Security maturity

Most security maturity scales descend from the Capability Maturity Model developed at Carnegie Mellon's Software Engineering Institute for software processes, whose successor CMMI uses five levels: Initial, Managed, Defined, Quantitatively Managed and Optimizing. The logic carries over: level 1 means outcomes depend on individuals, level 2 that practices are planned and tracked at project or team level, level 3 that they are documented and standardised across the organisation, level 4 that they are managed with quantitative data, and level 5 that they are systematically improved. Process assessment standards in the ISO/IEC 33000 series, which replaced ISO/IEC 15504, and COBIT 2019 use comparable capability levels from 0 to 5.

Security-specific models vary in what they rate. The US Department of Energy's C2M2 uses maturity indicator levels MIL0 to MIL3 per domain; OWASP SAMM scores software assurance practices from 0 to 3; BSIMM is descriptive, reporting which activities other firms actually perform rather than prescribing levels. The NIST CSF Tiers (Partial, Risk Informed, Repeatable, Adaptive) are frequently used as a maturity scale, although NIST describes them as characterising the rigour of risk governance and management rather than as maturity levels. ISO/IEC 27001 has no maturity levels at all: a requirement is either conformed with or not, and maturity scoring is layered on top by assessors or by the organisation itself.

A useful distinction is between capability (can the process be performed reliably?) and effectiveness (does it reduce risk?). A well-documented, level-3 patch process that takes 60 days to close critical vulnerabilities is mature on paper and weak in practice, which is why maturity ratings should be paired with security metrics that measure outcomes.

Common pitfalls: averaging scores across domains hides a single critical weakness; self-ratings are inflated unless every level requires evidence; organisations set level 5 as a universal target when a risk-based target profile might call for level 2 in some domains and level 4 in others; and changes to the scale between assessments make year-on-year comparisons meaningless. Done well, a maturity assessment produces a gap between current and target levels per domain, a roadmap prioritised by risk, and a repeatable method so that the next assessment measures progress rather than a different assessor's opinion.