Current state
What the evidence supports
Observed practices, control coverage and evidence confidence.
Evidence for investment decisions
Cybersecurity Maturity Assessment: Know What to Fund Next
Give leadership an evidence-backed baseline and your team a clear investment plan. Our cybersecurity maturity assessment services connect current and target maturity, business risk and a prioritized improvement roadmap. Typically delivered in 4–8 weeks, with scope and schedule agreed before work begins.
Start with a 30-minute scoping call.
When to assess
A baseline for the decision ahead.
A cyber maturity assessment helps security leaders, IT teams and business stakeholders agree what matters next.
- A new CISO or IT leader needs an objective baseline.
- The board or audit committee wants a clear view of security maturity.
- The budget cycle needs a risk-based investment case.
- An insurance renewal or customer questionnaire is approaching.
- An acquisition, integration or ownership change needs security due diligence.
- A certification initiative, incident or near miss has exposed program gaps.
Framework and scoring
A shared basis for current and target maturity.
NIST CSF 2.0 is our default. We agree the assessment criteria and scoring rubric before reviewing evidence.
A security maturity assessment separates documented intent from operating evidence. Each domain receives a current-state assessment and a target agreed with leadership; missing evidence and assumptions remain visible.
We can align to CIS Controls v8, ISO/IEC 27001:2022, NIST SP 800-53, C2M2 or your internal control framework. Any requirements crosswalk is defined in scope.
NIST CSF Tiers describe risk governance and management practices. They are separate from maturity scores and are not a certification.
NIST CSF 2.0 referenceTarget state
What leadership needs
Agreed outcomes based on risk appetite and business priorities.
Improvement gap
What to change next
Actions sequenced by risk, ownership, effort and dependencies.
A five-level maturity rubric
We agree domain-specific evidence criteria before applying this scale. These are maturity ratings, not NIST CSF Tiers.
Initial
Practices are largely ad hoc.
Managed
Responsibilities and repeatable activities are established.
Defined
Documented practices are applied consistently.
Quantitatively managed
Measures inform control performance and decisions.
Optimizing
Evidence drives continuous improvement.
Assessment scope
Coverage across all six NIST CSF functions.
Govern
Strategy, risk appetite, accountability, policy, supplier oversight and resourcing.
Identify
Asset inventory across cloud and SaaS, risk assessment and data classification.
Protect
Identity, MFA, privileged access, data protection, configuration, application security and awareness.
Detect
Logging, monitoring, detection coverage and security operations responsibilities.
Respond
Incident plans, playbooks, tabletop readiness, escalation and communications.
Recover
Backup integrity, ransomware resilience, business continuity, recovery and lessons learned.
Scope can also address AI governance and shadow AI using NIST AI RMF and ISO 42001, cloud and SaaS sprawl, and third-party risk. Review boundaries and depth are agreed before the engagement.
Engagement and effort
Typically 4–8 weeks, with a clear work plan.
Nominate a project sponsor, a coordinator and the relevant control owners. We agree interview commitments and evidence requests up front; timing depends on scope and availability.
Illustrative eight-week schedule. Stages overlap or compress for a four-week engagement; final timing depends on scope and evidence availability.
Scoping and kickoff
Objectives, boundaries, framework, stakeholders and evidence request.
Evidence review
Policies, configurations, reports, tickets and existing metrics.
Stakeholder interviews
Structured interviews across security, IT, legal, HR and the business.
Scoring and validation
Domain scoring, validation workshop and risk-ranked gaps.
Roadmap and readout
Prioritized roadmap, executive briefing and board summary.
Engagement outputs
Deliverables your team can act on.
Executive summary and board briefing
A decision-focused view of program strengths, material gaps and investment priorities for non-technical leadership.
Current and target maturity scorecard
Domain scores and a heat map with the assessment criteria, evidence basis and leadership-agreed targets.
Risk-ranked gap register
Findings linked to business impact, likelihood, evidence limitations and remediation dependencies.
Prioritized improvement roadmap
A 12–24 month planning view with 30/60/90-day actions, proposed owners and indicative effort or cost bands, adjusted to your priorities.
Applicable requirements crosswalk
Findings mapped to the requirements agreed in scope, such as SOX ITGC, HIPAA, PCI DSS, NYDFS 500, CMMC or SEC cyber disclosure obligations.
Leadership and security team readout
A workshop to review conclusions, challenge assumptions, agree priorities and establish the next steps.
Optional remediation support and reassessment at 6 or 12 months can be scoped separately.
Report format preview
See how evidence becomes a decision.
Illustrative format only. This preview contains no customer data, assessment results or promised scores.
Executive decision brief
Assessment boundary, key strengths, material gaps and recommended investment decisions.
Current versus target scorecard
Each domain shows its agreed rubric, evidence-backed current rating, target rating and the reason for the gap.
Gap and action record
- Evidence
- Control records, owner interviews and identified limitations.
- Business impact
- The affected service, exposure and decision required.
- Next action
- Proposed owner, dependency, effort band and completion evidence.
Practitioner-led assessment
Practical judgment behind the findings.
Assessment leadership brings hands-on GRC, HITRUST certification-cycle and SOX ITGC experience, alongside NIST AI RMF and ISO 42001 implementation and work in ITAR and air-gapped environments.
We do not resell security tools. Recommendations are based on your program and priorities. AI-assisted evidence analysis supports the review, with expert judgment on every finding.
Confidentiality is part of scoping.
An NDA is standard. Before evidence collection, we agree approved transfer methods, access, storage, retention and deletion arrangements, including restrictions for sensitive environments.
Frequently asked questions
Plan the engagement with confidence.
How long does an assessment take, and what does our team need to contribute?
A typical engagement takes 4–8 weeks. Scope, evidence availability and stakeholder access affect the schedule. Plan for a sponsor, a coordinator and interviews with control owners; interview commitments are agreed during scoping.
Which framework and scoring model do you use?
NIST CSF 2.0 is our default framework. We can align to CIS Controls v8, ISO/IEC 27001:2022, NIST SP 800-53, C2M2 or your internal framework. We agree the scoring rubric and evidence criteria before assessment, then compare current and leadership-agreed target maturity by domain. NIST CSF Tiers are separate from maturity scores.
How is a cybersecurity maturity audit different from penetration testing or a compliance audit?
A cybersecurity maturity audit evaluates how the security program operates and improves. Penetration testing validates exploitable technical weaknesses; a compliance audit evaluates specified requirements. A maturity assessment informs improvement and does not issue certification.
Can the engagement be remote, onsite or hybrid?
Delivery arrangements, interview format and any onsite access are agreed during scoping to match your environment and evidence restrictions.
How is pricing determined?
The proposal defines the fee, scope and deliverables after the initial discussion. Organizational boundaries, framework coverage, evidence volume and delivery arrangements inform the proposal.
How do you protect evidence and findings?
An NDA is standard. We agree approved transfer methods, access, storage, retention and deletion arrangements before evidence collection. Restricted or air-gapped environments require an agreed handling approach.
Can we share the results with our board, auditors or insurer?
The executive summary and briefing materials support leadership discussions. Intended recipients and confidentiality restrictions are agreed in the engagement terms. An external party determines whether the report meets its own assurance requirements.
Do you help with remediation and reassessment?
The roadmap identifies actions, proposed owners, dependencies and effort or cost bands. Follow-on remediation support and a 6- or 12-month reassessment can be scoped separately.
Start an assessment
Discuss Your Assessment
Tell us the decision driving your assessment, your preferred framework and any evidence-handling constraints. Start with a 30-minute scoping call.