What is a cybersecurity maturity assessment?

A cybersecurity maturity assessment evaluates how well an organisation's security capabilities are defined, implemented, measured and improved, scored against the levels of a published model such as the NIST CSF 2.0 tiers, CIS Controls implementation groups, C2M2 or CMMC 2.0. The deliverable is a current profile per domain, a target profile and a roadmap between them. It measures capability and repeatability, not whether a specific attack would succeed today.

How is a maturity assessment different from a security audit?

An audit tests conformity to a standard such as ISO 27001, SOC 2 or PCI DSS and produces a pass, a certificate or a list of nonconformities at a point in time. A maturity assessment grades how capable and repeatable each domain is on a multi-level scale and tells you where to invest next. You can be certified and still immature in detection and response, which is why most programmes run both.

Which maturity model should a US company use?

Use the one your regulators and customers recognise. NIST CSF 2.0 with its four tiers is the default for most US enterprises and fits SEC disclosure framing; CIS Controls v8.1 implementation groups suit organisations that want a concrete control ladder; CMMC 2.0 is mandatory for Department of Defense contractors; C2M2 fits energy and OT-heavy operators. ISO 27001 is a certification, not a maturity model, and is layered with a tier scale where needed.

Is ISO 27001 certification the same as high security maturity?

No. ISO 27001 certifies that an information security management system conforms to the standard; it does not grade how effectively the 93 Annex A controls operate. A certified organisation can sit at a low maturity tier in detection, response or supplier risk. Treat certification as a floor and use a maturity model to measure the programme above it.

How long does a cybersecurity maturity assessment take?

Four to eight weeks of calendar time for a mid-size enterprise, covering evidence review, twelve to twenty stakeholder interviews, control sampling, scoring calibration and reporting. Your team's effort is a few days in total. Add two to three weeks when a penetration test is run against the same scope to validate the scores.

How often should maturity be reassessed?

Annually, with a lighter progress review at six months against the roadmap. Reassess outside the cycle after a serious incident, a merger or acquisition, a new CISO, a major cloud migration or a regulator's request. Keep the same model and scoring sheets so that each year is a measured delta rather than a new baseline.

Why pair a maturity assessment with a penetration test?

Because a maturity model scores what is documented and described, and a penetration test shows what actually holds under attack. Testing the assessed scope catches the gap between a control's intent and its operating state, which is where self-assessments inflate. The combination gives the board a defensible trend and the security team a test programme aimed at real risk.

2 November 2026 · 11 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)

Cybersecurity maturity assessment: what it measures, which model to use and how to turn the result into a roadmap the board will fund

A cybersecurity maturity assessment scores how repeatable, measured and governed your security capabilities are, against a recognised model, and turns the gaps into a prioritised roadmap. This guide explains how it differs from an audit, a penetration test and a posture scan, which model fits which organisation, how an assessment runs, and how offensive testing keeps the score honest.

Scope a maturity assessment

What a cybersecurity maturity assessment is

A cybersecurity maturity assessment is a structured evaluation of how well an organisation's security capabilities are defined, implemented, measured and improved, scored against the levels of a published maturity model. It answers a different question from most security work. A penetration test asks whether an attacker can get in today. An audit asks whether you comply with a standard. A maturity assessment asks whether your programme is built to keep working: are controls documented, owned, repeatable, monitored and adjusted when the business or the threat changes? The output is a profile per domain (governance, identity, asset management, detection, response, recovery, supplier risk), a target profile, and the roadmap between the two.

The term is used interchangeably with security posture assessment and cyber maturity assessment. The distinction that matters is with a cyber risk assessment. A risk assessment inventories threats and vulnerabilities to specific assets and estimates likelihood and impact; it is tactical and asset-centric. A maturity assessment is capability-centric and strategic. Most organisations need both, and mature programmes link them: the risk register says where the exposure is, the maturity profile says whether the organisation has the capability to manage it.

Boards and audit committees commission assessments when a regulator or customer asks how mature the programme is, after an incident, before a transaction, when a new CISO arrives, or when the security budget needs a defensible basis. In the US, the SEC's 2023 cybersecurity disclosure rules (Regulation S-K Item 106) require public companies to describe their risk management processes and board oversight in the annual report, and a maturity profile is the most common way to give that description substance. In the EU, NIS2 Article 20 makes management bodies accountable for approving and overseeing cybersecurity risk-management measures, and DORA Article 5 places the same duty on the management of financial entities.

Maturity assessment vs audit vs penetration test vs posture scan

Four exercises that are regularly confused, and regularly bought in the wrong order.

Aspect	Maturity assessment	Audit	Penetration test	Posture scan
Question answered	How capable and repeatable is the programme, and where should it go next?	Do controls meet a defined standard, with evidence, at a point in time?	Can a skilled attacker reach a defined objective, and how?	Which known weaknesses and misconfigurations are exposed right now?
Reference	A maturity model: NIST CSF 2.0 tiers, CIS Controls implementation groups, C2M2, CMMC levels	A standard or regulation: ISO 27001, SOC 2, PCI DSS, NIS2, HIPAA	Attacker tradecraft, MITRE ATT&CK, OWASP, PTES	Vulnerability databases, CIS Benchmarks, cloud provider baselines
Method	Interviews, document review, control sampling, scoring workshops	Evidence testing against each requirement, sampling, auditor judgement	Manual exploitation by testers, chained findings	Automated scanning of hosts, cloud accounts, identities and external surface
Output	Scored profile per domain, target profile, roadmap, board summary	Opinion, certificate or attestation, list of nonconformities	Report with exploited findings, attack narrative, CVSS scores, remediation	List of findings with severity, often thousands, little context
Who performs	Security consultants, often with a vCISO or governance background	Accredited certification body or licensed CPA firm	Certified offensive testers (OSCP, OSWE, CREST)	Internal team or managed scanning service
Cadence	Annually, or at a trigger: new CISO, incident, transaction, regulator request	Annual surveillance, recertification every three years	Annually, plus after major change	Continuous or weekly
Blind spot	Self-reported answers inflate scores unless validated technically	Compliance is not security; a certified ISMS can still be breached	Shows exploitability, not whether the programme can sustain the fixes	Finds the known; misses logic flaws, attack chains and process failures

The maturity models in use in 2026

Choose the model your regulators, customers and board already recognise. Switching models later resets your baseline.

NIST Cybersecurity Framework 2.0

Released in February 2024, CSF 2.0 organises outcomes in six functions: Govern, Identify, Protect, Detect, Respond and Recover. Its four tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorously risk is governed and managed. NIST states that the tiers are not maturity levels in the strict sense and that Tier 4 is not a universal goal; most US assessments nonetheless use them as the scoring scale, combined with current and target profiles.

CIS Controls v8.1 and implementation groups

Eighteen controls and 153 safeguards, split into three implementation groups. IG1 (56 safeguards) is essential cyber hygiene for every organisation; IG2 adds safeguards for organisations with dedicated IT staff and sensitive data; IG3 completes the set for organisations facing targeted attacks. The groups form a practical maturity ladder, and the 2024 v8.1 update aligned the controls with the Govern function of CSF 2.0.

C2M2 (Cybersecurity Capability Maturity Model)

Maintained by the US Department of Energy, version 2.1 covers ten domains and scores each at maturity indicator levels 0 to 3, from ad hoc practices to managed, documented and resourced ones. Built for energy and other operators of operational technology, and borrowed by other sectors because its practices are concrete and its self-evaluation tool is public.

CMMC 2.0

The US Department of Defense model for contractors handling federal contract information and controlled unclassified information. Level 1 covers 17 practices with an annual self-assessment; Level 2 maps to the 110 requirements of NIST SP 800-171 with third-party assessment every three years for most contractors; Level 3 adds requirements from NIST SP 800-172 with government-led assessment. Phased into DoD contracts from late 2025.

ISO/IEC 27001:2022: a certification, not a maturity model

ISO 27001 certifies that an information security management system conforms to the standard; the result is binary. It does not grade how well the 93 Annex A controls perform. Organisations that want a maturity view of their ISMS layer a tier scale on top, usually borrowed from CSF 2.0 or from ISO/IEC 33000-style process capability levels, and use ISO/IEC 27004 for measurement.

Sector and national baselines

US sectors add their own layers: the HHS 405(d) Health Industry Cybersecurity Practices for healthcare, the Cyber Risk Institute Profile for financial institutions (the FFIEC retired its own Cybersecurity Assessment Tool in 2025) and NYDFS Part 500 for New York licensees. In the Netherlands, the BIO 2.0 baseline for government bodies and the NCSC's basic measures serve the same purpose.

How an assessment runs

A credible assessment takes four to eight weeks of calendar time and a few days of your team's attention. These are the steps.

1. Scoping and model selection

Agree the organisational boundary (entities, sites, cloud tenants, OT), the model and tier scale, and who the result is for. A board summary and an engineering roadmap need the same evidence but different framing.

2. Document and evidence collection

Policies, standards, risk register, asset inventory, architecture diagrams, previous audit and penetration test reports, incident records, vendor contracts. The assessor reads these before any interview, so interviews test claims rather than collect them.

3. Stakeholder interviews

Structured interviews with the CISO, IT operations, identity and access owners, application owners, the SOC or MDR provider, legal and privacy, HR and procurement. Twelve to twenty interviews is typical for a mid-size enterprise.

4. Control sampling and technical validation

Checking that what is described is what is deployed: MFA configuration, EDR coverage, backup restore tests, logging retention, privileged account inventories. This step separates an assessment from a questionnaire, and it is where offensive findings are brought in.

5. Scoring and calibration

Each domain is scored against the model's levels, with the evidence that justifies the score. Calibration sessions with your team resolve disputes before the report, so the result is owned rather than received.

6. Target profile and gap analysis

The target tier per domain is a business decision, not a default. A payments company needs Adaptive detection and response; its facilities function may be fine at Repeatable. The gap between current and target drives the roadmap.

7. Roadmap, quick wins and report

Initiatives sequenced in waves with owners, dependencies, effort and the maturity gain each delivers, plus a board-level summary and a technical appendix your engineers can work from.

What the output looks like

Ask to see a redacted sample before you commission. A good deliverable contains the following.

A heat map per domain and sub-category showing current and target maturity on one page, in the model's own vocabulary
Scored findings with the evidence behind each score, so the next assessment measures movement rather than opinion
Quick wins: changes achievable within 90 days with existing staff and budget, typically MFA gaps, logging retention, privileged account clean-up and backup restore testing
A roadmap in waves of six to twelve months, each with owners, dependencies, indicative effort and the maturity gain it buys
Mapping of every finding to the frameworks you report against: SOC 2 criteria, ISO 27001 Annex A, NIS2 Article 21(2) measures, DORA, HIPAA, PCI DSS v4.0.1
A two-page board summary: where you are, where peers in your sector sit, the top five risks, and what the roadmap costs in effort and what it buys
A re-assessment baseline: scoring sheets and evidence index in a format you own, so year two is a delta rather than a restart

Using the result for budget and board conversations

A maturity profile converts security spend from a list of tools into a narrative of capability. Instead of asking for an EDR renewal, the CISO shows that Detect sits at Risk Informed while the target is Repeatable, that two initiatives close the gap, and what each costs in effort. Boards respond to that framing because it mirrors how they evaluate every other function. The same profile answers the disclosure obligations now in force: the SEC's Item 106 description of risk management and governance, NIS2 Article 20 management accountability, DORA Article 5, and NYDFS Part 500.4, which requires the CISO to report in writing to the board at least annually on the cybersecurity programme and its material risks.

Two cautions. Do not set Tier 4 or Level 3 as the universal target; over-investing in domains that carry little business risk is as much a governance failure as under-investing in those that do. And do not let the assessment become a self-assessment. Internal teams score themselves one level higher than external assessors do in nearly every engagement we have seen, not from dishonesty but from knowing the intent of a control rather than its operating state.

How offensive testing validates the self-assessment

The weakness of every maturity model is that it scores what people say and document. Offensive testing scores what actually happens. A penetration test against the assessed scope checks whether the Protect tier claimed for identity and access survives a password spray and a token theft; whether the Detect tier claimed for the SOC produces an alert when a tester moves laterally; whether Respond is Repeatable or a wiki page nobody has opened. We fold the findings from a scoped penetration test or red-team engagement into the scoring step, so a domain cannot score Repeatable on paper when the tester walked through it unnoticed.

The reverse also holds. A maturity assessment tells the offensive team where to aim. Domains scored low are confirmed quickly; domains scored high are where a red team earns its fee by testing the claim. Organisations that pair the two every year get a maturity trend they can defend to a regulator, and a testing programme that follows actual risk rather than last year's scope. The guide on types of security testing explains how those engagements differ and how they combine.

How HackersHub runs maturity assessments

HackersHub is an Amsterdam-based offensive-security firm with more than ten years of experience, serving enterprise clients in the EU and the US through remote delivery and on-site travel where needed. Our security consulting practice runs maturity assessments against NIST CSF 2.0, CIS Controls v8.1, CMMC 2.0 and ISO 27001:2022, with the Dutch BIO and NIS2 baselines for European clients, and validates the scoring with testers who hold OSCP as a minimum, with OSWE and CREST-certified specialists on the team.

Every assessment is scoped individually: entities, cloud tenants, OT and the frameworks you report against. You receive the heat map, the scored evidence, the roadmap and the board summary, in a format you own for next year's re-assessment. Where a client wants the score tested, we pair the assessment with a penetration test or red-team engagement against the same scope.

Frequently asked questions

Related guides

Want a maturity score your board can trust?

Our consulting practice runs the assessment, and our testers validate it against the same scope. Talk to an expert about the model your regulators expect and the roadmap your budget cycle needs.

Explore security consulting Schedule a call