Security Maturity Assessment: 10 Domains, 5 Levels (Free)

You can't improve what you can't measure

Every security leader has been in this meeting: the CEO asks "how mature is our security program?" and the room goes quiet. You know it's better than it was last year, but you don't have a structured way to prove it. You can't point to a score, show a trend, or benchmark against peers.

That's the maturity measurement gap. And it's not just an optics problem — it's an operational one. Without a clear picture of where your program stands across every domain, you're allocating budget on gut feel, prioritizing the wrong initiatives, and leaving gaps you don't know about.

This framework gives you a structured, repeatable way to assess your security program across 10 domains, score it on a consistent scale, and turn the results into an actionable improvement plan. Whether you're a CISO building an internal program or a vCISO managing multiple clients, this model works.

Why maturity matters more than compliance

Compliance tells you whether you meet a specific set of requirements at a point in time. Maturity tells you how capable your program is — how well it can adapt, scale, and respond to new threats. You can be fully compliant with SOC 2 and still have a deeply immature security program if every control is manual, every policy is stale, and every evidence artifact is collected the week before the audit.

Maturity is the difference between a security program that survives audits and one that actually protects the business. If you're still figuring out what GRC means and why it matters, start there — then come back to measure how well you're executing on it.

The 10 domains of security program maturity

Each domain represents a critical function of a complete security program. For each domain, we define four maturity levels so you can honestly assess where you stand today — not where you hope to be.

Domain 1: Governance

Governance is the foundation. It defines who makes security decisions, how authority flows, and whether leadership is engaged in security outcomes.

Level 1 — Ad Hoc: No formal security governance structure exists. Security decisions are made reactively by whoever happens to be available.
Level 2 — Basic: A security leader is identified and basic responsibilities are assigned, but governance is informal and inconsistent.
Level 3 — Structured: A formal governance committee meets regularly, roles and responsibilities are documented, and security has a seat at the executive table.
Level 4 — Optimized: Governance is fully integrated into business decision-making with defined risk appetite, automated reporting to leadership, and continuous oversight mechanisms.

Domain 2: Risk Management

Risk management is how you identify, assess, and treat the threats that could impact your organization. Without it, you're playing defense without knowing where the offense is coming from.

Level 1 — Ad Hoc: Risks are identified reactively, usually after an incident. No formal risk register exists.
Level 2 — Basic: A risk register exists but is updated infrequently, scoring is inconsistent, and risk owners are loosely defined.
Level 3 — Structured: Risks are scored consistently using a defined methodology, owners are assigned, and the register is reviewed on a regular cadence.
Level 4 — Optimized: Risk scoring is data-driven with automated feeds from integrations, risk trends are tracked over time, and the register dynamically reflects changes in the threat landscape.

For a deeper dive on building this domain from scratch, see our guide on building a risk register that actually gets used.

Domain 3: Compliance

Compliance is the practice of aligning your controls to external frameworks and proving that alignment through evidence.

Level 1 — Ad Hoc: No formal compliance program exists. Regulatory requirements are addressed only when a customer or auditor demands it.
Level 2 — Basic: One framework is partially mapped, but evidence collection is manual, sporadic, and driven by audit deadlines.
Level 3 — Structured: Multiple frameworks are mapped with cross-framework control alignment, evidence is collected on a defined schedule, and gaps are tracked systematically.
Level 4 — Optimized: Evidence collection is automated through integrations, cross-framework mapping eliminates duplicate effort, and compliance posture is monitored continuously in real time.

Domain 4: Policy Management

Policies are the documented rules that define how your organization approaches security. Without them, controls have no foundation and auditors have nothing to evaluate.

Level 1 — Ad Hoc: Policies are informal or nonexistent. Employees follow unwritten conventions that vary across teams.
Level 2 — Basic: Core policies exist (acceptable use, data handling, incident response) but are rarely reviewed, inconsistently distributed, and not tracked for acknowledgment.
Level 3 — Structured: A complete policy library is maintained with version control, annual review cycles, and employee acknowledgment tracking.
Level 4 — Optimized: Policies are generated and updated with AI assistance, mapped to specific controls and frameworks, and automatically distributed with acknowledgment workflows that feed into compliance evidence.

Domain 5: Evidence Collection

Evidence is the proof that your controls actually work. It is the bridge between what your policies say and what your operations do.

Level 1 — Ad Hoc: Evidence is collected manually, usually in a panic before an audit. Screenshots are taken ad hoc and stored in random folders.
Level 2 — Basic: An evidence checklist exists and is followed before audits, but collection is still manual and time-consuming.
Level 3 — Structured: Evidence is collected on a defined schedule, organized by control, and stored in a centralized vault with expiration tracking.
Level 4 — Optimized: Evidence flows automatically from integrated tools, maps itself to controls across multiple frameworks, and triggers alerts when artifacts approach expiration.

Domain 6: Incident Response

Incident response is your organization's ability to detect, contain, and recover from security events. The maturity of this domain is often only tested under fire — which is exactly why you need to measure it proactively.

Level 1 — Ad Hoc: No incident response plan exists. When incidents occur, response is improvised by whoever notices the problem first.
Level 2 — Basic: A documented incident response plan exists but has never been tested. Roles are loosely defined and communication channels are unclear.
Level 3 — Structured: The incident response plan is tested through tabletop exercises at least annually, roles are clearly assigned, and post-incident reviews drive improvements.
Level 4 — Optimized: Incident detection is automated through SIEM and SOAR integration, response playbooks are rehearsed quarterly, and metrics like MTTD and MTTR are tracked and trended.

Domain 7: Vendor Risk Management

Your security is only as strong as your weakest vendor. Vendor risk management ensures that third parties with access to your data or systems meet your security standards.

Level 1 — Ad Hoc: No vendor risk process exists. Third parties are onboarded without security review.
Level 2 — Basic: Critical vendors are assessed during onboarding using questionnaires, but there is no ongoing monitoring or reassessment.
Level 3 — Structured: All vendors are classified by risk tier, assessed on a defined cadence, and tracked in a centralized vendor inventory with certification expiration monitoring.
Level 4 — Optimized: Vendor risk assessments are automated with questionnaire workflows, certification status is monitored continuously, and vendor risk feeds directly into the organization's risk register.

Domain 8: Security Awareness

People are both your biggest vulnerability and your strongest control. Security awareness measures how well your organization educates and tests its workforce.

Level 1 — Ad Hoc: No formal security awareness program exists. Employees receive no training beyond an initial onboarding mention.
Level 2 — Basic: Annual security awareness training is conducted, but it is generic, checkbox-style, and not measured for effectiveness.
Level 3 — Structured: Role-based training is delivered quarterly, phishing simulations are run regularly, and completion rates are tracked as compliance evidence.
Level 4 — Optimized: Training content adapts based on employee risk profiles and phishing simulation results, metrics drive continuous program improvement, and security culture is measured through behavioral analytics.

Domain 9: Monitoring and Detection

Monitoring is the operational capability to see what's happening across your environment in real time and detect anomalies before they become incidents.

Level 1 — Ad Hoc: No centralized monitoring exists. Threats are discovered by end users reporting symptoms or by external notification.
Level 2 — Basic: Basic logging is enabled on critical systems, but logs are reviewed infrequently and there is no correlation or alerting.
Level 3 — Structured: A SIEM or centralized logging platform aggregates logs from key sources, detection rules are tuned, and alerts are triaged by a defined process.
Level 4 — Optimized: Detection engineering is a formal discipline with coverage metrics, automated enrichment, and continuous tuning based on threat intelligence and incident post-mortems.

Domain 10: Reporting

Reporting is how you communicate the state of your security program to leadership, the board, clients, and regulators. It's the domain that translates technical work into business language.

Level 1 — Ad Hoc: Reporting is informal or nonexistent. Leadership has no visibility into security posture.
Level 2 — Basic: Periodic reports are generated manually, usually as slide decks assembled before board meetings, with limited data and inconsistent formats.
Level 3 — Structured: Reporting follows a standard format, is generated on a regular cadence, and includes key metrics like risk posture, compliance status, and incident trends.
Level 4 — Optimized: Reports are generated automatically from live program data, tailored to different audiences (board, executive, operational), and include trend analysis and actionable recommendations.

For guidance on the board reporting domain specifically, see our detailed guide on how to present security to the board.

How to score your program

Each domain is scored from 1 to 4 based on the maturity levels above. Your total score across all 10 domains gives you a composite maturity score on a 10-40 scale. This composite maps to five overall maturity levels:

Composite Score	Maturity Level	Label
10-15	Level 1	Reactive
16-20	Level 2	Foundational
21-27	Level 3	Established
28-34	Level 4	Advanced
35-40	Level 5	Optimized

How to assess honestly: For each domain, read the four level descriptions and pick the one that most accurately describes your current state — not your aspirational state, not where you were last month, and not where you'll be after that project wraps up. The value of this exercise is in honesty, not in getting a high score.

What your maturity level means

Level 1 — Reactive (Score 10-15)

Your security program is in survival mode. Controls exist only where absolutely necessary, processes are informal, and most activity is driven by incidents or urgent customer requests. Next steps: Focus on governance and risk management first. Assign a security owner, build a basic risk register, and adopt a single compliance framework. You need a foundation before you can build anything on top of it.

Level 2 — Foundational (Score 16-20)

The basics are in place, but everything is manual and inconsistent. You have policies, a risk register, and maybe one framework mapped — but evidence is collected before audits, not continuously, and reporting is reactive. Next steps: Standardize your processes. Implement a GRC platform to centralize your program, set review cadences for risks and policies, and begin automating evidence collection from your most critical integrations.

Level 3 — Established (Score 21-27)

You have a real security program. Processes are documented, risks are managed systematically, and compliance is more than a checkbox exercise. The main gaps are in automation and advanced capabilities. Next steps: Invest in automation and integration. Connect your security tools to your GRC platform for automated evidence collection, implement continuous monitoring, and build structured reporting that generates from live data rather than manual assembly.

Level 4 — Advanced (Score 28-34)

Your program is running well. Automation handles routine tasks, evidence flows continuously, and leadership has real-time visibility into security posture. You're likely managing multiple frameworks efficiently. Next steps: Focus on optimization and metrics. Track trend data across all domains, benchmark against industry peers, build predictive risk models, and ensure your program can scale with the business without proportional headcount increases.

Level 5 — Optimized (Score 35-40)

You have a best-in-class security program. Every domain is automated or structured, governance is deeply integrated into business operations, and your security program is a competitive advantage — not just a cost center. Next steps: Maintain and evolve. Share your approach with industry peers, contribute to framework development, mentor less mature organizations, and continuously adapt to emerging threats and regulatory changes. The risk at this level is complacency — keep pushing.

Using maturity as a management tool

A maturity assessment is not a one-time exercise. Run it quarterly or semi-annually to track progress, justify budget requests, and demonstrate value to leadership. When you can show the board that your program moved from Level 2 to Level 3 in six months — and tie specific investments to specific domain improvements — you've turned security from a cost center into a measurable business function.

For vCISOs managing multiple clients, maturity assessments are an especially powerful tool. They provide a standardized way to compare client programs, prioritize engagement activities, and demonstrate measurable progress in every quarterly business review.

Take the assessment

Stop guessing where your program stands. Take the free Security Program Maturity Assessment at radius360.co/tools/security-maturity — 10 questions, instant score, no signup required.

How to Measure Security Program Maturity: A 10-Domain Framework