0 / 24

Model 42 of 74 · Cybersecurity

Enterprise Security Maturity Assessment

Assess your organisation's security maturity across governance, identity, detection, incident response, and culture.

Pillars & areas

Govern

Establish the rules

  1. 01Governance & Risk Management
  2. 02Identity & Access Control

Detect

Spot the threats

  1. 03Detection & Monitoring
  2. 04Incident Response & Recovery

Protect

Shield the assets

  1. 05Data & Asset Protection
  2. 06Security Culture & Awareness

Levels

  1. 1ExposedRespond after the fact
  2. 2DefendedDefined & consistent
  3. 3ResilientContinuously refined

01 Governance & Risk Management

Does the organisation treat cybersecurity as a business risk with clear ownership, funding, and oversight?

0/4 answered

GR-1How is cybersecurity accountability structured in your organisation?

Think about whether there is a named person responsible for cybersecurity outcomes, and whether they have authority and budget.

GR-2How does your organisation identify and prioritise cybersecurity risks?

Consider whether you maintain a register of security risks, or whether risks are only discussed after something goes wrong.

GR-3How does your organisation manage cybersecurity policies?

Think about whether written policies exist, whether staff know about them, and whether anyone checks compliance.

GR-4How does your organisation assess the cybersecurity posture of third parties and suppliers?

Consider whether you evaluate the security of vendors who have access to your data or systems before and during the relationship.

02 Identity & Access Control

Does the organisation control who can access what, and can it prove it?

0/4 answered

IA-1How does your organisation manage user accounts and access rights?

Think about whether access is granted based on job role, and whether old accounts are cleaned up when people leave or change roles.

IA-2How does your organisation protect privileged accounts (admin, root, service accounts)?

Consider whether admin accounts are shared, whether their use is monitored, and whether there are extra controls around them.

IA-3How does your organisation handle authentication across its systems?

Think about whether multi-factor authentication is used, and whether users manage dozens of separate passwords.

IA-4How does your organisation control access to sensitive data and critical systems?

Consider whether you know which systems hold your most sensitive data, and whether access to them has extra controls.

03 Detection & Monitoring

Can the organisation see what is happening in its environment and spot threats before they cause damage?

0/4 answered

DM-1How does your organisation collect and manage security logs?

Think about whether logs from key systems are collected centrally, or whether each system keeps its own logs that nobody reviews.

DM-2How does your organisation detect malicious or anomalous activity?

Consider whether you rely on users reporting problems, or whether automated systems alert you to threats.

DM-3How does your organisation manage vulnerabilities in its systems?

Think about whether you scan for vulnerabilities regularly, and whether findings are actually fixed within a reasonable timeframe.

DM-4How does your organisation test its own defences?

Consider whether anyone regularly tries to break in (with permission) to find weaknesses before attackers do.

04 Incident Response & Recovery

Can the organisation respond effectively when a security incident occurs and restore operations quickly?

0/4 answered

IR-1Does your organisation have a documented incident response plan?

Think about whether there is a written plan people can follow during a security incident, or whether the response is improvised each time.

IR-2How does your organisation practise its incident response capability?

Consider whether the plan has been tested in a realistic exercise, or whether the first real test will be an actual incident.

IR-3How does your organisation handle communication during a security incident?

Think about who is told what, how quickly, and whether there are pre-prepared messages for regulators, customers, and staff.

IR-4How does your organisation recover from security incidents and learn from them?

Consider whether systems can be restored quickly, and whether anything changes after an incident to prevent recurrence.

05 Data & Asset Protection

Does the organisation know what it needs to protect and apply appropriate safeguards?

0/4 answered

DA-1How well does your organisation maintain an inventory of its IT assets?

Think about whether you have a current, accurate list of all hardware, software, and cloud services in your environment.

DA-2How does your organisation protect data at rest and in transit?

Consider whether sensitive data is encrypted on laptops, in databases, and when sent over networks.

DA-3How does your organisation protect its endpoints (laptops, desktops, mobile devices)?

Think about whether devices are hardened to a standard build, or whether each machine is configured differently.

DA-4How does your organisation handle backup and recovery of critical data?

Consider whether backups are tested regularly, stored securely, and whether you could actually restore them under pressure.

06 Security Culture & Awareness

Do people across the organisation understand their role in keeping the organisation secure?

0/4 answered

SC-1How does your organisation deliver security awareness training?

Think about whether training is a once-a-year checkbox exercise, or whether it genuinely changes how people behave.

SC-2How easy is it for staff to report a security concern or suspected incident?

Consider whether people know exactly how to report something suspicious, and whether they feel safe doing so.

SC-3How does your organisation test whether staff can recognise social engineering attacks?

Think about whether you run phishing simulations or other social engineering tests, and what happens with the results.

SC-4How embedded is security thinking in everyday business decisions?

Consider whether security is only brought in at the end of projects, or whether teams naturally consider security implications in their work.

Self-assessment report

Enterprise Security

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Enterprise Security maturity model

Cybersecurity maturity is not about how many tools you own or how large your security team is. It is about how deeply security is woven into the way your organisation thinks, operates, and responds to threats. The least mature organisations treat security as a technical afterthought — something bolted on after the fact. The most mature treat it as a business discipline: governed, measured, tested, and continuously improved.

This model deliberately avoids reproducing existing compliance frameworks. Instead, it asks practical questions about observable behaviours — how access is managed, how incidents are handled, how risks are governed, and whether people across the organisation understand their role in keeping things secure. The goal is not to generate a compliance score, but to surface the gaps between what an organisation believes it does and what actually happens day to day.

The Cybersecurity maturity model assesses six areas that together span people, process, and technology. It is designed to be accessible to organisations of any size, from small teams with no dedicated security function to large enterprises with mature security operations. Each question describes three levels of maturity through concrete, observable behaviours rather than abstract capability statements.

The assessment produces an honest snapshot of where your organisation stands today. It highlights areas of strength and, more importantly, areas where a security incident would find you unprepared. It is not a substitute for a formal risk assessment or compliance audit, but it is a fast, practical way to start the conversation about what needs to improve and where to invest next.

Who this assessment is for

  • CISOs, security managers, and IT leaders seeking a quick maturity benchmark
  • Risk and compliance teams looking to identify security capability gaps
  • Business leaders who want to understand cybersecurity posture without deep technical knowledge
  • Consultants and advisors conducting initial security assessments for clients
  • Small and mid-sized organisations without a dedicated security team who need a starting point

The three maturity levels

  • Level 1 — Exposed: Security is dealt with after incidents occur. Controls are informal, inconsistent, and dependent on individual effort rather than organisational process. The organisation cannot confidently describe its risk posture, and gaps are discovered through failures rather than proactive assessment. Security responsibility is diffuse — everyone assumes someone else is handling it.
  • Level 2 — Defended: Security practices are defined, documented, and applied consistently. The organisation has dedicated security ownership, maintains a risk register, and operates defined controls across its environment. Incidents are handled through a documented plan, staff receive regular training, and vulnerabilities are managed through a systematic process. The organisation knows what it has, who can access it, and how it would respond to a breach.
  • Level 3 — Resilient: Security is continuously refined based on threat intelligence, incident lessons, and performance data. The organisation anticipates emerging risks and adapts its controls accordingly. Detection is behavioural and around-the-clock, offensive testing validates defences regularly, and security thinking is embedded into everyday business decisions. Recovery is rehearsed and automated where possible. The security function operates as a strategic partner to the business, not a cost centre.

The 6 areas assessed

1. Governance & Risk Management

How cybersecurity is owned, funded, and governed at an organisational level. This area examines whether security is treated as a business risk with executive visibility, or as an IT operational concern that receives attention only after something breaks. It covers accountability structures, risk identification, policy management, and third-party risk.

2. Identity & Access Control

How the organisation manages who can access what, and whether it can prove that access is appropriate. This area covers user lifecycle management, privileged access, authentication strength, and controls around sensitive data and systems. Poor access control is consistently one of the most exploited attack vectors — this area assesses whether the basics are in place and enforced.

3. Detection & Monitoring

Whether the organisation can see what is happening in its environment and identify threats before they cause significant damage. This area covers log management, threat detection, vulnerability management, and offensive testing. An organisation that cannot detect an attacker in its environment is one that will only learn about breaches from external parties — or from the attacker themselves.

4. Incident Response & Recovery

How the organisation responds when a security incident occurs and how quickly it can restore normal operations. This area assesses whether there is a tested plan, whether communication is handled effectively, and whether the organisation learns from incidents to prevent recurrence. The difference between a minor security event and a catastrophic breach often comes down to the speed and quality of the response.

5. Data & Asset Protection

Whether the organisation knows what it needs to protect and applies appropriate safeguards. This area covers asset inventory, encryption, endpoint protection, and backup resilience. You cannot protect what you do not know you have — and you cannot recover what you have not backed up.

6. Security Culture & Awareness

Whether people across the organisation understand their role in keeping things secure. This area examines training quality, reporting ease, social engineering resilience, and whether security thinking is embedded in everyday decisions. Technology controls fail when people bypass them — a strong security culture is the control that scales across every team and every decision.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

  • NIST Cybersecurity Framework (CSF) 2.0 — a comprehensive, function-based framework for managing cybersecurity risk
  • CIS Controls v8 — a prioritised set of safeguards organised by implementation group
  • CMMC 2.0 — the US Department of Defense cybersecurity maturity model for contractors
  • Essential Eight — the Australian Cyber Security Centre's baseline mitigation strategies
  • ISO/IEC 27001 — the international standard for information security management systems

Frequently asked questions

What is the Enterprise Security maturity model?

Assess your organisation's security maturity across governance, identity, detection, incident response, and culture. It is an original, simplified model with three maturity levels (Exposed, Defended and Resilient), assessed through 24 questions across 6 areas: Governance & Risk Management, Identity & Access Control, Detection & Monitoring, Incident Response & Recovery, Data & Asset Protection and Security Culture & Awareness.

How long does the Enterprise Security assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Exposed), 2 (Defended) or 3 (Resilient). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.