Cybersecurity Maturity Assessment

Governance & Policy

🪶

No formal security policies or ownership.

📜

Basic policies exist but are informal, limited approval or scope.

📘

Approved policies with defined roles; reviewed occasionally.

🏰

Enterprise-wide policy framework with regular reviews and metrics.

🦄

Policies integrated into business strategy; continuous improvement based on KPIs.

Risk Management

🎲

Ad-hoc or reactive; no risk register.

⚠️

Initial register exists; inconsistent assessments.

🧭

Periodic assessments with basic treatment plans.

📈

Formal methodology, risk owners, dashboards for leadership.

🧠

Continuous risk monitoring; scenarios drive investment decisions.

Identity & Access Management (IAM)

🧍‍♂️

Shared accounts, weak passwords, manual provisioning.

👨‍💻

Unique accounts, basic MFA in place for some users.

🧑‍🚀

MFA for privileged users; role-based access for core apps.

🔒

Centralized IAM, least-privilege, periodic access reviews.

🧬

Zero-Trust access, continuous verification and automated JML.

Vulnerability & Patch Management

🪛

No scanning; patching only after incidents.

🧱

Quarterly scans; manual patching for critical issues.

🧰

Monthly scans; SLAs for critical/high patches.

🔧

Continuous scanning; risk-based prioritization and metrics.

🤖

Continuous validation (BAS/DAST/SCA); automated remediation.

Incident Response

💤

No formal plan; improvised response.

🚨

Draft plan exists; limited roles or contact lists.

🧯

Approved plan; annual tabletop exercises.

🚒

24/7 procedures, playbooks, evidence handling and reporting.

🦾

Threat-led testing (purple team), continuous lessons-learned.

Security Monitoring & Detection

🙈

No centralized logging; alerts often missed.

👀

Basic SIEM/logging for critical systems.

🕵️‍♂️

Use-case driven detections and periodic tuning.

🛰️

24/7 monitoring (internal or MSSP) with KPIs/MTTD/MTTR.

👁️‍🔥

Threat intel + behavior analytics + automation/response.

Company Information (Optional)

Company Name

Email

Company Size

Cybersecurity Maturity Assessment 🛡️

🧭 Maturity Self-Assessment