Overview
Knowing where your security program actually stands is the first step toward improving it. This self-assessment helps you score your organization across 10 security domains using one maturity scale. It is built for CISOs and security leaders who need an honest internal view of strengths, gaps, and priorities without waiting for an external audit to surface the problems.
If you already report against NIST Cybersecurity Framework 2.0, you can tag each domain with the matching CSF function. Note that the CSF's four Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorously risk is governed rather than how mature a single control area is, so treat any mapping between the two scales as approximate.
Security Domains Covered
- Governance, risk, and compliance (GRC)
- Identity and access management (IAM)
- Endpoint security and device management
- Network security and segmentation
- Cloud security posture
- Data protection and classification
- Application security (SDLC and AppSec)
- Security operations and monitoring
- Incident response and recovery
- Third-party and supply chain risk management
Maturity Scoring Scale
| Level | Description | Indicators |
|---|---|---|
| 1: Initial | Ad hoc, reactive, undocumented | No formal policies, firefighting mode, tribal knowledge |
| 2: Developing | Some processes defined but inconsistently applied | Partial documentation, manual workflows, limited metrics |
| 3: Defined | Documented policies and repeatable processes | Written procedures, assigned ownership, basic monitoring |
| 4: Managed | Processes measured and actively managed | KPIs tracked, regular reviews, risk-based decisions |
| 5: Optimizing | Continuous improvement with automation and feedback loops | Automated controls, advanced analytics, proactive posture |
Sample Scoring Questions per Domain
| Domain | Question to answer | Evidence that supports level 3 or higher |
|---|---|---|
| Governance and compliance | Is there an approved security policy with a named owner and a review date? | Signed policy, review record |
| Identity and access | Is MFA enforced for all staff, and are privileged accounts reviewed each quarter? | Identity provider policy, review tickets |
| Endpoint | Do all company devices run endpoint protection and receive patches within a set time? | Device management report |
| Network | Are production and corporate networks separated, with rules reviewed? | Network diagram, firewall review record |
| Cloud | Is cloud configuration checked continuously against a baseline? | Posture tool report or scheduled checks |
| Data protection | Do you know where sensitive data lives, and is it classified? | Data inventory, classification policy |
| Application security | Is code reviewed and scanned before release? | Pipeline configuration, review records |
| Security operations | Are alerts from key systems monitored with defined response times? | Alert routing, on-call rota |
| Incident response | Has the incident response plan been exercised in the last 12 months? | Exercise report and actions |
| Third-party risk | Are critical vendors assessed before onboarding and reviewed on a schedule? | Vendor register with assessment dates |
Running the Assessment
Assign a domain owner for each of the 10 areas. Each owner should review their domain independently, score it honestly, and provide supporting evidence for the rating. Bring the group together for a calibration session where scores are discussed and adjusted based on peer input. This prevents both sandbagging and overconfidence. Document the rationale behind each score so you can track progress over time.
Scoring Worksheet with a Filled Example
| Domain | Score | Main reason | Owner | Target in 12 months |
|---|---|---|---|---|
| Identity and access | 2 | MFA on email only; no privileged access reviews | IT lead | 4 |
| Cloud | 3 | Baseline checks weekly, findings fixed by hand | Platform lead | 4 |
| Incident response | 2 | Plan written but never exercised | CISO | 3 |
| Third-party risk | 1 | No vendor register | Procurement and security | 3 |
| Data protection | 3 | Inventory complete for production systems only | Data owner | 3 |
Calibration Session Agenda
- Ten minutes: restate the scale and agree that evidence beats opinion
- Forty minutes: each owner presents score, evidence, and the main reason in two minutes
- Twenty minutes: challenge round; any score without evidence drops one level
- Twenty minutes: pick the three gaps with the highest business risk
- Ten minutes: assign an owner, a sponsor, and a 90-day goal to each of the three
How to Read the Filled Example
The worksheet above is illustrative. It shows why the lowest score is not always the first priority. Third-party risk scores 1, but if the company relies on few vendors, the identity gap at level 2 may matter more because every attack path runs through accounts. Write the main reason for each score in one line; next time you assess, that line tells you whether the gap was closed or simply rescored.
Translating Results into Action
After scoring, identify domains where your maturity level creates the most business risk. A level-2 identity program in an organization with remote workers and cloud infrastructure is a bigger concern than a level-2 physical security program in a fully remote company. Prioritize remediation based on business impact, not just low scores. Build a 90-day improvement plan for the top three gaps and assign executive sponsors to ensure accountability.
Benchmarking and Cadence
Repeat this assessment every six months. Track scores over time to measure improvement and demonstrate progress to the board and auditors. Compare your results against industry benchmarks when available. Organizations in regulated industries like financial services or healthcare should aim for level-4 maturity across all domains within 18 to 24 months of starting the program.