, and fixes are verified by a rescan before closure.

A missed deadline with no approved deferral in the sample means Defined is not met.

DM-09 Identity and access

Practice	Defined needs	Managed adds	Judging the evidence
MP-19 Joiners, movers and leavers Is access granted on approval, changed on moves, and removed on leaving, within set times?	A written process with approval before access, and records showing leavers' access removed within the time it sets.	Removal times are measured and reported, and the process was changed because of a late removal.	Samples must be chosen from HR records, not from the access system, or late removals cannot be seen.
MP-20 Access reviews Are user access rights reviewed by their owners at a set interval?	Access reviews of the in-scope systems at the interval the procedure sets, with removals made and recorded.	Completion and removal rates are measured and reported, and reviews are checked by someone other than the reviewer.	A review that removed nothing across several systems deserves a sample check: an approve-all review is Informal.
MP-21 Privileged access Is privileged access limited, approved, and its use controlled?	A list of privileged accounts with an owner and approval for each, separate accounts for privileged work, and strong authentication on them.	Privileged activity is logged and reviewed, and the number of privileged accounts is measured and reported.	Shared administrator accounts with no record of who used them mean Defined is not met.

Practice

Defined needs

Managed adds

Judging the evidence

MP-19 Joiners, movers and leavers

Is access granted on approval, changed on moves, and removed on leaving, within set times?

A written process with approval before access, and records showing leavers' access removed within the time it sets.

Removal times are measured and reported, and the process was changed because of a late removal.

Samples must be chosen from HR records, not from the access system, or late removals cannot be seen.

MP-20 Access reviews

Are user access rights reviewed by their owners at a set interval?

Access reviews of the in-scope systems at the interval the procedure sets, with removals made and recorded.

Completion and removal rates are measured and reported, and reviews are checked by someone other than the reviewer.

A review that removed nothing across several systems deserves a sample check: an approve-all review is Informal.

MP-21 Privileged access

Is privileged access limited, approved, and its use controlled?

A list of privileged accounts with an owner and approval for each, separate accounts for privileged work, and strong authentication on them.

Privileged activity is logged and reviewed, and the number of privileged accounts is measured and reported.

Shared administrator accounts with no record of who used them mean Defined is not met.

DM-10 Awareness and training

Practice	Defined needs	Managed adds	Judging the evidence
MP-22 Training Do people receive security training suited to their role, on joining and each year?	A training plan by audience, records of completion, and additional training for roles at higher risk.	Completion is measured and followed up, and the plan is changed each year from incidents and risks.	One course for everyone, with no role-based training, is Informal.
MP-23 Behaviour measured Is the effect of awareness on behaviour measured?	A written measure of behaviour, such as the reporting rate of suspicious emails, collected at a set interval.	The measure has a target, it is reported, and the programme was changed because of it.	Completion rates alone measure attendance, not behaviour: Informal at most.

Practice

Defined needs

Managed adds

Judging the evidence

MP-22 Training

Do people receive security training suited to their role, on joining and each year?

A training plan by audience, records of completion, and additional training for roles at higher risk.

Completion is measured and followed up, and the plan is changed each year from incidents and risks.

One course for everyone, with no role-based training, is Informal.

MP-23 Behaviour measured

Is the effect of awareness on behaviour measured?

A written measure of behaviour, such as the reporting rate of suspicious emails, collected at a set interval.

The measure has a target, it is reported, and the programme was changed because of it.

Completion rates alone measure attendance, not behaviour: Informal at most.

DM-11 Protection of systems and data

Practice	Defined needs	Managed adds	Judging the evidence
MP-24 Backups restored Are backups of critical data taken, protected, and restored in tests?	A backup schedule for critical data, a copy protected from the systems it backs up, and records of restore tests at the interval set.	Restore success and time are measured and reported, and failed restores lead to recorded changes.	Backups that have never been restored in a test are Informal, whatever the backup reports say.
MP-25 Secure configuration Are systems built and kept to a written secure configuration?	Written configuration baselines for the main system types, and records showing new systems are built to them.	Drift from the baseline is detected and measured, and the baselines are reviewed at a set interval.	Vendor defaults with ad hoc hardening are Informal.

Practice

Defined needs

Managed adds

Judging the evidence

MP-24 Backups restored

Are backups of critical data taken, protected, and restored in tests?

A backup schedule for critical data, a copy protected from the systems it backs up, and records of restore tests at the interval set.

Restore success and time are measured and reported, and failed restores lead to recorded changes.

Backups that have never been restored in a test are Informal, whatever the backup reports say.

MP-25 Secure configuration

Are systems built and kept to a written secure configuration?

Written configuration baselines for the main system types, and records showing new systems are built to them.

Drift from the baseline is detected and measured, and the baselines are reviewed at a set interval.

Vendor defaults with ad hoc hardening are Informal.

DM-12 Detection and monitoring

Practice	Defined needs	Managed adds	Judging the evidence
MP-26 Logging Are security logs from critical systems collected, protected and kept for a set period?	A list of the systems whose logs are collected, central collection protected from change, and retention as the organisation has decided.	Missing log sources are detected and reported, and the list is reviewed when systems change.	Logs kept only on the systems that produce them are Informal.
MP-27 Alert handling Are alerts reviewed and triaged against written criteria, with a set response time?	Written criteria for the alerts that must be reviewed, a response time, and records of triage.	Triage times and missed alerts are measured and reported, and the criteria are tuned from incidents and false positives.	Alerts sent to a mailbox that nobody is assigned to watch are Not in place.

Practice

Defined needs

Managed adds

Judging the evidence

MP-26 Logging

Are security logs from critical systems collected, protected and kept for a set period?

A list of the systems whose logs are collected, central collection protected from change, and retention as the organisation has decided.

Missing log sources are detected and reported, and the list is reviewed when systems change.

Logs kept only on the systems that produce them are Informal.

MP-27 Alert handling

Are alerts reviewed and triaged against written criteria, with a set response time?

Written criteria for the alerts that must be reviewed, a response time, and records of triage.

Triage times and missed alerts are measured and reported, and the criteria are tuned from incidents and false positives.

Alerts sent to a mailbox that nobody is assigned to watch are Not in place.

DM-13 Incident response and notification

Practice	Defined needs	Managed adds	Judging the evidence
MP-28 Incident procedure Are incidents handled to a written procedure, with severity levels and roles?	An approved incident procedure with severity levels and named roles, and incident records that follow it.	Response measures are reported, and post-incident reviews lead to changes that are tracked to closure.	A procedure that recent incident records do not follow is Informal.
MP-29 Notification readiness Can the organisation decide and make a regulatory notification within the legal deadlines?	A record of which regimes apply, a written way of deciding whether to report, named people with tested access to each authority's channel, and records of decisions made.	Decisions and reports on time are measured, and readiness is re-checked at a set interval.	Where no notification duty applies, record Not applicable with the reason (MA-08).
MP-30 Exercises Is incident response rehearsed at a set interval, and are lessons acted on?	An exercise programme, at least one exercise held in the evidence window, and its lessons recorded with owners.	Lessons are tracked to closure and reported, and the programme varies scenarios and participants from year to year.	An exercise held with no lessons recorded is Informal.

Practice

Defined needs

Managed adds

Judging the evidence

MP-28 Incident procedure

Are incidents handled to a written procedure, with severity levels and roles?

An approved incident procedure with severity levels and named roles, and incident records that follow it.

Response measures are reported, and post-incident reviews lead to changes that are tracked to closure.

A procedure that recent incident records do not follow is Informal.

MP-29 Notification readiness

Can the organisation decide and make a regulatory notification within the legal deadlines?

A record of which regimes apply, a written way of deciding whether to report, named people with tested access to each authority's channel, and records of decisions made.

Decisions and reports on time are measured, and readiness is re-checked at a set interval.

Where no notification duty applies, record Not applicable with the reason (MA-08).

MP-30 Exercises

Is incident response rehearsed at a set interval, and are lessons acted on?

An exercise programme, at least one exercise held in the evidence window, and its lessons recorded with owners.

Lessons are tracked to closure and reported, and the programme varies scenarios and participants from year to year.

An exercise held with no lessons recorded is Informal.

DM-14 Recovery and continuity

Practice	Defined needs	Managed adds	Judging the evidence
MP-31 Recovery plans Do critical services have recovery plans with recovery times agreed by the business?	A list of critical services with recovery time objectives agreed by their business owners, and a recovery plan for each.	The objectives are reviewed each year, and plans are updated after each test or real recovery.	Recovery objectives set by IT without the business owner's agreement are Informal.
MP-32 Recovery tested Is recovery of critical services tested against the agreed recovery times?	Recovery tests at the interval set, with the time achieved recorded against the objective.	Results are reported, and every missed objective leads to a recorded change.	A test that restored data but never measured the time against the objective is Informal.

Practice

Defined needs

Managed adds

Judging the evidence

MP-31 Recovery plans

Do critical services have recovery plans with recovery times agreed by the business?

A list of critical services with recovery time objectives agreed by their business owners, and a recovery plan for each.

The objectives are reviewed each year, and plans are updated after each test or real recovery.

Recovery objectives set by IT without the business owner's agreement are Informal.

MP-32 Recovery tested

Is recovery of critical services tested against the agreed recovery times?

Recovery tests at the interval set, with the time achieved recorded against the objective.

Results are reported, and every missed objective leads to a recorded change.

A test that restored data but never measured the time against the objective is Informal.

Scoring a practice

The steps

The assessor takes each practice assigned to them through these steps, in order, and records the result in the questionnaire.

Check it applies. If the sponsor approved it as Not applicable, record that with the reason and stop (MA-08).
Collect the evidence in the window. Set aside records dated outside it (MA-04).
Choose the sample yourself, from a list the practice owner did not filter, and check each record against the practice (MA-05).
Find the highest level the evidence supports on its face. Start at Not in place and go up one level at a time; stop at the first level whose evidence is missing (MA-02, MA-03).
Record the confidence: Told, Seen or Tested. Lower the level to what the confidence supports (MA-13).
If you own or run the practice, mark the result self-assessed and lower it to Defined if it is higher (MA-14).
Write the note: what you saw, the sample, and what the next level needs. The note is the finding if the practice is below target.

The evidence window

Only records in the window count (MA-04). A practice that runs less often than the window, such as a yearly exercise or a two-yearly recovery test, is judged on its own last cycle. Write the dates in the note. A record dated after the last day of fieldwork does not count for this assessment; it counts for the next one, or for a re-assessment of the action that produced it (MA-18).

Sampling

Recurring records are checked on a sample (MA-05). The assessor chooses the sample from a list the owner did not filter: leavers from the HR records, not from the access system; findings from the scanner's export, not from the remediation tracker. If the list itself is incomplete, that is a finding against the practice.

A failure the practice caught itself is evidence that it works. A failure the assessor found is evidence that it does not, and Defined is not met.

Independence

No one rates a practice they own or run (P08 IS-07). Where no independent assessor is available for a practice, the result is marked self-assessed and cannot be above Defined until someone independent checks the evidence (MA-14).

The rule is P08's IS-07, "Internal auditors must not audit their own work", applied to an assessment. The Internal Security Assessment Procedure lists the ways a small team can stay independent, in the order to try them, and when to commission an independent assessment instead.

From practices to a domain result

A domain's level

A domain's level is the lowest level among its practices that apply. No average, no rounding (MA-06).

One weak practice limits the domain. That is deliberate: a domain with two Defined practices and one Informal practice depends on the Informal one, and the result must show it.

Practice levels	Domain level	Why
Defined, Defined, Informal	Informal	The lowest practice sets the domain. Two Defined practices do not lift one Informal (MA-06).
Managed, Not in place	Not in place	No average: Managed and Not in place do not make Informal or Defined (MA-06, MA-07).
Not applicable, Defined	Defined	A practice that does not apply is left out (MA-08).
Not applicable, Not applicable	Left out of the result	Every practice Not applicable: the domain is left out of the result, and the report says why (MA-08).

No overall score

There is no overall score, no percentage and no weighting. The result is each domain's level and target, in words, and the gap between them (MA-07).

Counts are allowed where they describe the result without scoring it: "2 of 14 domains at target" is a count; an average of the domain levels is a score, and is never shown. A traffic-light total, a radar chart that joins the domains into a shape, and a number out of 100 are all scores.

Guidance — delete before approval

Management will often ask for a single number. Offer instead the count of domains at target and the gaps that carry an obligation or a risk outside appetite. Those are what a decision rests on.

Targets and gaps

Setting a target

The sponsor approves a target level for every domain before any evidence is scored, with a reason: an obligation that rests on it, a risk outside appetite, or a business need. Defined is the default target. Managed is a target only where one of those reasons asks for measurement and independent checking (MA-09).

Defined is the default because it is what most obligations and auditors look for: a written, agreed way of working that is done routinely and leaves a record. Managed costs more: a measure with a target, reported; a check by someone other than the person who does the work; and a record of improvement. Ask for it only where one of the reasons in MA-09 needs it.

The sponsor approves the targets before any evidence is scored, and the approval is dated. A target changed after scoring has started is a new target for the next assessment, never for this one.

The gap

A domain's gap is its target minus its level (MA-10). It is counted in levels, never in points. A domain above its target has no gap; the result says so, and the sponsor may lower the effort spent on it.

Ordering the actions

Every practice below its domain's target gets an action. Actions take priority first where a risk outside appetite, or an obligation the organisation has recorded as not met, rests on the practice; then the practice at the lower level; then the domain with the larger gap; then domain and practice order. Up to [[5]] actions take priority in one cycle (MA-11).

Pressing is said of a practice on which a risk outside appetite, or an obligation the organisation has recorded as not met, rests. Its action takes priority (MA-11). The risk must be recorded as outside appetite in the risk register, or the obligation recorded as not met by the body that owns it. A practice the assessor merely thinks is important is not pressing.

One level at a time

A practice moves up one level per action. Managed can be claimed only after the practice has run at Defined, with records, for at least [[6]] months. A roadmap never plans a jump of two levels in one step (MA-12).

A practice at Not in place with a target of Defined needs two actions: one to make it happen at all, and one to write it down and make it routine. Planning both as one action hides the risk that the first does not take hold.

Closing and re-assessing

An action closes only on a re-assessment, by someone other than its owner, that shows the level moved (MA-18). Finishing the work is not enough: the practice must run, and leave records, before the next level can be seen. A domain is also re-assessed sooner than the full cycle after a significant incident, a major change or a new obligation that rests on it (MA-17).

Comparing results over time

Results are compared only like with like (MA-15). A change to a practice's evidence criteria, a domain added or removed, a different window or a different sample size is a break in series. Mark it in the report beside each result it affects, and do not show a change in level across it. P11's MR-09 marks a changed metric the same way.

A level that falls without a break in series is a finding. Ask what changed: a person who left, a process that lapsed, or evidence that was accepted last time and should not have been. The last is a calibration problem, and goes in the calibration record.

Worked example: the distributor's first assessment

EXAMPLE. The organisation used throughout the pack is a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. It is an important entity under NIS2 in its Member State. Its first assessment, ASM-2026-1, covered the whole security programme, all fourteen domains. No practice was Not applicable.

Item	EXAMPLE
Sponsor and lead	Chief Operating Officer; Internal Audit Manager, who runs none of the practices assessed
Targets approved	21 Aug 2026, before any evidence was scored (MA-09)
Fieldwork and window	7 Sep 2026 to 18 Sep 2026; records from 19 Sep 2025 (MA-04)
Owners could add evidence	21 Sep 2026 to 28 Sep 2026 (MA-16)
Report	29 Sep 2026; to the board 29 Oct 2026

The Head of Information Security owns the programme and rated nothing. The Information Security Manager rated the practices IT runs, and the Internal Audit Manager the rest.

The targets

EXAMPLE. The Chief Operating Officer approved a target for every domain on 21 Aug 2026. Thirteen domains have the default, Defined; several name the obligation or risk that rests on them. One has Managed: Incident response and notification. Reason: incidents test the programme most often, NIS2's reporting deadlines rest on the response, and R-01 is outside appetite. Response must be measured and checked by someone other than the team that runs it.

The result for each domain

EXAMPLE. Each practice's decided level, after the confidence and self-assessment caps (MA-13, MA-14), and each domain's level, the lowest of its practices (MA-06). 2 of 14 domains are at target. There is no overall score (MA-07).

Domain	Practices	Level	Target	Gap
DM-01 Governance and accountability	MP-01 Defined MP-02 Defined MP-03 Defined	Defined	Defined	None
DM-02 Policy	MP-04 Informal MP-05 Informal	Informal	Defined	1 level
DM-03 Risk management and exceptions	MP-06 Defined MP-07 Defined MP-08 Informal	Informal	Defined	1 level
DM-04 Third-party security	MP-09 Defined MP-10 Informal	Informal	Defined	1 level
DM-05 Legal and regulatory obligations	MP-11 Defined MP-12 Informal	Informal	Defined	1 level
DM-06 Measurement and assessment	MP-13 Defined MP-14 Not in place	Not in place	Defined	2 levels
DM-07 Assets and information	MP-15 Informal MP-16 Defined	Informal	Defined	1 level
DM-08 Vulnerabilities and patching	MP-17 Defined MP-18 Informal	Informal	Defined	1 level
DM-09 Identity and access	MP-19 Defined MP-20 Informal MP-21 Informal	Informal	Defined	1 level
DM-10 Awareness and training	MP-22 Defined MP-23 Defined	Defined	Defined	None
DM-11 Protection of systems and data	MP-24 Informal MP-25 Informal	Informal	Defined	1 level
DM-12 Detection and monitoring	MP-26 Informal MP-27 Informal	Informal	Defined	1 level
DM-13 Incident response and notification	MP-28 Defined MP-29 Informal MP-30 Defined	Informal	Managed	2 levels
DM-14 Recovery and continuity	MP-31 Defined MP-32 Informal	Informal	Defined	1 level

EXAMPLE. Governance and accountability and Awareness and training are at target. Eleven domains are Informal. Measurement and assessment is Not in place, because no assessment of the programme had been made before this one (MP-14). The two largest gaps, 2 levels each, are in measurement and assessment and incident response and notification.

What the example shows about scoring

The confidence cap. MP-05: HR said every joiner acknowledges the policies at induction, but could not show the records during fieldwork, so the result is capped at Informal (MA-13).
Self-assessment. MP-26 and MP-27 were rated by their owner, the Information Security Manager, because no one independent could judge the technical evidence in the time. Both are marked, and neither could be above Defined (MA-14).
A disagreement. MP-20: The Head of Information Security held that the earlier reviews count. The lead kept Informal: they left no record of what was removed (MA-02).
Evidence added at validation. MP-30: Raised from Informal at validation, when the owner added the after-action report on 23 Sep 2026.
A practice that caught its own failure. MP-19: Five leavers sampled from HR records: four had their access removed in time. The fifth was found by the monthly reconciliation and removed, so the practice caught its own failure (MA-05) (P13).

The order of the actions

EXAMPLE. 18 practices are below their domain's target, so 18 actions, each one level (MA-11, MA-12). The first 5 take priority:

MP-04 Policy set, Informal to Defined. Pressing: the board recorded NIS2 measure (h), cryptography, as outstanding until its policy is approved (P12, 30 Jul 2026).
MP-10 Supplier assessment, Informal to Defined. Pressing: R-02, payment fraud through a compromised supplier email account, is outside appetite (P05).
MP-24 Backups restored, Informal to Defined. Pressing: R-01, ransomware takes online ordering offline, is outside appetite (P05).
MP-32 Recovery tested, Informal to Defined. Pressing: R-01, ransomware takes online ordering offline, is outside appetite (P05).
MP-14 Assessment and follow-up, Not in place to Informal. Not pressing, but the only practice at Not in place, in measurement and assessment, one of the two domains with the largest gap.

EXAMPLE. The 4 pressing practices come first, the lower level first among them. MP-28 and MP-30 come last: each is already at Defined, and moves only because incident response and notification has a Managed target.

Guidance — delete before approval

The example's results, targets and actions are the same in every P19 document. The Security Programme Maturity Assessment records each practice's evidence and note, the Maturity Findings & Improvement Tracker tracks the actions, the Maturity Assessment Report Template reports them and the Target-State Maturity Roadmap sequences them.

Common mistakes

Mistake	What the model does instead
Rating what should happen instead of what does.	Rate only on evidence in the window (MA-02, MA-04), and check a sample the assessor chooses (MA-05).
Turning the levels into a single score.	Report each domain's level and target in words, and never add, average or weight them (MA-06, MA-07).
Setting Managed as the target everywhere.	Defined is the default target; Managed needs a reason, and it costs measurement and independent checking (MA-09).
Setting targets after seeing the results.	The sponsor approves targets before any evidence is scored (MA-09).
The security team rating its own practices.	Assign assessors so no one rates their own work; mark and cap what cannot be (MA-14).
Planning to jump from Not in place to Managed in one step.	Move one level per action, and claim Managed only after [[6]] months at Defined (MA-12).
Closing an action when the work is done, not when the level moved.	Close only on re-assessment by someone other than the owner (MA-18).
Comparing this year's result with last year's after the model changed.	Mark the break in series and compare only like with like (MA-15).
Presenting the result as an audit or as compliance.	Say what the result is and what it is not, in the report and the deck (MA-19).

How to defend the method to an auditor

An auditor will usually test that you have decided what is evaluated and how, when, and by whom, that the methods give valid results, and that the results are kept (ISO/IEC 27001 clause 9.1). This model answers each of these for each practice. An assessor of a regulated entity may ask the same questions about effectiveness assessments under NIS2 or DORA.

Evidence to have ready

This model, approved, with its version and the date it was adopted.
For the last assessment: the plan with the assessor for each practice, and the sponsor's approval of the scope and the targets, dated before fieldwork (MA-09, MA-14).
For every practice: the evidence seen, the sample chosen, the confidence, and the assessor's note (MA-02, MA-05, MA-13).
The draft results shown to practice owners, the evidence they added, and every disagreement with the lead's decision (MA-16).
The calibration record for assessors.

The re-derivation test

Invite the auditor to pick [[3]] practices from the last report, including at least one above the default target and one self-assessed result. For each, take the evidence on file and the practice's criteria in this model, and decide the level again. It should match the report, and the domain's level should be the lowest of its practices. Run this test yourself after each assessment, with an assessor who did not rate the practices, so the first time is not in front of the auditor.

Questions auditors commonly ask

Question	Answer the model gives
How do you know two assessors would give the same level?	Every level has written evidence criteria for every practice, the confidence caps the level, and assessors work through the calibration cases each year. The re-derivation test checks it on real results.
Why is there no overall maturity score?	A score hides the weak practice that matters and invites comparison it cannot support. The result is each domain's level and target, and the gap, in words (MA-06, MA-07).
Who rated the practices the security team runs?	Someone who does not run them, from the assessment plan. Where no one could, the result is marked self-assessed, capped at Defined and counted in the report (MA-14).
Were the targets set after you saw the results?	No. The sponsor approved them, with reasons, before any evidence was scored. The dated approval shows it (MA-09).
Is this your internal audit?	No. It judges how reliably practices work. The internal audit programme can use its results to choose what to audit, and the management review can use them as input (MA-19).

Limitations

No maturity model is complete. These are this one's known weaknesses, and how they are managed.

Limitation	Effect	How it is managed
A level is a judgement on evidence.	Two assessors can read the same records differently.	Written evidence criteria for every practice and level, the confidence caps, the assessor's own sample, and yearly calibration.
Thirty-two practices do not cover everything.	A weakness outside them is not seen.	The practices are the ones most organisations need. Add a practice where your obligations or risks need it, and mark the change as a break in series (MA-15).
Maturity is not exposure.	A Defined practice can still fail against a determined attacker, and an Informal one can work well for a while.	Read the result beside the risk register. Practices on which a risk outside appetite rests take priority (MA-11).
Three domains have no published pack.	Protection of systems and data, detection and monitoring, and recovery have generic practices and no detailed method to raise them.	Use the practices' evidence criteria as the minimum, and your own procedures or a specialist for the detail.
Small teams struggle to be independent.	Some results are rated by their owners.	Mark them self-assessed and cap them at Defined (MA-14); when more than a third would be self-assessed, the sponsor decides whether to commission an independent assessment, and records the decision (IT-3 in the Internal Security Assessment Procedure).

Calibration and review

Calibrating assessors

Before their first assessment, and every year after, each assessor works through the cases below on their own.
Compare with the expected level and discuss each difference. A pattern of differences shows a practice or a level whose evidence needs clearer wording: change it here, and record the change below.
A change to a practice's evidence criteria is a break in series for that practice (MA-15).

Calibration cases

Each case is run through the model's scoring rules when this document is built. A questionnaire or tool that applies the rules should give the same answers.

Case	What the assessor found	Face value	Confidence	Level	Why
1	The owner describes a weekly log review in detail. No record of any review is shown.	Defined	Told	Informal	An interview alone supports Informal at most (MA-02, MA-13).
2	An approved access review procedure, and records of four quarterly reviews. The assessor looked at the records but did not check any.	Defined	Seen	Defined	Defined needs at least Seen. Seen is enough for Defined (MA-13).
3	A risk register with owners and ratings, reviews every quarter, a reported measure with a target, and a method change after a review. The assessor read the documents but chose no sample.	Managed	Seen	Defined	Managed needs Tested: a sample the assessor chose and checked (MA-13).
4	As above, and the assessor checked three risks chosen from the register against the method.	Managed	Tested	Managed	Every element of Managed is evidenced and tested.
5	The only person who runs alert triage rates it Managed, with records tested on a sample.	Managed	Tested Self-assessed	Defined	Self-assessed results are capped at Defined until someone independent checks the evidence (MA-14).
6	Joiner records: one of three sampled joiners had access before approval, and nothing recorded the error.	Informal	Tested	Informal	A sampled record that fails means Defined is not met, unless the practice caught and recorded the failure itself (MA-05).
7	A notification readiness practice, where the sponsor approved that no notification duty applies.	Not applicable	Seen	Not applicable	Not applicable, with the reason in the report (MA-08). It is left out of the domain's level.

Measures of the assessment programme

The Head of Information Security reports four measures with the tracker, which the Maturity Findings & Improvement Tracker computes: MAM-01 domains at target (target: rising each cycle); MAM-02 priority actions on time (target: all); MAM-03 self-assessed results (target: none; never more than a third); MAM-04 months since the last full assessment (target: [[12]] or fewer). In the EXAMPLE at quarter end, MAM-01 was 2 of 14, MAM-02 was none due yet, MAM-03 was 2 of 32, MAM-04 was 0.

Review

This model is reviewed at least every 12 months, before the next full assessment, and also when a law or obligation that rests on a domain changes, when a pack named in the domains table is published or revised, or when the re-derivation test finds a result it cannot reproduce. The review is approved by the assessment sponsor. A change to a level, a practice or a rule is a break in series (MA-15).

Calibration record

Date	Assessors	Cases worked	Differences	Change made	Approved by
[[YYYY-MM-DD]]	[[Roles]]	[[n]]	[[n]]	[[None / description]]	[[Name]]

Document	Relationship
Security Maturity Assessment Pack — Guide	How the pack's documents fit together
Internal Security Assessment Procedure	Planning, fieldwork, validation and reporting; who may assess what, and when to commission an independent assessment (MA-14, MA-16)
Security Programme Maturity Assessment	The questionnaire: one row per practice, with the level, confidence and note (MA-02, MA-13)
Assessment Evidence Request Checklist	What to ask each practice owner for, and how to judge it (MA-04, MA-05)
Maturity Findings & Improvement Tracker	Findings and actions to re-assessment (MA-11, MA-12, MA-18)
Maturity Assessment Report Template	The report: levels, targets and gaps in words, with no overall score (MA-06, MA-07)
Target-State Maturity Roadmap	The improvement plan by quarter, one level per step (MA-12)
Maturity Results Executive Summary Deck	The five slides for the approver (MA-16)
Vulnerability & Exposure Management (P01)	The maturity scale
ISO 27001 Implementation & Certification Readiness (P08)	The internal audit programme, which a result can feed, and IS-07
Cybersecurity Metrics & Reporting Programme (P11)	The break-in-series rule MR-09, and the security metrics behind many Managed criteria

Adapting this template

Guidance — delete before approval

Small organisation: keep the scale, the evidence criteria, the rule that a domain is its lowest practice, and the independence rule; they are what makes a level trustworthy. You may assess a few domains each year instead of all 14, as long as each is assessed within [[12]] months and the report says which. Where one person runs security, use a colleague from another function or a reciprocal assessor before marking results self-assessed.

Regulated entity (NIS2, DORA): use the table "Where laws ask for this kind of assessment" in the legal note to show where results feed your duties. For a financial entity, the internal audit of DORA Article 6(6) remains a separate duty for independent auditors.

Adding a practice: write its question, its Defined and Managed evidence and its judging note in the same form, give it the next free ID, and mark the domain's result as a break in series (MA-15). Never remove a practice to raise a domain's level.

Larger organisation: assess each business unit separately and report each unit's profile. Do not combine units into one level by averaging; where one view is needed, use the lowest level, as for a domain (MA-06).

Delete this section before approval.

Framework references

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR).

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 9.1 — Monitoring, measurement, analysis and evaluation	The whole model: what is evaluated, the methods that give valid results, when, and by whom
ISO/IEC 27001:2022	Clause 9.2 — Internal audit	What a maturity result is and is not: results can feed the internal audit programme (MA-19)
ISO/IEC 27001:2022	Clause 9.3.2 — Management review inputs	Results as an input to the management review
ISO/IEC 27001:2022	Clause 10.2 — Nonconformity and corrective action	Ordering the actions; closing and re-assessing (MA-11, MA-18)
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	The whole model: improvements identified from the evaluation, in priority order
NIS2 — Directive (EU) 2022/2555	Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”	The whole model: a procedure to assess the effectiveness of the security measures
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	Who the Implementing Regulation binds; for other entities its Annex is a guide only
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 1.1.1(j) — the policy on the security of network and information systems shall “lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security”	The domain levels, usable as indicators of maturity in the security policy
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 7.1 — establish, implement and apply a policy and procedures to assess whether the cybersecurity risk-management measures taken are effectively implemented and maintained	The rules MA-01 to MA-19
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 7.2 — taking into account the risk assessment and past significant incidents, determine what is monitored and measured, the methods “to ensure valid results”, when it is measured, who measures, when the results are analysed and evaluated, and who analyses and evaluates them	The practices and their evidence (what and how), the evidence window (when), and independence (who)
DORA — Regulation (EU) 2022/2554	Article 6(5) — the ICT risk management framework is documented and reviewed at least once a year (periodically for microenterprises), upon major ICT-related incidents, and following supervisory instructions or conclusions from digital operational resilience testing or audit processes; “It shall be continuously improved on the basis of lessons derived from implementation and monitoring.” A report on the review is submitted to the competent authority on request	Results as an input to the yearly review; comparing results over time (MA-15, MA-17)
DORA — Regulation (EU) 2022/2554	Article 6(6) — “The ICT risk management framework of financial entities, other than microenterprises, shall be subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan.” The auditors possess sufficient knowledge, skills and expertise in ICT risk and appropriate independence, and the frequency and focus of ICT audits are commensurate to the entity’s ICT risk	What a maturity result is and is not: it is not the internal audit, and can inform it (MA-19)
DORA — Regulation (EU) 2022/2554	Article 13(4) — financial entities monitor the effectiveness of the implementation of their digital operational resilience strategy and map the evolution of ICT risk over time, “with a view to understanding the level of ICT risk exposure, in particular in relation to critical or important functions, and enhance the cyber maturity and preparedness of the financial entity”	Comparing results over time; targets and gaps
GDPR — Regulation (EU) 2016/679	Article 32(1)(d) — the security measures include, as appropriate, “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing”	The practices that protect personal data, assessed each cycle

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.

Definitions

Term	Meaning in this model
Action	The work that will move one practice up one level, with an owner, a due date and the evidence that will show it is done.
Assessment lead	The person who plans the assessment, assigns assessors, decides each result and writes the report. Independent of the practices they rate.
Break in series	A change to the model, the scope or the evidence window that means a result cannot be compared with an earlier one. It is marked, as P11's MR-09 marks a change to a metric (MA-15).
Confidence	How a result was evidenced: Told, Seen or Tested (MA-13).
Domain	One area of the security programme, such as risk management or identity and access, made up of two to three practices (DM-01 to DM-14).
Domain level	The lowest level among a domain's practices that apply. One weak practice limits the domain, and an average would hide it (MA-06).
Evidence	A document or record that shows a practice is done as the level requires. Interviews explain evidence; they are not evidence of Defined or Managed on their own (MA-02).
Evidence window	The period records must fall in to count: the [[12]] months up to the last day of fieldwork, or the practice's own last cycle where it runs less often than that (MA-04).
Finding	A practice below its domain's target, written as what was found, what the level needs, and the evidence seen.
Gap	The number of levels between a domain's level and its target: 0 when the target is met, up to 3 (MA-10).
Level	One of the four levels of the scale: Not in place, Informal, Defined or Managed. The scale is P01-A09's, and P11 uses it too.
Maturity	How reliably a security practice is done: whether it happens at all, whether it depends on particular people, whether it is written down and leaves a record, and whether it is measured, checked and improved. It describes how the practice works, not how exposed the organisation is today.
Practice	One thing the programme does, stated as a question with the evidence each level needs (MP-01 to MP-32). Practices are what the assessor rates.
Pressing	Said of a practice on which a risk outside appetite, or an obligation the organisation has recorded as not met, rests. Its action takes priority (MA-11).
Re-assessment	Checking a practice again after its action closes, by someone other than the action's owner, to confirm the level moved (MA-18).
Sample	The records the assessor chooses, not the practice owner, to check that a practice is done as its level requires (MA-05).
Self-assessed	A result given by someone who owns or does the practice. It is marked as such and cannot be above Defined until someone independent checks the evidence (MA-14).
Sponsor	The member of management who commissions the assessment, approves its scope and targets, and receives the report.
Target	The level management decides a domain should reach, set before the evidence is scored, with the reason for it (MA-09).

Security Maturity Model & Scoring Method

What's inside

What changed

Preview

Purpose

Legal note

What a maturity result is and is not

Where laws ask for this kind of assessment

Scope

The rules

The scale

The four levels

What the assessor must see for each level

How a result was evidenced

When a practice is Not applicable

The domains

The practices and the evidence each level needs

DM-01 Governance and accountability

DM-02 Policy

DM-03 Risk management and exceptions

DM-04 Third-party security

DM-05 Legal and regulatory obligations

DM-06 Measurement and assessment

DM-07 Assets and information

DM-08 Vulnerabilities and patching

DM-09 Identity and access

DM-10 Awareness and training

DM-11 Protection of systems and data

DM-12 Detection and monitoring

DM-13 Incident response and notification

DM-14 Recovery and continuity

Scoring a practice

The steps

The evidence window

Sampling

Independence

From practices to a domain result

A domain's level

No overall score

Targets and gaps

Setting a target

The gap

Ordering the actions

One level at a time

Closing and re-assessing

Comparing results over time

Worked example: the distributor's first assessment

The targets

The result for each domain

What the example shows about scoring

The order of the actions

Common mistakes

How to defend the method to an auditor

Evidence to have ready

The re-derivation test

Questions auditors commonly ask

Limitations

Calibration and review

Calibrating assessors

Calibration cases

Measures of the assessment programme

Review

Calibration record

Related documents

Adapting this template

Framework references

Definitions