Security Programme Maturity Assessment
Domain-by-domain maturity questionnaire returning current level, target gap and prioritised next actions.
Available soon
Answer it online instead: How mature is our security programme?About 40 minutes, free, and nothing is stored.
- Format
- Excel
- Size
- 76 KB
- Length
- 11 sheets
- Version
- 1.2
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.2
DM-14 names P23.
- 1.1
DM-14 Recovery and continuity names P22.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Before scoring, the sponsor approves a target level and its reason for every domain (MA-09). Enter them on the Domain Results sheet with the assessment's details. Defined is the default target. |
| 2 | Gather and judge the evidence with the Assessment Evidence Request Checklist. This workbook holds the decided results. On the Assessment sheet, Not in place and Informal mean the same for every practice (Scale and Rules sheet); the row says what Defined and Managed need. |
| 3 | Choose the answer: the level the evidence supports on its face. Choose Not applicable only for a reason the sponsor approved, and write it in the note (MA-08). |
| 4 | Choose the confidence: Told, Seen or Tested. The Scale and Rules sheet says what each means. Mark Self-assessed Yes where the rater owns or runs the practice (MA-14). |
| 5 | The workbook works out the decided level. Told cannot give more than Informal; Managed needs Tested; a self-assessed result cannot be above Defined (MA-13, MA-14). The Check column says when a cap applied. |
| 6 | Where a risk outside appetite, or an obligation recorded as not met, rests on a practice, name it in the Pressing column. Its action comes first (MA-11). |
| 7 | Read the Domain Results sheet: each domain's level is the lowest of its practices (MA-06); the gap is the target minus that level, in levels (MA-10). Nothing is added, averaged or weighted (MA-07). |
| 8 | Read the Next Actions sheet: every practice below its domain's target, in the order MA-11 sets. The first [[5]] take priority. Each action moves its practice up one level (MA-12). Record the actions in the Maturity Findings & Improvement Tracker. |
| 9 | To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column on the Assessment sheet, and the details, targets and reasons on the Domain Results sheet. The practices and formulas stay. Rows at the foot of the Assessment sheet take practices you add; give each an ID and a domain from the list. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps you judge how well your security practices work. It is not legal advice, and a maturity result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law or a certification asks for an assessment or an audit, confirm with counsel or your certification body what it must include.
A maturity result is not an internal audit, a certification or a statement of compliance, and is never presented as one. It can feed the management review, the internal audit programme and the risk register. The results describe how reliably the practices work; they are not a test of controls.
MA-14 applies P08's IS-07: "Internal auditors must not audit their own work." An assessor never rates a practice they own or run.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State. Its first assessment, ASM-2026-1, was led by its Internal Audit Manager, who runs none of the practices. Fieldwork ran from 7 Sep 2026 to 18 Sep 2026. The Assessment sheet shows the results after validation.
Domains with no published pack: DM-11 Protection of systems and data and DM-12 Detection and monitoring. Their practices are generic; rate them on the same evidence rules.
Tailoring — small organisation: if no one independent can rate a practice, mark it self-assessed. If more than a third of results are self-assessed, the sponsor decides whether to commission an independent assessment, and records the decision (Internal Security Assessment Procedure, IT-3).
This workbook is your own record. Keep it with the assessment plan, the evidence checklist and the report.
Assessment
One row per practice, by domain. Yellow columns are yours; the rest calculate. Not in place and Informal: see the Scale and Rules sheet. Full judging notes: Assessment Evidence Request Checklist.
| Row | Practice ID | Domain | Practice | Question | Defined needs | Managed adds | Answer: level the evidence supports | Confidence | Self-assessed | Decided level | Check | Domain level (lowest) | Domain target | Domain gap (levels) | Pressing: the risk or obligation that rests on it | Ordering key (MA-11) | Action order | Priority this cycle | Action aims for (one level up) | Note: reason for Not applicable, change at validation, disagreement |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | MP-01 | Governance and accountability | Accountable person | Is one person accountable for security, with the authority and time for it set in writing? | A role description or appointment, approved by management, that names the person accountable for security, their reporting line and their authority. | Their objectives are reviewed each year against results by the person they report to, and the role was changed at least once because of a review. | Defined | Seen | No | Defined | OK | Defined | Defined | 0 | ||||||
| EXAMPLE | MP-02 | Governance and accountability | Management reporting | Does management receive security reporting at a set interval, and take decisions on it? | A security report to the board or its equivalent at least every quarter, and minutes that record the decisions taken on it. | The report's measures have targets, and the decisions and actions it leads to are tracked to closure and reported back. | Defined | Tested | No | Defined | OK | Defined | Defined | 0 | ||||||
| EXAMPLE | MP-03 | Governance and accountability | Security objectives | Are security objectives set each year, with owners and dates? | Written security objectives for the year, approved by management, each with an owner, a date and how it will be measured. | Progress is reported at least each quarter, and an objective that will be missed leads to a recorded decision. | Defined | Seen | No | Defined | OK | Defined | Defined | 0 | ||||||
| EXAMPLE | MP-04 | Policy | Policy set | Are security policies approved at the right level, published, and reviewed on schedule? | A policy set, each policy approved at the level its tier requires, with an owner and a review date, published where staff can read it. | Reviews are measured as on time or late and reported, and policy breaches and exceptions are used to revise the policies. | Informal | Seen | No | Informal | OK | Informal | Defined | 1 | The board recorded NIS2 measure (h), cryptography, as outstanding until its policy is approved (P12, 30 Jul 2026) | 220204 | 1 | Yes | Defined | |
| EXAMPLE | MP-05 | Policy | Policy acknowledgement | Do the people who must follow a policy confirm they have read it? | Records of acknowledgement for the policies staff must follow, taken on joining and after each material change. | The acknowledgement rate is measured and reported, and those who have not acknowledged are followed up to a deadline. | Defined | Told | No | Informal | Capped by confidence (MA-13) | Informal | Defined | 1 | 1220205 | 7 | No | Defined | ||
| EXAMPLE | MP-06 | Risk management and exceptions | Risk register | Are security risks assessed by a written method, recorded with owners, and reviewed? | A written risk method, a register in which every risk has an owner and a rating made by that method, and a review of the register at the interval the method sets. | Treatment progress and risks outside appetite are measured and reported, and the method was changed at least once because of what the reviews found. | Defined | Tested | No | Defined | OK | Informal | Defined | 1 | ||||||
| EXAMPLE | MP-07 | Risk management and exceptions | Risk appetite | Is there an approved risk appetite, and are risks outside it escalated to the right level? | An appetite statement approved by the approver, and a decision recorded at the right level for every risk outside it: treat, or accept with the reason. | Appetite is reviewed each year, and the number of risks outside it, and their age, is reported to management each quarter. | Defined | Seen | No | Defined | OK | Informal | Defined | 1 | ||||||
| EXAMPLE | MP-08 | Risk management and exceptions | Exceptions | Is every security exception approved at the right level, time-limited and tracked? | An exception register in which every exception has a risk owner, an approver at the level its rating requires, compensating controls and an expiry date. | Expired and renewed exceptions are counted and reported, and an exception renewed more than the rules allow goes to the next level up. | Informal | Tested | No | Informal | OK | Informal | Defined | 1 | 1220308 | 8 | No | Defined | ||
| EXAMPLE | MP-09 | Third-party security | Supplier tiering and contracts | Are suppliers tiered by risk, with security terms in the contracts of those that matter? | A supplier register in which every supplier with access to data or systems has a tier, and the contracts of the highest tier carry the security clauses the tier requires. | The share of high-tier suppliers whose contracts carry the required clauses is measured, and gaps are closed at renewal to a plan. | Defined | Seen | No | Defined | OK | Informal | Defined | 1 | ||||||
| EXAMPLE | MP-10 | Third-party security | Supplier assessment | Are higher-risk suppliers assessed before contract and reviewed during it? | An assessment on record before contract for every supplier in the highest tiers, and a periodic review at the interval the tier sets. | Overdue reviews are counted and reported, and assessment findings are tracked to closure with the supplier. | Informal | Seen | No | Informal | OK | Informal | Defined | 1 | R-02, payment fraud through a compromised supplier email account, is outside appetite (P05) | 220410 | 2 | Yes | Defined | |
| EXAMPLE | MP-11 | Legal and regulatory obligations | Obligations known and owned | Are the laws, regulations and contracts that set security duties identified, with an owner for each? | A register of the security obligations that apply, each with an owner and the date it was last confirmed, including whether NIS2, DORA or the GDPR apply and in which role. | The register is reviewed at least each year and whenever the business changes, and a new obligation reaches the register within a set time. | Defined | Seen | No | Defined | OK | Informal | Defined | 1 | ||||||
| EXAMPLE | MP-12 | Legal and regulatory obligations | Compliance checked | Is compliance with those obligations checked, and are gaps acted on? | A check against each obligation at least each year, with gaps recorded and assigned. | Gaps are tracked to closure and reported, and the checks are made by someone other than the obligation's owner. | Informal | Seen | No | Informal | OK | Informal | Defined | 1 | 1220512 | 9 | No | Defined | ||
| EXAMPLE | MP-13 | Measurement and assessment | Security metrics | Are security metrics defined, owned and checked before they are reported? | A written definition for every reported metric, a named owner, and data quality checks recorded before each report. | Metrics are reviewed each year against the decisions they serve, and failed data checks are used to fix their sources. | Defined | Tested | No | Defined | OK | Not in place | Defined | 2 | ||||||
| EXAMPLE | MP-14 | Measurement and assessment | Assessment and follow-up | Is the programme assessed at a set interval, and are findings tracked to closure? | A planned assessment or internal audit at least each year, its findings in a tracker with owners and dates, and closure checked by someone other than the action owner. | Overdue findings are counted and reported to management, and the assessment method was improved at least once because of what an assessment showed. | Not in place | Seen | No | Not in place | OK | Not in place | Defined | 2 | 1110614 | 5 | Yes | Informal | ||
| EXAMPLE | MP-15 | Assets and information | Asset inventory | Is there an inventory of hardware, software and services, with an owner for each? | An inventory of devices, software and cloud services, each with an owner, kept current by a set process. | Completeness is checked against another source, such as network discovery or purchasing records, and differences are measured and fixed. | Informal | Seen | No | Informal | OK | Informal | Defined | 1 | 1220715 | 10 | No | Defined | ||
| EXAMPLE | MP-16 | Assets and information | Information classification | Is information classified, and handled as its level requires? | A classification scheme approved by management, handling rules for each level, and records showing information is labelled and handled by them. | Handling is checked on a sample at a set interval, and the results are reported and used to change the rules or the training. | Defined | Tested | No | Defined | OK | Informal | Defined | 1 | ||||||
| EXAMPLE | MP-17 | Vulnerabilities and patching | Finding and prioritising vulnerabilities | Are all in-scope systems scanned, and are findings prioritised by a written method? | Scan coverage of the in-scope assets on record, and a written prioritisation method applied to every finding. | Coverage is measured against the inventory and reported, and the method was adjusted because of what the measures showed. | Defined | Seen | No | Defined | OK | Informal | Defined | 1 | ||||||
| EXAMPLE | MP-18 | Vulnerabilities and patching | Fixing on time | Are vulnerabilities fixed and patches applied within set deadlines, with deferrals approved? | Written remediation deadlines by priority, records showing fixes against them, and a deferral approved as an exception whenever a deadline is missed. | Fixes within deadline are measured and reported, and fixes are verified by a rescan before closure. | Informal | Tested | No | Informal | OK | Informal | Defined | 1 | 1220818 | 11 | No | Defined | ||
| EXAMPLE | MP-19 | Identity and access | Joiners, movers and leavers | Is access granted on approval, changed on moves, and removed on leaving, within set times? | A written process with approval before access, and records showing leavers' access removed within the time it sets. | Removal times are measured and reported, and the process was changed because of a late removal. | Defined | Tested | No | Defined | OK | Informal | Defined | 1 | ||||||
| EXAMPLE | MP-20 | Identity and access | Access reviews | Are user access rights reviewed by their owners at a set interval? | Access reviews of the in-scope systems at the interval the procedure sets, with removals made and recorded. | Completion and removal rates are measured and reported, and reviews are checked by someone other than the reviewer. | Informal | Seen | No | Informal | OK | Informal | Defined | 1 | 1220920 | 12 | No | Defined | Disagreement recorded: The Head of Information Security held that the earlier reviews count. The lead kept Informal: they left no record of what was removed (MA-02). | |
| EXAMPLE | MP-21 | Identity and access | Privileged access | Is privileged access limited, approved, and its use controlled? | A list of privileged accounts with an owner and approval for each, separate accounts for privileged work, and strong authentication on them. | Privileged activity is logged and reviewed, and the number of privileged accounts is measured and reported. | Informal | Seen | No | Informal | OK | Informal | Defined | 1 | 1220921 | 13 | No | Defined | ||
| EXAMPLE | MP-22 | Awareness and training | Training | Do people receive security training suited to their role, on joining and each year? | A training plan by audience, records of completion, and additional training for roles at higher risk. | Completion is measured and followed up, and the plan is changed each year from incidents and risks. | Defined | Tested | No | Defined | OK | Defined | Defined | 0 | ||||||
| EXAMPLE | MP-23 | Awareness and training | Behaviour measured | Is the effect of awareness on behaviour measured? | A written measure of behaviour, such as the reporting rate of suspicious emails, collected at a set interval. | The measure has a target, it is reported, and the programme was changed because of it. | Defined | Seen | No | Defined | OK | Defined | Defined | 0 | ||||||
| EXAMPLE | MP-24 | Protection of systems and data | Backups restored | Are backups of critical data taken, protected, and restored in tests? | A backup schedule for critical data, a copy protected from the systems it backs up, and records of restore tests at the interval set. | Restore success and time are measured and reported, and failed restores lead to recorded changes. | Informal | Seen | No | Informal | OK | Informal | Defined | 1 | R-01, ransomware takes online ordering offline, is outside appetite (P05) | 221124 | 3 | Yes | Defined | |
| EXAMPLE | MP-25 | Protection of systems and data | Secure configuration | Are systems built and kept to a written secure configuration? | Written configuration baselines for the main system types, and records showing new systems are built to them. | Drift from the baseline is detected and measured, and the baselines are reviewed at a set interval. | Informal | Seen | No | Informal | OK | Informal | Defined | 1 | 1221125 | 14 | No | Defined | ||
| EXAMPLE | MP-26 | Detection and monitoring | Logging | Are security logs from critical systems collected, protected and kept for a set period? | A list of the systems whose logs are collected, central collection protected from change, and retention as the organisation has decided. | Missing log sources are detected and reported, and the list is reviewed when systems change. | Informal | Seen | Yes | Informal | OK | Informal | Defined | 1 | 1221226 | 15 | No | Defined | ||
| EXAMPLE | MP-27 | Detection and monitoring | Alert handling | Are alerts reviewed and triaged against written criteria, with a set response time? | Written criteria for the alerts that must be reviewed, a response time, and records of triage. | Triage times and missed alerts are measured and reported, and the criteria are tuned from incidents and false positives. | Informal | Seen | Yes | Informal | OK | Informal | Defined | 1 | 1221227 | 16 | No | Defined | ||
| EXAMPLE | MP-28 | Incident response and notification | Incident procedure | Are incidents handled to a written procedure, with severity levels and roles? | An approved incident procedure with severity levels and named roles, and incident records that follow it. | Response measures are reported, and post-incident reviews lead to changes that are tracked to closure. | Defined | Tested | No | Defined | OK | Informal | Managed | 2 | 1311328 | 17 | No | Managed | ||
| EXAMPLE | MP-29 | Incident response and notification | Notification readiness | Can the organisation decide and make a regulatory notification within the legal deadlines? | A record of which regimes apply, a written way of deciding whether to report, named people with tested access to each authority's channel, and records of decisions made. | Decisions and reports on time are measured, and readiness is re-checked at a set interval. | Informal | Seen | No | Informal | OK | Informal | Managed | 2 | 1211329 | 6 | No | Defined | ||
| EXAMPLE | MP-30 | Incident response and notification | Exercises | Is incident response rehearsed at a set interval, and are lessons acted on? | An exercise programme, at least one exercise held in the evidence window, and its lessons recorded with owners. | Lessons are tracked to closure and reported, and the programme varies scenarios and participants from year to year. | Defined | Seen | No | Defined | OK | Informal | Managed | 2 | 1311330 | 18 | No | Managed | Raised from Informal at validation, when the owner added the after-action report on 23 Sep 2026. | |
| EXAMPLE | MP-31 | Recovery and continuity | Recovery plans | Do critical services have recovery plans with recovery times agreed by the business? | A list of critical services with recovery time objectives agreed by their business owners, and a recovery plan for each. | The objectives are reviewed each year, and plans are updated after each test or real recovery. | Defined | Seen | No | Defined | OK | Informal | Defined | 1 | ||||||
| EXAMPLE | MP-32 | Recovery and continuity | Recovery tested | Is recovery of critical services tested against the agreed recovery times? | Recovery tests at the interval set, with the time achieved recorded against the objective. | Results are reported, and every missed objective leads to a recorded change. | Informal | Tested | No | Informal | OK | Informal | Defined | 1 | R-01, ransomware takes online ordering offline, is outside appetite (P05) | 221432 | 4 | Yes | Defined |
Domain Results
Domain results and assessment details
Each domain's level, worked out from the Assessment sheet as the lowest level among its practices that apply (MA-06), and its gap to the target the sponsor approved before scoring (MA-09, MA-10). No overall score, percentage or weighting (MA-07).
EXAMPLE: the results of ASM-2026-1, after validation. Clear the EXAMPLE answers, details and targets to use your own.
The assessment
| Detail | Value | Notes | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Assessment ID | ASM-2026-1 | Quote it in the report and the tracker. | ||||||||
| Assessment sponsor | Chief Operating Officer | Approves the scope and the targets before scoring (MA-09). | ||||||||
| Assessment lead | Internal Audit Manager | Runs none of the practices assessed. Decides each result (MA-16). | ||||||||
| First day of fieldwork | 7 Sep 2026 | |||||||||
| Last day of fieldwork | 18 Sep 2026 | The evidence window ends on this date (MA-04). | ||||||||
| Evidence window (months) | 12 | MA-04: records count only if they fall in this many months up to the last day of fieldwork. | ||||||||
| Evidence window starts | 19 Sep 2025 | Calculated: the day after the same date the window's length earlier. | ||||||||
| Priority actions per cycle | 5 | MA-11: the most actions given priority in one cycle. | ||||||||
Results by domain
| Domain ID | Domain | Practices | Judged | Level now (lowest) | Target | Gap (levels) | Practices below target | Self-assessed | Reason for the target | Published packs that show how to raise it |
|---|---|---|---|---|---|---|---|---|---|---|
| DM-01 | Governance and accountability | 3 | 3 | Defined | Defined | 0 | 0 | 0 | Default. NIS2 makes the management body answerable for the security measures (P12). | P03 Board Cybersecurity Reporting |
| DM-02 | Policy | 2 | 2 | Informal | Defined | 1 | 2 | 0 | Default. The board recorded the cryptography policy as outstanding on 30 Jul 2026 (P12, measure (h)). | P04 Security Policy Management |
| DM-03 | Risk management and exceptions | 3 | 3 | Informal | Defined | 1 | 1 | 0 | Default. | P05 Information Security Risk Management; P02 Security Exception, Waiver & Segregation of Duties |
| DM-04 | Third-party security | 2 | 2 | Informal | Defined | 1 | 1 | 0 | Default. Supplier payment fraud, R-02, is outside appetite (P05). | P06 Third-Party Security Risk Management |
| DM-05 | Legal and regulatory obligations | 2 | 2 | Informal | Defined | 1 | 1 | 0 | Default. | P12 NIS2 Implementation & Readiness; P08 ISO 27001 Implementation & Certification Readiness |
| DM-06 | Measurement and assessment | 2 | 2 | Not in place | Defined | 2 | 1 | 0 | Default. NIS2 asks for policies and procedures to assess whether the security measures are effective. | P11 Cybersecurity Metrics & Reporting Programme; P19 Security Maturity & Internal Assessment (this pack) |
| DM-07 | Assets and information | 2 | 2 | Informal | Defined | 1 | 1 | 0 | Default. | P15 Information Classification & Handling |
| DM-08 | Vulnerabilities and patching | 2 | 2 | Informal | Defined | 1 | 1 | 0 | Default. | P01 Vulnerability & Exposure Management; P17 Patch Management |
| DM-09 | Identity and access | 3 | 3 | Informal | Defined | 1 | 2 | 0 | Default. | P13 Joiner-Mover-Leaver & Access Provisioning; P07 User Access Review; P14 Privileged Access Management |
| DM-10 | Awareness and training | 2 | 2 | Defined | Defined | 0 | 0 | 0 | Default. | P16 Security Awareness Programme |
| DM-11 | Protection of systems and data | 2 | 2 | Informal | Defined | 1 | 2 | 0 | Default. Ransomware taking ordering offline, R-01, is outside appetite (P05). | No published pack covers this domain yet. |
| DM-12 | Detection and monitoring | 2 | 2 | Informal | Defined | 1 | 2 | 2 | Default. | No published pack covers this domain yet. |
| DM-13 | Incident response and notification | 3 | 3 | Informal | Managed | 2 | 3 | 0 | Incidents test the programme most often, NIS2's reporting deadlines rest on the response, and R-01 is outside appetite. Response must be measured and checked by someone other than the team that runs it. | P09 Security Incident Management; P18 Regulatory Incident Notification & Reporting; P10 Cyber Incident Exercises & Tabletop Scenario Library |
| DM-14 | Recovery and continuity | 2 | 2 | Informal | Defined | 1 | 1 | 0 | Default. R-01 is outside appetite (P05). | P22 Cyber Resilience & Recovery; P23 Backup & Restore Assurance |
A gap of 0 means the domain is at or above its target. "Not all judged": a practice in the domain has no level yet. "Left out (MA-08)": every practice is Not applicable; say why in the report.
Counts
| Count | Result | What it counts | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Domains at target (MAM-01) | 2 of 14 | Domains at or above their target level, out of the domains assessed. | ||||||||
| Practices below target, each needing an action (MA-11) | 18 | One action per practice, moving it one level (MA-12). The order is on the Next Actions sheet. | ||||||||
| Self-assessed results (MAM-03) | 2 of 32 | Practice results marked self-assessed, out of all results. Above a third, the sponsor decides whether to commission an independent assessment (IT-3). | ||||||||
| Results capped by a rule | 1 of 32 | Rows where the confidence or self-assessment held the level below the answer. | ||||||||
| Priority actions this cycle | 5 | At most the setting above (MA-11). | ||||||||
What this result does not say
• It is not an audit, a certification or a statement of compliance (MA-19).
• A level says how reliably a practice works. It does not say how exposed the organisation is today (MA-01).
• Self-assessed results and results evidenced only as Told are limits. Count them in the report (Maturity Assessment Report Template).
• Results can be compared with an earlier assessment only when the practices, the scope and the evidence window are the same (MA-15).
Next Actions
Next actions, in order
Every practice below its domain's target, in the order MA-11 sets. The first [[5]] take priority this cycle. Each action moves its practice up one level (MA-12). Owners, dates and evidence go in the Maturity Findings & Improvement Tracker.
| Order | Practice ID | Practice | Domain | Decided level | Action aims for | Pressing: the risk or obligation | Priority this cycle |
|---|---|---|---|---|---|---|---|
| 1 | MP-04 | Policy set | Policy | Informal | Defined | The board recorded NIS2 measure (h), cryptography, as outstanding until its policy is approved (P12, 30 Jul 2026) | Yes |
| 2 | MP-10 | Supplier assessment | Third-party security | Informal | Defined | R-02, payment fraud through a compromised supplier email account, is outside appetite (P05) | Yes |
| 3 | MP-24 | Backups restored | Protection of systems and data | Informal | Defined | R-01, ransomware takes online ordering offline, is outside appetite (P05) | Yes |
| 4 | MP-32 | Recovery tested | Recovery and continuity | Informal | Defined | R-01, ransomware takes online ordering offline, is outside appetite (P05) | Yes |
| 5 | MP-14 | Assessment and follow-up | Measurement and assessment | Not in place | Informal | Yes | |
| 6 | MP-29 | Notification readiness | Incident response and notification | Informal | Defined | No | |
| 7 | MP-05 | Policy acknowledgement | Policy | Informal | Defined | No | |
| 8 | MP-08 | Exceptions | Risk management and exceptions | Informal | Defined | No | |
| 9 | MP-12 | Compliance checked | Legal and regulatory obligations | Informal | Defined | No | |
| 10 | MP-15 | Asset inventory | Assets and information | Informal | Defined | No | |
| 11 | MP-18 | Fixing on time | Vulnerabilities and patching | Informal | Defined | No | |
| 12 | MP-20 | Access reviews | Identity and access | Informal | Defined | No | |
| 13 | MP-21 | Privileged access | Identity and access | Informal | Defined | No | |
| 14 | MP-25 | Secure configuration | Protection of systems and data | Informal | Defined | No | |
| 15 | MP-26 | Logging | Detection and monitoring | Informal | Defined | No | |
| 16 | MP-27 | Alert handling | Detection and monitoring | Informal | Defined | No | |
| 17 | MP-28 | Incident procedure | Incident response and notification | Defined | Managed | No | |
| 18 | MP-30 | Exercises | Incident response and notification | Defined | Managed | No |
How the order is set
Every practice below its domain's target gets an action. Actions take priority first where a risk outside appetite, or an obligation the organisation has recorded as not met, rests on the practice; then the practice at the lower level; then the domain with the larger gap; then domain and practice order. Up to [[5]] actions take priority in one cycle.
A practice moves up one level per action. Managed can be claimed only after the practice has run at Defined, with records, for at least [[6]] months. A roadmap never plans a jump of two levels in one step.
The Ordering key column on the Assessment sheet applies these tests in turn: pressing first, then the lower decided level, then the larger domain gap, then domain order and row order. It is a sorting aid, not a score.
An action closes only when a re-assessment, by someone other than the action's owner, shows that the practice reached the level the action aimed for.
Scale and Rules
The scale and the rules
The four levels are P01-A09's, word for word; P11 uses them too. The Security Maturity Model & Scoring Method sets out the rules in full.
The four levels
| Level | What it means | What the assessor must see |
|---|---|---|
| Not in place | The practice does not exist, or happens only by chance. | Nothing. This is the level when there is no evidence that the practice happens, or it happens only by chance. |
| Informal | It happens, but depends on particular people and is not written down or not done consistently. | Someone can describe how it is done and show at least one instance, but there is no agreed written way of doing it, or the records are not kept consistently. |
| Defined | It is written down, agreed and done routinely, and leaves a record. | The practice's Defined evidence, seen by the assessor: a written, agreed way of doing it, and records in the evidence window showing it was done routinely. Where the assessor checks a sample, every sampled record must pass (MA-05). |
| Managed | As Defined, and it is also measured, checked by someone else and improved. | All of Defined, and the practice's Managed evidence: a measure with a target that is reported, a check by someone other than the person who does the work, and a record of at least one improvement made because of them. |
How a result was evidenced (MA-13)
| Confidence | What it means | Supports up to |
|---|---|---|
| Told | Described in an interview, with nothing shown. | Informal |
| Seen | A document or record was shown, and it says what the practice needs. | Defined |
| Tested | The assessor chose a sample of records and checked each one against the practice. | Managed |
A self-assessed result cannot be above Defined, whatever the confidence (MA-14).
The rules this workbook applies
| Rule | What it says | |
|---|---|---|
| MA-09 | The sponsor approves a target level for every domain before any evidence is scored, with a reason: an obligation that rests on it, a risk outside appetite, or a business need. Defined is the default target. Managed is a target only where one of those reasons asks for measurement and independent checking. | |
| MA-14 | No one rates a practice they own or run (P08 IS-07). Where no independent assessor is available for a practice, the result is marked self-assessed and cannot be above Defined until someone independent checks the evidence. | |
Lists
| Level | Answer | Confidence | ConfidenceCap | YesNo | Domain |
|---|---|---|---|---|---|
| Not in place | Not in place | Told | 2 | Yes | Governance and accountability |
| Informal | Informal | Seen | 3 | No | Policy |
| Defined | Defined | Tested | 4 | Risk management and exceptions | |
| Managed | Managed | Third-party security | |||
| Not applicable | Legal and regulatory obligations |
Measurement and assessment
Assets and information
Vulnerabilities and patching
Identity and access
Awareness and training
Protection of systems and data
Detection and monitoring
Incident response and notification
Recovery and continuity
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Domain | One area of the security programme, such as risk management or identity and access, made up of two to three practices (DM-01 to DM-14). |
| Practice | One thing the programme does, stated as a question with the evidence each level needs (MP-01 to MP-32). Practices are what the assessor rates. |
| Domain level | The lowest level among a domain's practices that apply. One weak practice limits the domain, and an average would hide it (MA-06). |
| Target | The level management decides a domain should reach, set before the evidence is scored, with the reason for it (MA-09). |
| Gap | The number of levels between a domain's level and its target: 0 when the target is met, up to 3 (MA-10). |
| Pressing | Said of a practice on which a risk outside appetite, or an obligation the organisation has recorded as not met, rests. Its action takes priority (MA-11). |
| Self-assessed | A result given by someone who owns or does the practice. It is marked as such and cannot be above Defined until someone independent checks the evidence (MA-14). |
| Not applicable | A practice that does not apply, for a reason the sponsor approves and the report states (MA-08). |
| Answer | The level the evidence supports on its face, before the caps of MA-13 and MA-14. |
| Decided level | The level after those caps. This is the practice's result. |
| MA-nn | The rules of the Security Maturity Model & Scoring Method, MA-01 to MA-19. MP-nn are its practices, DM-nn its domains, MAM-nn its headline measures. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its first assessment, ASM-2026-1. Clear the EXAMPLE answers before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | Assessment and Domain Results sheets: what is evaluated, by which method, and the results |
| NIST CSF 2.0 | ID.IM-01 — “Improvements are identified from evaluations” | Next Actions sheet: the improvements identified from this evaluation, in order |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | The workbook as a whole: one way to assess how well each security practice works, with the same rules for every practice |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Applies to the providers its Article 1 names. For them, the Annex points below; for others, a useful guide only |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 1.1.1(j) — the policy on the security of network and information systems shall “lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security” | Domain Results sheet: the current maturity level of each domain, which a policy's indicators can report |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 7.2 — taking into account the risk assessment and past significant incidents, determine what is monitored and measured, the methods “to ensure valid results”, when it is measured, who measures, when the results are analysed and evaluated, and who analyses and evaluates them | Scale and Rules sheet: what is assessed, by which rules, and how results are decided, so they are valid and comparable |
| DORA — Regulation (EU) 2022/2554 | Article 6(5) — the ICT risk management framework is documented and reviewed at least once a year (periodically for microenterprises), upon major ICT-related incidents, and following supervisory instructions or conclusions from digital operational resilience testing or audit processes; “It shall be continuously improved on the basis of lessons derived from implementation and monitoring.” A report on the review is submitted to the competent authority on request | Next Actions sheet, for financial entities: gaps and actions that can feed the yearly review of the ICT risk management framework. The assessment is not that review |
| DORA — Regulation (EU) 2022/2554 | Article 13(4) — financial entities monitor the effectiveness of the implementation of their digital operational resilience strategy and map the evolution of ICT risk over time, “with a view to understanding the level of ICT risk exposure, in particular in relation to critical or important functions, and enhance the cyber maturity and preparedness of the financial entity” | Domain Results sheet, for financial entities: domain levels against targets, as one input to enhancing cyber maturity |
| GDPR — Regulation (EU) 2016/679 | Article 32(1)(d) — the security measures include, as appropriate, “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing” | The workbook as a whole: part of a process for regularly assessing the effectiveness of security measures |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.