Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Tools · Security Maturity & Internal Assessment

How mature is our security programme?

Practice by practice, from governance to recovery: rate 32 practices in 14 domains. You get each domain's level in words against its target, and every practice below target in the order to raise it, one level at a time. Free, no account, and nothing is stored.

Part 1 of 14 · 0 of 32 answered

Governance and accountability

Who is accountable for security, what management receives, and what it decides.

Choose the level the evidence supports on its face, then how it was evidenced. Told cannot give more than Informal; Managed needs Tested; a self-assessed result cannot be above Defined (MA-13, MA-14). Choose Not applicable only for a reason the sponsor approved (MA-08).

Target for Governance and accountability

The sponsor approves a target level for every domain before any evidence is scored, with a reason: an obligation that rests on it, a risk outside appetite, or a business need. Defined is the default target. Managed is a target only where one of those reasons asks for measurement and independent checking.

MP-01 Accountable person Is one person accountable for security, with the authority and time for it set in writing?
Defined needs
A role description or appointment, approved by management, that names the person accountable for security, their reporting line and their authority.
Managed adds
Their objectives are reviewed each year against results by the person they report to, and the role was changed at least once because of a review.

The level the evidence supports

How it was evidenced (MA-13)

What these mean

Told. Described in an interview, with nothing shown. Supports up to Informal.

Seen. A document or record was shown, and it says what the practice needs. Supports up to Defined.

Tested. The assessor chose a sample of records and checked each one against the practice. Supports up to Managed.

Self-assessed: rated by someone who owns or runs it (MA-14)?

Pressing: does a risk outside appetite, or an obligation recorded as not met, rest on it (MA-11)?

MP-02 Management reporting Does management receive security reporting at a set interval, and take decisions on it?
Defined needs
A security report to the board or its equivalent at least every quarter, and minutes that record the decisions taken on it.
Managed adds
The report's measures have targets, and the decisions and actions it leads to are tracked to closure and reported back.

The level the evidence supports

How it was evidenced (MA-13)

What these mean

Told. Described in an interview, with nothing shown. Supports up to Informal.

Seen. A document or record was shown, and it says what the practice needs. Supports up to Defined.

Tested. The assessor chose a sample of records and checked each one against the practice. Supports up to Managed.

Self-assessed: rated by someone who owns or runs it (MA-14)?

Pressing: does a risk outside appetite, or an obligation recorded as not met, rest on it (MA-11)?

MP-03 Security objectives Are security objectives set each year, with owners and dates?
Defined needs
Written security objectives for the year, approved by management, each with an owner, a date and how it will be measured.
Managed adds
Progress is reported at least each quarter, and an objective that will be missed leads to a recorded decision.

The level the evidence supports

How it was evidenced (MA-13)

What these mean

Told. Described in an interview, with nothing shown. Supports up to Informal.

Seen. A document or record was shown, and it says what the practice needs. Supports up to Defined.

Tested. The assessor chose a sample of records and checked each one against the practice. Supports up to Managed.

Self-assessed: rated by someone who owns or runs it (MA-14)?

Pressing: does a risk outside appetite, or an obligation recorded as not met, rest on it (MA-11)?

You can move on with questions unanswered. They are left out, never counted against you. Nothing is saved, so reloading the page starts again.

How this is worked out, and what it is not

  1. MA-06: A domain's level is the lowest level among its practices that apply. No average, no rounding.
  2. MA-07: There is no overall score, no percentage and no weighting. The result is each domain's level and target, in words, and the gap between them.
  3. MA-10: A domain's gap is its target level minus its current level, counted in levels. A domain at or above its target has no gap.
  4. MA-11: Every practice below its domain's target gets an action. Actions take priority first where a risk outside appetite, or an obligation the organisation has recorded as not met, rests on the practice; then the practice at the lower level; then the domain with the larger gap; then domain and practice order. Up to 5 actions take priority in one cycle.
  5. MA-12: A practice moves up one level per action. Managed can be claimed only after the practice has run at Defined, with records, for at least 6 months. A roadmap never plans a jump of two levels in one step.
  6. MA-13: Every result states how it was evidenced: Told, Seen or Tested. A level above Informal needs at least Seen; Managed needs Tested.
  7. MA-14: No one rates a practice they own or run (P08 IS-07). Where no independent assessor is available for a practice, the result is marked self-assessed and cannot be above Defined until someone independent checks the evidence.

Nothing here is scored out of 100 and there is no percentage. Results are in words and counts, and the questions, the levels and the rule are the workbook's: the same answers give the same result in both.

  • It is not an audit, a certification or a statement of compliance (MA-19).
  • A level says how reliably a practice works. It does not say how exposed the organisation is today (MA-01).
  • Self-assessed results and results evidenced only as Told are limits. Count them in the report (Maturity Assessment Report Template).
  • Results can be compared with an earlier assessment only when the practices, the scope and the evidence window are the same (MA-15).
From
Security Programme Maturity Assessment, version 1.2
Questions
32 practices · 14 domains