Target-State Maturity Roadmap
Sequences improvements over two to three years with dependencies, effort and expected maturity movement.
Available soon
- Format
- Excel
- Size
- 121 KB
- Length
- 12 sheets
- Version
- 1.1
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.1
DM-14 Recovery and continuity names P22.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Start from the decided results of the assessment, after validation (Security Programme Maturity Assessment, Maturity Assessment Report Template). On the Practice Levels sheet, enter each practice's level now. The 32 practices are the Security Maturity Model & Scoring Method's; add your own on the yellow rows at the foot, with a domain from the list. |
| 2 | On the Domain Levels sheet, enter each domain's target and its reason, exactly as the sponsor approved them before any evidence was scored (MA-09). Never change a target here to make the plan look better. Each domain's level now and gap calculate (MA-06, MA-10). |
| 3 | On the Roadmap Overview sheet, enter the date the roadmap starts from (usually the quarter end after the report), the last day of fieldwork, and the months a practice must run at Defined before Managed can be claimed (MA-12). The quarter ends calculate to the roadmap's horizon: the first year closes the gaps before the next full assessment (MA-17); the later years hold the candidates. |
| 4 | On the Roadmap Items sheet, add one row for each step: one practice, up one level (MA-12). Copy the action, owner, due date and evidence from the Maturity Findings & Improvement Tracker. A practice two levels below target needs two rows; the second starts where the first ends, and its From level must be the level the first reaches. |
| 5 | Add the later steps your current targets do not ask for, usually Managed where the next assessment may raise a target, with the status "Candidate: needs a raised target" and why. Mark them in no option. They become items only when the sponsor raises the target (MA-09). |
| 6 | Mark the actions that take priority (MA-11): those on which a risk outside appetite or an unmet obligation rests first, then the lower levels and the larger gaps. Up to [[5]] in one cycle. Give them the earliest dates the owners can meet. |
| 7 | Name the one item each row waits for, if any, and any work outside the roadmap it waits for, such as a risk treatment action. An item falls due on or after the item it waits for. Managed is planned no sooner than [[6]] months after the practice reaches Defined (MA-12). |
| 8 | Choose an effort band for each item (the bands are on the Roadmap Overview sheet) and enter its external one-off cost: licences, services, contractors. Staff time is effort, not cost. Amounts in the examples are in euros (€); use your own currency. |
| 9 | On the Options sheet, describe each option, mark whether it is recommended, and enter its yearly cost and any one-off cost outside the items. Then on the Roadmap Items sheet mark which items each option includes. An option that leaves out an item must leave out what waits for it; the Check column says so. Where an option brings an item forward, enter the new date in the date changes table. |
| 10 | Read the Domain Levels sheet. For each option, each domain's expected level at each quarter end is the lowest of its practices once the items due by then are done (MA-06). The gap left at the end and the quarter the domain reaches its target calculate. These are expected levels: a level moves only when a re-assessment confirms it (MA-18). |
| 11 | Clear every Check on the Roadmap Items and Practice Levels sheets that does not say OK, At target now or Items reach the target. The Roadmap Overview sheet counts what is left to resolve. |
| 12 | Take the roadmap, with the report and the executive summary deck, to the approver through the sponsor (PH-8, MA-16). Record the option approved at the foot of the Roadmap Overview sheet. Each quarter, compare re-assessed levels with the expected levels, and re-plan items that slip. |
| 13 | To clear the EXAMPLE, delete the EXAMPLE rows on the Roadmap Items sheet, the levels now on the Practice Levels sheet, the targets and reasons on the Domain Levels sheet, and the yellow cells on the Options sheet. The practices, domains and formulas stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule MA-12: "A practice moves up one level per action. Managed can be claimed only after the practice has run at Defined, with records, for at least [[6]] months. A roadmap never plans a jump of two levels in one step."
Rule MA-11: "Every practice below its domain's target gets an action. Actions take priority first where a risk outside appetite, or an obligation the organisation has recorded as not met, rests on the practice; then the practice at the lower level; then the domain with the larger gap; then domain and practice order. Up to [[5]] actions take priority in one cycle."
Rule MA-18: "An action closes only when a re-assessment, by someone other than the action's owner, shows that the practice reached the level the action aimed for."
This document helps you judge how well your security practices work. It is not legal advice, and a maturity result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law or a certification asks for an assessment or an audit, confirm with counsel or your certification body what it must include.
A maturity result is not an internal audit, a certification or a statement of compliance, and is never presented as one. It can feed the management review, the internal audit programme and the risk register. The roadmap plans improvements; it does not test controls, and an expected level is not a result.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State. Its first assessment, ASM-2026-1, ran fieldwork from 7 Sep 2026 to 18 Sep 2026. The roadmap starts from 30 Sep 2026 and runs to 31 Dec 2028: its items close the gaps ahead of the next assessment by 17 Sep 2027, and 5 candidates follow in the later years. It goes to the board on 29 Oct 2026 with three options; option B is recommended.
Domains with no published pack: DM-11 Protection of systems and data and DM-12 Detection and monitoring. Plan their items from the practice's Defined and Managed evidence in the Security Maturity Model & Scoring Method; there is no pack to follow yet.
Tailoring — small organisation: fewer, larger steps are fine, but keep one level per step and a named owner for each. Where one person owns most items, spread the due dates so the quarter's work is possible.
Tailoring — regulated entity (NIS2, DORA): keep each approved version of the roadmap with the report and the approver's minute. A financial entity can draw on the items, dates, owners and costs for the measures section of its ICT risk management framework review report.
Tailoring — IT run by a service provider: items the provider delivers name your contract owner as owner, and the provider's work as what the item waits for. The re-assessment stays yours.
This workbook is your own record. Keep it with the assessment report and the tracker.
Roadmap Overview
Roadmap overview
The settings the roadmap calculates from, where it stands, what it is for, how it is made, the effort bands, the review points and the approval. Yellow cells are yours; the EXAMPLE entries show a completed roadmap.
| Roadmap starts from (as at) | 30 Sep 2026 | EXAMPLE: the quarter end after the report. Quarters are counted from the day after. |
| Levels now decided on (last day of fieldwork) | 18 Sep 2026 | A practice already at Defined on this date counts its months at Defined from here (MA-12). |
| Months at Defined before Managed | 6 | MA-12. The pack's default; set your own. |
Quarter ends, from the start to the roadmap's horizon
| Quarter | Label | Ends | |
|---|---|---|---|
| Quarter 1 | Q4 2026 | 31 Dec 2026 | |
| Quarter 2 | Q1 2027 | 31 Mar 2027 | |
| Quarter 3 | Q2 2027 | 30 Jun 2027 | |
| Quarter 4 | Q3 2027 | 30 Sep 2027 | |
| Quarter 5 | Q4 2027 | 31 Dec 2027 | |
| Quarter 6 | Q1 2028 | 31 Mar 2028 | |
| Quarter 7 | Q2 2028 | 30 Jun 2028 | |
| Quarter 8 | Q3 2028 | 30 Sep 2028 | |
| Quarter 9 | Q4 2028 | 31 Dec 2028 | |
| Roadmap horizon (calc) | 31 Dec 2028 | The first [[12]] months close the gaps before the next assessment (MA-17); the later quarters hold the candidates. |
Where the roadmap stands
| Measure | Value | What it means | ||
|---|---|---|---|---|
| Items in the roadmap | 20 | One row per step: one practice up one level (MA-12). | ||
| Candidates | 5 | Later steps that wait for a raised target (MA-09). No option funds them. | ||
| Items that take priority | 5 | MA-11: up to [[5]] in one cycle. | ||
| Item rows to resolve | 0 | Rows on the Roadmap Items sheet whose Check does not say OK. | ||
| Practices below target that the items do not bring to target | 0 | Every practice below target needs items that bring it there (MA-11). | ||
| Domains at target now | 2 of 14 | Domains at or above their target at the end of fieldwork. | ||
| Option recommended | B | Marked on the Options sheet. | ||
| its one-off cost | €59,000 | External one-off cost of its items, and any outside them. | ||
| its yearly cost | €18,000 | What it adds to yearly budgets. | ||
| domains at target at the last quarter end | 14 of 14 | Expected, if every item closes on time and its re-assessment confirms the level (MA-18). | ||
What the roadmap is for, and what it is not
| Item | Entry | |||
|---|---|---|---|---|
| Objective | Bring every domain to the target the sponsor approved before scoring (MA-09), by the next full assessment, one level per step (MA-12). | |||
| Objective | Give the approver a choice: what each option buys, what it costs once and each year, and what it leaves below target. | |||
| Objective | Spend effort first where a risk outside appetite or an unmet obligation rests on a practice (MA-11). | |||
| Measure of success | Domains at target, counted "n of m" at each quarter end (MAM-01), and priority actions closed on time and re-assessed (MAM-02). | |||
| In scope | Every practice below its domain's target after the assessment, and the second steps the targets need after the first actions close. | |||
| Candidates | Year-two and year-three steps to Managed for practices whose target the next assessment may raise. They stay candidates until the sponsor raises the target (MA-09), and no option funds them. The Domain Levels sheet shows the recommended option with and without them. | |||
| Not in this roadmap | The findings and their status (the Maturity Findings & Improvement Tracker); the results and the reasons for the targets (the Maturity Assessment Report Template); the risk treatment work other packs fund, which an item may wait for. | |||
| What it is not | An expected level is a plan. A practice's level moves only when someone other than the owner re-assesses it (MA-18). The roadmap is not an audit or a compliance plan (MA-19). | |||
How the roadmap is made
| Step | What | How | ||
|---|---|---|---|---|
| 1 | Start from the decided results | Each practice's level now and each domain's target, from the report. Targets are never changed to fit the plan (MA-09). | ||
| 2 | One step per level | Every practice below target gets an action (MA-11). Each item moves one practice up one level (MA-12). A practice two levels short needs two items. | ||
| 3 | Order by MA-11 | Items on which a risk outside appetite or an unmet obligation rests first; then lower levels; then larger gaps. Up to [[5]] take priority. | ||
| 4 | Sequence | An item falls due after the item it waits for. Managed only after [[6]] months at Defined, with records (MA-12). | ||
| 5 | Size | An effort band for each item, and its external one-off cost. Staff time is effort; money spent outside is cost. | ||
| 6 | Build the options | Within the current budget (items with no external cost, and nothing that waits for a dropped item); the recommended option; and a faster or fuller one if it is worth asking. | ||
| 7 | Approve | The sponsor takes the report, the roadmap and its options to the approver (PH-8, MA-16), who approves the option and the investment. | ||
Effort bands
| Band | Name | Person-days | At most (person-days) |
|---|---|---|---|
| S | Small | up to 5 person-days | 5 |
| M | Medium | 6 to 20 person-days | 20 |
| L | Large | 21 to 60 person-days | 60 |
The pack's defaults; set your own. An option's effort is the upper bounds added up: a ceiling, not an estimate.
Review points
| When | Who | What is checked | ||
|---|---|---|---|---|
| Each quarter end | Head of Information Security, to the assessment sponsor | Items due and closed; levels re-assessed against the expected levels on the Domain Levels sheet (PH-9); items that slip re-planned | ||
| When an item is ready | Someone other than the item's owner | Re-assesses the practice. The item closes only if the level moved (MA-18) | ||
| After a significant incident, a major change or a new obligation | Assessment lead | Re-assess the domains it touches sooner (MA-17), and re-plan their items | ||
| At the next full assessment, within [[12]] months | Assessment lead | The new results replace the levels now, and the next roadmap starts from them (MA-17) | ||
Approval (MA-16)
| Role | Name or body | Date | Option approved | |
|---|---|---|---|---|
| Proposed by (Head of Information Security, PH-7) | EXAMPLE: Head of Information Security | [[YYYY-MM-DD]] | ||
| Taken to the approver by (Assessment sponsor, PH-8) | EXAMPLE: Chief Operating Officer | [[YYYY-MM-DD]] | ||
| Approved by (Approver: the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management) | EXAMPLE: the board, meeting on 29 Oct 2026 | [[YYYY-MM-DD]] | [[Option approved; EXAMPLE: option B recommended]] | |
Roadmap Items
One row per step: one practice up one level (MA-12). Yellow columns are yours; the practice, domain, quarter, each option's dates and the Check calculate. Every status is a word; the colour only repeats it.
| Row | Item ID | Status | Practice ID | Practice (calc) | Domain (calc) | From level | To level | What will be done | Evidence that it is done | Owner | Priority (MA-11) | Waits for item | Waits for, outside the roadmap | Due date | Quarter due (calc) | Effort | One-off cost (€) | In option A | In option B | In option C | Due under A (calc) | Due under B (calc) | Due under C (calc) | Due with candidates (calc) | Why it is a candidate | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | MF-01 | In the roadmap | MP-04 | Policy set | Policy | Informal | Defined | Approve a cryptography policy, and keep a policy register with an approval and review date for every policy | The register, and the cryptography policy with its approval | Head of Information Security | Yes | 18 Dec 2026 | Q4 2026 | M | €0 | Yes | Yes | Yes | 18 Dec 2026 | 18 Dec 2026 | 18 Dec 2026 | 18 Dec 2026 | OK | |||
| EXAMPLE | MF-02 | In the roadmap | MP-10 | Supplier assessment | Third-party security | Informal | Defined | Assess the five remaining Tier 1 suppliers on P06's plan, and agree a date for the overdue High finding | Five assessments on record, and the finding's agreed date | Information Security Manager | Yes | 8 Dec 2026 | Q4 2026 | M | €0 | Yes | Yes | Yes | 8 Dec 2026 | 8 Dec 2026 | 8 Dec 2026 | 8 Dec 2026 | OK | |||
| EXAMPLE | MF-03 | In the roadmap | MP-24 | Backups restored | Protection of systems and data | Informal | Defined | Protect the backup copy from the systems it backs up, and restore critical data in a test each quarter | The restore test records of two quarters | Head of IT | Yes | 29 Jan 2027 | Q1 2027 | M | €9,000 | No | Yes | Yes | 29 Jan 2027 | 29 Jan 2027 | 29 Jan 2027 | OK | ||||
| EXAMPLE | MF-04 | In the roadmap | MP-32 | Recovery tested | Recovery and continuity | Informal | Defined | Test the recovery of every critical service against its objective once the ordering platform's recovery is rebuilt | A recovery test record for each critical service, with the time achieved | Head of IT | Yes | MF-03 | P05 TA-01: Rebuild the ordering platform's recovery so it can be restored within 24 hours (due 15 Dec 2026, awaiting board approval; funded through the risk treatment plan, not this roadmap) | 26 Mar 2027 | Q1 2027 | L | €0 | No | Yes | Yes | 26 Mar 2027 | 26 Mar 2027 | 26 Mar 2027 | OK | ||
| EXAMPLE | MF-05 | In the roadmap | MP-14 | Assessment and follow-up | Measurement and assessment | Not in place | Informal | Set the 2027 assessment in the plan, and report progress on this assessment's actions to the Executive Committee each quarter | The 2027 assessment in the plan, and the first quarterly progress report | Head of Information Security | Yes | 18 Dec 2026 | Q4 2026 | S | €0 | Yes | Yes | Yes | 18 Dec 2026 | 18 Dec 2026 | 18 Dec 2026 | 18 Dec 2026 | OK | |||
| EXAMPLE | MF-06 | In the roadmap | MP-29 | Notification readiness | Incident response and notification | Informal | Defined | Close P18's open readiness actions and rehearse a report in the October tabletop | A readiness check at Ready, and the tabletop's record of the rehearsed report | Head of Information Security | No | 31 Oct 2026 | Q4 2026 | S | €0 | Yes | Yes | Yes | 31 Oct 2026 | 31 Oct 2026 | 31 Oct 2026 | 31 Oct 2026 | OK | |||
| EXAMPLE | MF-07 | In the roadmap | MP-05 | Policy acknowledgement | Policy | Informal | Defined | Keep policy acknowledgements in the HR system for every joiner and after each material change | Acknowledgement records for ten people chosen by the assessor | HR Director | No | MF-01 | 18 Dec 2026 | Q4 2026 | S | €0 | Yes | Yes | Yes | 18 Dec 2026 | 18 Dec 2026 | 18 Dec 2026 | 18 Dec 2026 | OK | ||
| EXAMPLE | MF-08 | In the roadmap | MP-08 | Exceptions | Risk management and exceptions | Informal | Defined | Decide the expired exception, and check the exception register for expiries each month | The decision, and three monthly checks | Head of Information Security | No | 30 Oct 2026 | Q4 2026 | S | €0 | Yes | Yes | Yes | 30 Oct 2026 | 30 Oct 2026 | 30 Oct 2026 | 30 Oct 2026 | OK | |||
| EXAMPLE | MF-09 | In the roadmap | MP-12 | Compliance checked | Legal and regulatory obligations | Informal | Defined | Repeat the NIS2 readiness self-assessment each half year, with gaps assigned | Two readiness self-assessments with their gaps | Head of Information Security | No | 31 Mar 2027 | Q1 2027 | S | €0 | Yes | Yes | Yes | 31 Mar 2027 | 31 Mar 2027 | 31 Mar 2027 | 31 Mar 2027 | OK | |||
| EXAMPLE | MF-10 | In the roadmap | MP-15 | Asset inventory | Assets and information | Informal | Defined | Build one inventory of devices, software and services with an owner for each, and keep it current from purchasing and discovery | The inventory, and the process that keeps it current | Head of IT | No | 30 Jun 2027 | Q2 2027 | L | €12,000 | No | Yes | Yes | 30 Jun 2027 | 30 Jun 2027 | 30 Jun 2027 | OK | ||||
| EXAMPLE | MF-11 | In the roadmap | MP-18 | Fixing on time | Vulnerabilities and patching | Informal | Defined | Bring the most urgent fixes back to deadline, with every miss deferred as an exception | Five sampled findings fixed on time or deferred with approval | Head of IT | No | 29 Jan 2027 | Q1 2027 | M | €0 | Yes | Yes | Yes | 29 Jan 2027 | 29 Jan 2027 | 29 Jan 2027 | 29 Jan 2027 | OK | |||
| EXAMPLE | MF-12 | In the roadmap | MP-20 | Access reviews | Identity and access | Informal | Defined | Complete two review campaigns under the procedure, with removals recorded | Two campaign records with their removals | Head of Information Security | No | 31 Mar 2027 | Q1 2027 | M | €0 | Yes | Yes | Yes | 31 Mar 2027 | 31 Mar 2027 | 31 Mar 2027 | 31 Mar 2027 | OK | |||
| EXAMPLE | MF-13 | In the roadmap | MP-21 | Privileged access | Identity and access | Informal | Defined | Move every administrator to separate accounts with strong authentication, as P14's Tier 1 plan sets | The account list, and three approval records | Head of IT | No | 18 Dec 2026 | Q4 2026 | M | €0 | Yes | Yes | Yes | 18 Dec 2026 | 18 Dec 2026 | 18 Dec 2026 | 18 Dec 2026 | OK | |||
| EXAMPLE | MF-14 | In the roadmap | MP-25 | Secure configuration | Protection of systems and data | Informal | Defined | Write configuration baselines for servers and office PCs, and build new systems to them | The baselines, and three build records | Head of IT | No | 30 Jun 2027 | Q2 2027 | M | €0 | Yes | Yes | Yes | 30 Jun 2027 | 30 Jun 2027 | 30 Jun 2027 | 30 Jun 2027 | OK | |||
| EXAMPLE | MF-15 | In the roadmap | MP-26 | Logging | Detection and monitoring | Informal | Defined | List the log sources required and collect them all centrally, protected from change | The source list, and three sources reaching the store | Information Security Manager | No | 10 Sep 2027 | Q3 2027 | L | €38,000 | No | Yes | Yes | 10 Sep 2027 | 10 Mar 2027 | 10 Sep 2027 | OK | ||||
| EXAMPLE | MF-16 | In the roadmap | MP-27 | Alert handling | Detection and monitoring | Informal | Defined | Write alert criteria and response times with the managed provider, and record triage | The criteria, and five triage records | Information Security Manager | No | MF-15 | 10 Sep 2027 | Q3 2027 | M | €0 | No | Yes | Yes | 10 Sep 2027 | 10 Mar 2027 | 10 Sep 2027 | OK | |||
| EXAMPLE | MF-17 | In the roadmap | MP-28 | Incident procedure | Incident response and notification | Defined | Managed | Report incident response measures each month, and have post-incident actions checked by internal audit | Six months of measures, and internal audit's checks | Information Security Manager | No | 30 Jun 2027 | Q2 2027 | M | €0 | Yes | Yes | Yes | 30 Jun 2027 | 30 Jun 2027 | 30 Jun 2027 | 30 Jun 2027 | OK | |||
| EXAMPLE | MF-18 | In the roadmap | MP-30 | Exercises | Incident response and notification | Defined | Managed | Track exercise lessons to closure and report them, and vary scenarios and participants each year | The lessons log closed and reported, and the 2027 programme | Information Security Manager | No | 30 Jun 2027 | Q2 2027 | S | €0 | Yes | Yes | Yes | 30 Jun 2027 | 30 Jun 2027 | 30 Jun 2027 | 30 Jun 2027 | OK | |||
| EXAMPLE | RS-01 | In the roadmap | MP-14 | Assessment and follow-up | Measurement and assessment | Informal | Defined | Follow up every finding of this assessment in the 2027 assessment, with closure checked by someone other than each action's owner | The 2027 assessment report, showing each finding of this one followed up | Head of Information Security | No | MF-05 | 17 Sep 2027 | Q3 2027 | S | €0 | Yes | Yes | Yes | 17 Sep 2027 | 17 Sep 2027 | 17 Sep 2027 | 17 Sep 2027 | OK | ||
| EXAMPLE | RS-02 | In the roadmap | MP-29 | Notification readiness | Incident response and notification | Defined | Managed | Measure decisions and reports on time each quarter, and re-check readiness every six months | Two quarters of the measures reported, and a readiness re-check | Head of Information Security | No | MF-06 | 30 Jun 2027 | Q2 2027 | S | €0 | Yes | Yes | Yes | 30 Jun 2027 | 30 Jun 2027 | 30 Jun 2027 | 30 Jun 2027 | OK | ||
| EXAMPLE | RC-01 | Candidate: needs a raised target | MP-10 | Supplier assessment | Third-party security | Defined | Managed | Count overdue supplier reviews and report them, and track assessment findings to closure with each supplier | Two quarters of the measure reported, and findings closed with suppliers | Information Security Manager | No | MF-02 | 31 Mar 2028 | Q1 2028 | M | €0 | No | No | No | 31 Mar 2028 | R-02, payment fraud through a compromised supplier email account, is outside appetite (P05) | OK | ||||
| EXAMPLE | RC-02 | Candidate: needs a raised target | MP-02 | Management reporting | Governance and accountability | Defined | Managed | Track the board's security decisions and actions to closure, and report them back each quarter | Four quarterly reports with the actions list | Head of Information Security | No | 31 Mar 2028 | Q1 2028 | S | €0 | No | No | No | 31 Mar 2028 | The board asked on 30 Jul 2026 for oversight through the quarterly report (P12). | OK | |||||
| EXAMPLE | RC-03 | Candidate: needs a raised target | MP-24 | Backups restored | Protection of systems and data | Defined | Managed | Measure restore success and time, report them each quarter, and change the backup set-up after every failed restore | Four quarters of restore measures, and the record of a change made | Head of IT | No | MF-03 | 30 Jun 2028 | Q2 2028 | M | €0 | No | No | No | 30 Jun 2028 | R-01, ransomware takes online ordering offline, is outside appetite (P05) | OK | ||||
| EXAMPLE | RC-04 | Candidate: needs a raised target | MP-14 | Assessment and follow-up | Measurement and assessment | Defined | Managed | Report overdue findings to management each quarter, and improve the assessment method from what the 2027 assessment showed | The overdue measure reported, and the method's change record | Head of Information Security | No | RS-01 | 29 Sep 2028 | Q3 2028 | S | €0 | No | No | No | 29 Sep 2028 | NIS2 asks for procedures to assess whether the security measures are effective. | OK | ||||
| EXAMPLE | RC-05 | Candidate: needs a raised target | MP-32 | Recovery tested | Recovery and continuity | Defined | Managed | Report recovery test results, and change the plan after every missed objective | A year of recovery test results reported, and the changes they led to | Head of IT | No | MF-04 | 29 Sep 2028 | Q3 2028 | M | €0 | No | No | No | 29 Sep 2028 | R-01, ransomware takes online ordering offline, is outside appetite (P05) | OK |
Options
Investment options
What each option funds, what it costs once and each year, and what it leaves below target. Items are marked into an option on the Roadmap Items sheet; the date changes table moves an item's date under one option. Domain counts come from the Domain Levels sheet.
The options
| Measure | Option A | Option B | Option C | What it means | |
|---|---|---|---|---|---|
| Option | A | B | C | The letter the item columns use. | |
| What it is | Within the current budget | Close the gaps by the 2027 assessment | B, with a managed detection service | In a few words, for the deck. | |
| Recommended | No | Yes | No | Yes for one option. | |
| Items it funds | 15 | 20 | 20 | Items marked Yes for the option on the Roadmap Items sheet. | |
| Items it leaves out | 5 | 0 | 0 | Each leaves a practice below target, unless a later item covers it. | |
| One-off cost of its items | €0 | €59,000 | €59,000 | External one-off cost of the items it funds. | |
| Other one-off cost | €0 | €0 | €60,000 | One-off cost outside the items, such as setting up a service. | |
| One-off cost | €0 | €59,000 | €119,000 | Its items and other one-off cost together. | |
| Yearly cost | €0 | €18,000 | €95,000 | What it adds to yearly budgets once in place: licences, services, subscriptions. | |
| Effort, at most (person-days) | 180 | 400 | 400 | The upper bounds of its items' effort bands, added up. | |
| Domains at target at the last quarter end | 10 of 14 | 14 of 14 | 14 of 14 | Expected, from the Domain Levels sheet. | |
| Practices below target at the last quarter end | 5 | 0 | 0 | Expected, from the Practice Levels sheet. | |
| What it leaves | The practices Backups restored, Recovery tested, Asset inventory, Logging and Alert handling stay below target, and R-01's recovery work has no protected copies to restore from. | Detection reaches Defined only a week before the 2027 assessment's fieldwork ends. | Costs about five times B each year, for detection six months sooner. | What stays below target or is slower, in words for the approver. | |
Costs are external spend; staff time is the effort row. Work another pack funds, such as a risk treatment action an item waits for, is not counted here. Amounts in the examples are in euros (€); use your own currency.
Dates an option changes
| Item ID | Option | Due in the roadmap | Due instead | Why | |
|---|---|---|---|---|---|
| MF-15 | C | 10 Sep 2027 | 10 Mar 2027 | EXAMPLE: the managed detection service brings detection to target sooner. | |
| MF-16 | C | 10 Sep 2027 | 10 Mar 2027 | EXAMPLE: the managed detection service brings detection to target sooner. | |
The item's own due date stays on the Roadmap Items sheet; only the option named here uses the new date. Its Check confirms it still falls after the item it waits for.
What falls due, by quarter
| Option | Q4 2026 | Q1 2027 | Q2 2027 | Q3 2027 | Q4 2027 | Q1 2028 | Q2 2028 | Q3 2028 | Q4 2028 | Whole roadmap |
|---|---|---|---|---|---|---|---|---|---|---|
| Option A: items due | 7 | 3 | 4 | 1 | 0 | 0 | 0 | 0 | 0 | 15 |
| Option A: one-off cost due | €0 | €0 | €0 | €0 | €0 | €0 | €0 | €0 | €0 | €0 |
| Option B: items due | 7 | 5 | 5 | 3 | 0 | 0 | 0 | 0 | 0 | 20 |
| Option B: one-off cost due | €0 | €9,000 | €12,000 | €38,000 | €0 | €0 | €0 | €0 | €0 | €59,000 |
| Option C: items due | 7 | 7 | 5 | 1 | 0 | 0 | 0 | 0 | 0 | 20 |
| Option C: one-off cost due | €0 | €47,000 | €12,000 | €0 | €0 | €0 | €0 | €0 | €0 | €59,000 |
Each quarter counts the items due under that option after the previous quarter end, up to and including its own. Other one-off cost is not tied to a quarter.
Domains at target at each quarter end (expected)
| Option | Now | Q4 2026 | Q1 2027 | Q2 2027 | Q3 2027 | Q4 2027 | Q1 2028 | Q2 2028 | Q3 2028 | Q4 2028 |
|---|---|---|---|---|---|---|---|---|---|---|
| Option A | 2 of 14 | 5 of 14 | 8 of 14 | 9 of 14 | 10 of 14 | 10 of 14 | 10 of 14 | 10 of 14 | 10 of 14 | 10 of 14 |
| Option B | 2 of 14 | 5 of 14 | 9 of 14 | 12 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 |
| Option C | 2 of 14 | 5 of 14 | 10 of 14 | 13 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 |
| Recommended option with the candidates | 2 of 14 | 5 of 14 | 9 of 14 | 12 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 |
Counted "n of m" against today's targets, never as a share or a score (MA-07). Expected: each item closed on time, and its re-assessment confirms the level (MA-18). Candidates count only once the sponsor raises their targets.
Domain Levels
Domain levels by quarter end
Each domain's level now and its target, then, for each option, the level it is expected to reach by each quarter end: the lowest of its practices once the items due by then are done (MA-06). The last block adds the candidates to the recommended option. Expected levels assume each item closes on time and its re-assessment confirms the level (MA-18). No overall score (MA-07).
EXAMPLE: ASM-2026-1's results and targets, and its roadmap's three options.
| Domain ID | Domain | Practices | Level now (lowest) | Target | Gap now (levels) | Reason for the target | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DM-01 | Governance and accountability | 3 | Defined | Defined | 0 | Default. NIS2 makes the management body answerable for the security measures (P12). | ||||||||
| DM-02 | Policy | 2 | Informal | Defined | 1 | Default. The board recorded the cryptography policy as outstanding on 30 Jul 2026 (P12, measure (h)). | ||||||||
| DM-03 | Risk management and exceptions | 3 | Informal | Defined | 1 | Default. | ||||||||
| DM-04 | Third-party security | 2 | Informal | Defined | 1 | Default. Supplier payment fraud, R-02, is outside appetite (P05). | ||||||||
| DM-05 | Legal and regulatory obligations | 2 | Informal | Defined | 1 | Default. | ||||||||
| DM-06 | Measurement and assessment | 2 | Not in place | Defined | 2 | Default. NIS2 asks for policies and procedures to assess whether the security measures are effective. | ||||||||
| DM-07 | Assets and information | 2 | Informal | Defined | 1 | Default. | ||||||||
| DM-08 | Vulnerabilities and patching | 2 | Informal | Defined | 1 | Default. | ||||||||
| DM-09 | Identity and access | 3 | Informal | Defined | 1 | Default. | ||||||||
| DM-10 | Awareness and training | 2 | Defined | Defined | 0 | Default. | ||||||||
| DM-11 | Protection of systems and data | 2 | Informal | Defined | 1 | Default. Ransomware taking ordering offline, R-01, is outside appetite (P05). | ||||||||
| DM-12 | Detection and monitoring | 2 | Informal | Defined | 1 | Default. | ||||||||
| DM-13 | Incident response and notification | 3 | Informal | Managed | 2 | Incidents test the programme most often, NIS2's reporting deadlines rest on the response, and R-01 is outside appetite. Response must be measured and checked by someone other than the team that runs it. | ||||||||
| DM-14 | Recovery and continuity | 2 | Informal | Defined | 1 | Default. R-01 is outside appetite (P05). | ||||||||
| Domains at target now | 2 of 14 | |||||||||||||
Option A: Within the current budget
| Domain ID | Domain | Target | Now | Q4 2026 | Q1 2027 | Q2 2027 | Q3 2027 | Q4 2027 | Q1 2028 | Q2 2028 | Q3 2028 | Q4 2028 | Gap at the end | Reaches target |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DM-01 | Governance and accountability | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| DM-02 | Policy | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-03 | Risk management and exceptions | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-04 | Third-party security | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-05 | Legal and regulatory obligations | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-06 | Measurement and assessment | Defined | Not in place | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q3 2027 |
| DM-07 | Assets and information | Defined | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | 1 | Not by Q4 2028 |
| DM-08 | Vulnerabilities and patching | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-09 | Identity and access | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-10 | Awareness and training | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| DM-11 | Protection of systems and data | Defined | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | 1 | Not by Q4 2028 |
| DM-12 | Detection and monitoring | Defined | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | 1 | Not by Q4 2028 |
| DM-13 | Incident response and notification | Managed | Informal | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | 0 | Q2 2027 |
| DM-14 | Recovery and continuity | Defined | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | 1 | Not by Q4 2028 |
| Domains at target | 2 of 14 | 5 of 14 | 8 of 14 | 9 of 14 | 10 of 14 | 10 of 14 | 10 of 14 | 10 of 14 | 10 of 14 | 10 of 14 | ||||
Option B: Close the gaps by the 2027 assessment (recommended)
| Domain ID | Domain | Target | Now | Q4 2026 | Q1 2027 | Q2 2027 | Q3 2027 | Q4 2027 | Q1 2028 | Q2 2028 | Q3 2028 | Q4 2028 | Gap at the end | Reaches target |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DM-01 | Governance and accountability | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| DM-02 | Policy | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-03 | Risk management and exceptions | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-04 | Third-party security | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-05 | Legal and regulatory obligations | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-06 | Measurement and assessment | Defined | Not in place | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q3 2027 |
| DM-07 | Assets and information | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q2 2027 |
| DM-08 | Vulnerabilities and patching | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-09 | Identity and access | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-10 | Awareness and training | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| DM-11 | Protection of systems and data | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q2 2027 |
| DM-12 | Detection and monitoring | Defined | Informal | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q3 2027 |
| DM-13 | Incident response and notification | Managed | Informal | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | 0 | Q2 2027 |
| DM-14 | Recovery and continuity | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| Domains at target | 2 of 14 | 5 of 14 | 9 of 14 | 12 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | ||||
Option C: B, with a managed detection service
| Domain ID | Domain | Target | Now | Q4 2026 | Q1 2027 | Q2 2027 | Q3 2027 | Q4 2027 | Q1 2028 | Q2 2028 | Q3 2028 | Q4 2028 | Gap at the end | Reaches target |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DM-01 | Governance and accountability | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| DM-02 | Policy | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-03 | Risk management and exceptions | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-04 | Third-party security | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-05 | Legal and regulatory obligations | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-06 | Measurement and assessment | Defined | Not in place | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q3 2027 |
| DM-07 | Assets and information | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q2 2027 |
| DM-08 | Vulnerabilities and patching | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-09 | Identity and access | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-10 | Awareness and training | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| DM-11 | Protection of systems and data | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q2 2027 |
| DM-12 | Detection and monitoring | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-13 | Incident response and notification | Managed | Informal | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | 0 | Q2 2027 |
| DM-14 | Recovery and continuity | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| Domains at target | 2 of 14 | 5 of 14 | 10 of 14 | 13 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | ||||
Option B with the candidates: each candidate counts only once the sponsor raises its domain's target (MA-09)
| Domain ID | Domain | Target | Now | Q4 2026 | Q1 2027 | Q2 2027 | Q3 2027 | Q4 2027 | Q1 2028 | Q2 2028 | Q3 2028 | Q4 2028 | Gap at the end | Reaches target |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DM-01 | Governance and accountability | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| DM-02 | Policy | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-03 | Risk management and exceptions | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-04 | Third-party security | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q4 2026 |
| DM-05 | Legal and regulatory obligations | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-06 | Measurement and assessment | Defined | Not in place | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q3 2027 |
| DM-07 | Assets and information | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q2 2027 |
| DM-08 | Vulnerabilities and patching | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-09 | Identity and access | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| DM-10 | Awareness and training | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| DM-11 | Protection of systems and data | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q2 2027 |
| DM-12 | Detection and monitoring | Defined | Informal | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q3 2027 |
| DM-13 | Incident response and notification | Managed | Informal | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | 0 | Q2 2027 |
| DM-14 | Recovery and continuity | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | Q1 2027 |
| Domains at target | 2 of 14 | 5 of 14 | 9 of 14 | 12 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | 14 of 14 | ||||
Gap at the end: levels still between the domain and its target at the last quarter end (MA-10). "Not by …": the domain is not expected at target within the roadmap. "Left out (MA-08)": every practice is Not applicable.
Practice Levels
Each practice's level now, and the level it is expected to reach by each quarter end under each option: its level now, raised by every item due by then. Row 2 names the quarters. Rows marked Default are the model's 32 practices.
| Quarter ends | A: Q4 2026 | A: Q1 2027 | A: Q2 2027 | A: Q3 2027 | A: Q4 2027 | A: Q1 2028 | A: Q2 2028 | A: Q3 2028 | A: Q4 2028 | B: Q4 2026 | B: Q1 2027 | B: Q2 2027 | B: Q3 2027 | B: Q4 2027 | B: Q1 2028 | B: Q2 2028 | B: Q3 2028 | B: Q4 2028 | C: Q4 2026 | C: Q1 2027 | C: Q2 2027 | C: Q3 2027 | C: Q4 2027 | C: Q1 2028 | C: Q2 2028 | C: Q3 2028 | C: Q4 2028 | With candidates: Q4 2026 | With candidates: Q1 2027 | With candidates: Q2 2027 | With candidates: Q3 2027 | With candidates: Q4 2027 | With candidates: Q1 2028 | With candidates: Q2 2028 | With candidates: Q3 2028 | With candidates: Q4 2028 | |||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Row | Practice ID | Domain ID | Practice | Level now | Target (calc) | A: quarter 1 (calc) | A: quarter 2 (calc) | A: quarter 3 (calc) | A: quarter 4 (calc) | A: quarter 5 (calc) | A: quarter 6 (calc) | A: quarter 7 (calc) | A: quarter 8 (calc) | A: quarter 9 (calc) | B: quarter 1 (calc) | B: quarter 2 (calc) | B: quarter 3 (calc) | B: quarter 4 (calc) | B: quarter 5 (calc) | B: quarter 6 (calc) | B: quarter 7 (calc) | B: quarter 8 (calc) | B: quarter 9 (calc) | C: quarter 1 (calc) | C: quarter 2 (calc) | C: quarter 3 (calc) | C: quarter 4 (calc) | C: quarter 5 (calc) | C: quarter 6 (calc) | C: quarter 7 (calc) | C: quarter 8 (calc) | C: quarter 9 (calc) | With candidates: quarter 1 (calc) | With candidates: quarter 2 (calc) | With candidates: quarter 3 (calc) | With candidates: quarter 4 (calc) | With candidates: quarter 5 (calc) | With candidates: quarter 6 (calc) | With candidates: quarter 7 (calc) | With candidates: quarter 8 (calc) | With candidates: quarter 9 (calc) | Items (calc) | Check (calc) |
| Default | MP-01 | DM-01 | Accountable person | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-02 | DM-01 | Management reporting | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Managed | Managed | Managed | Managed | 1 | At target now |
| Default | MP-03 | DM-01 | Security objectives | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-04 | DM-02 | Policy set | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-05 | DM-02 | Policy acknowledgement | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-06 | DM-03 | Risk register | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-07 | DM-03 | Risk appetite | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-08 | DM-03 | Exceptions | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-09 | DM-04 | Supplier tiering and contracts | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-10 | DM-04 | Supplier assessment | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Managed | Managed | Managed | Managed | 2 | Items reach the target |
| Default | MP-11 | DM-05 | Obligations known and owned | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-12 | DM-05 | Compliance checked | Informal | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-13 | DM-06 | Security metrics | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-14 | DM-06 | Assessment and follow-up | Not in place | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Managed | Managed | 3 | Items reach the target |
| Default | MP-15 | DM-07 | Asset inventory | Informal | Defined | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-16 | DM-07 | Information classification | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-17 | DM-08 | Finding and prioritising vulnerabilities | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-18 | DM-08 | Fixing on time | Informal | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-19 | DM-09 | Joiners, movers and leavers | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-20 | DM-09 | Access reviews | Informal | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-21 | DM-09 | Privileged access | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-22 | DM-10 | Training | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-23 | DM-10 | Behaviour measured | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-24 | DM-11 | Backups restored | Informal | Defined | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Managed | Managed | Managed | 2 | Items reach the target |
| Default | MP-25 | DM-11 | Secure configuration | Informal | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-26 | DM-12 | Logging | Informal | Defined | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-27 | DM-12 | Alert handling | Informal | Defined | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | 1 | Items reach the target |
| Default | MP-28 | DM-13 | Incident procedure | Defined | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | 1 | Items reach the target |
| Default | MP-29 | DM-13 | Notification readiness | Informal | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | 2 | Items reach the target |
| Default | MP-30 | DM-13 | Exercises | Defined | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | Defined | Defined | Managed | Managed | Managed | Managed | Managed | Managed | Managed | 1 | Items reach the target |
| Default | MP-31 | DM-14 | Recovery plans | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | 0 | At target now |
| Default | MP-32 | DM-14 | Recovery tested | Informal | Defined | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Defined | Informal | Defined | Defined | Defined | Defined | Defined | Defined | Managed | Managed | 2 | Items reach the target |
Lists
| Level | Answer | YesNo | Option | StatusList | DomainID | DomainName |
|---|---|---|---|---|---|---|
| Not in place | Not in place | Yes | A | In the roadmap | DM-01 | Governance and accountability |
| Informal | Informal | No | B | Candidate: needs a raised target | DM-02 | Policy |
| Defined | Defined | C | DM-03 | Risk management and exceptions | ||
| Managed | Managed | DM-04 | Third-party security | |||
| Not applicable | DM-05 | Legal and regulatory obligations | ||||
| DM-06 | Measurement and assessment | |||||
| DM-07 | Assets and information | |||||
| DM-08 | Vulnerabilities and patching | |||||
| DM-09 | Identity and access | |||||
| DM-10 | Awareness and training | |||||
| DM-11 | Protection of systems and data | |||||
| DM-12 | Detection and monitoring | |||||
| DM-13 | Incident response and notification | |||||
| DM-14 | Recovery and continuity |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Maturity | How reliably a security practice is done: whether it happens at all, whether it depends on particular people, whether it is written down and leaves a record, and whether it is measured, checked and improved. It describes how the practice works, not how exposed the organisation is today. |
| Level | One of the four levels of the scale: Not in place, Informal, Defined or Managed. The scale is P01-A09's, and P11 uses it too. |
| Not in place | The practice does not exist, or happens only by chance. |
| Informal | It happens, but depends on particular people and is not written down or not done consistently. |
| Defined | It is written down, agreed and done routinely, and leaves a record. |
| Managed | As Defined, and it is also measured, checked by someone else and improved. |
| Domain | One area of the security programme, such as risk management or identity and access, made up of two to three practices (DM-01 to DM-14). |
| Practice | One thing the programme does, stated as a question with the evidence each level needs (MP-01 to MP-32). Practices are what the assessor rates. |
| Domain level | The lowest level among a domain's practices that apply. One weak practice limits the domain, and an average would hide it (MA-06). |
| Target | The level management decides a domain should reach, set before the evidence is scored, with the reason for it (MA-09). |
| Gap | The number of levels between a domain's level and its target: 0 when the target is met, up to 3 (MA-10). |
| Pressing | Said of a practice on which a risk outside appetite, or an obligation the organisation has recorded as not met, rests. Its action takes priority (MA-11). |
| Action | The work that will move one practice up one level, with an owner, a due date and the evidence that will show it is done. |
| Re-assessment | Checking a practice again after its action closes, by someone other than the action's owner, to confirm the level moved (MA-18). |
| Roadmap item | One step on the roadmap: one practice moved up one level (MA-12), with an owner, a due date, an effort band and its external one-off cost. An improvement action from the tracker is an item; so is a second step the target needs after it. |
| Waits for | The item, or the work outside the roadmap, that must be done before this item can be. The item falls due on or after it. |
| Effort band | Small (S): up to 5 person-days; Medium (M): 6 to 20 person-days; Large (L): 21 to 60 person-days. Staff time, not money. |
| One-off cost | External spend to deliver an item: licences, services, contractors. 0 when the work is done in-house. Amounts in the examples are in euros (€); use your own currency. |
| Yearly cost | What an option adds to yearly budgets once in place. |
| Option | A set of items the approver can fund, with its one-off and yearly cost and what it leaves below target. An option may bring an item's date forward. |
| Expected level | The level a practice or domain will have by a quarter end if every item due by then closes on time and its re-assessment confirms the level (MA-18). A plan, not a result. |
| Quarter end | The last day of each calendar quarter after the roadmap's start date, up to its horizon. The first [[12]] months run to the next full assessment (MA-17). |
| Candidate | A later step, usually to Managed, that the roadmap shows but no option funds, because its domain's target is not yet raised. It becomes an item once the sponsor raises the target (MA-09), and says why it is a candidate. |
| With candidates | The recommended option's items at its dates, plus the candidates at theirs: what the levels would be if the targets were raised and the candidates funded. |
| Reaches target | The first quarter end by which a domain's expected level is at or above its target. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| MA-nn | The rules of the Security Maturity Model & Scoring Method, MA-01 to MA-19. MP-nn are its practices, DM-nn its domains, MAM-nn its headline measures, PH-n the phases of the Internal Security Assessment Procedure; MF-nn are the tracker's actions, RS-nn the second steps. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Its first assessment, ASM-2026-1. Clear the EXAMPLE before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 6.2 — Information security objectives and planning to achieve them | The roadmap as a whole: what will be done to reach each domain's target, the resources, who is responsible, when it will be done and how the result will be evaluated |
| NIST CSF 2.0 | ID.IM-01 — “Improvements are identified from evaluations” | Roadmap Items sheet: the improvements identified from the maturity assessment, sequenced by quarter |
| NIS2 — Directive (EU) 2022/2555 | Article 21(1) — appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems | The roadmap as a whole: the steps that make the risk-management measures work more reliably, sized to each domain's gap |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Applies to the providers its Article 1 names. For them, the Annex point below; for others, a useful guide only |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.1.3 — when identifying and prioritising risk treatment options and measures, take into account the risk assessment results, “the results of the procedure to assess the effectiveness of cybersecurity risk-management measures”, the cost of implementation in relation to the expected benefit, the asset classification and the business impact analysis | Options sheet: improvements prioritised from the results of the assessment of effectiveness, with each option's cost set against the levels it is expected to reach |
| DORA — Regulation (EU) 2022/2554 | Article 6(8)(c) — the strategy sets out “clear information security objectives, including key performance indicators and key risk metrics” | Domain Levels sheet, for financial entities: dated targets and expected levels that can inform the strategy's information security objectives |
| DORA — Regulation (EU) 2022/2554 | Article 13(4) — financial entities monitor the effectiveness of the implementation of their digital operational resilience strategy and map the evolution of ICT risk over time, “with a view to understanding the level of ICT risk exposure, in particular in relation to critical or important functions, and enhance the cyber maturity and preparedness of the financial entity” | Domain Levels sheet, for financial entities: the planned rise in maturity, checked each quarter against re-assessed levels |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 27(2) — the report on the review of the ICT risk management framework (DORA Article 6(5)) contains, among other things, an executive-level summary of the ICT risk profile, threat landscape, “the assessed effectiveness of its controls” and security posture; the date of the management body’s approval; the reason for the review; the function responsible; the findings, with an assessment of the severity of weaknesses, deficiencies and gaps; the measures to address them, with expected dates, responsible functions and resource impact; the criteria for accepting residual risk where gaps are not remedied; planned developments; and the state of corrective measures from past reviews | Roadmap Items and Options sheets, for financial entities: measures to address the gaps, with expected dates, responsible owners and resource impact, which the review report can draw on. The roadmap is not the review report |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.