Understanding maturity levels: from 0 to 5
“Implemented: yes or no” falls short in information security. Between “does not exist” and “works perfectly” there are several levels. A maturity model makes these levels visible and progress measurable – provided everyone involved understands it the same way.
Why maturity levels instead of yes/no
A yes/no rating only tells you whether something exists. It does not distinguish between a backup that “somehow runs” and one that is documented, regularly tested and continuously improved. For managing security, that difference is exactly what counts.
Maturity levels have three advantages:
- A finer statement: you see not only gaps but also how far a topic has already come.
- Realistic targets: instead of “implement everything” you define which level is appropriate per topic.
- Measurable progress: from year to year you can show which controls have moved up a level.
The scale from 0 to 5
In security audit mode (SEC) Audhive rates every control on six levels. The names are a default and can be adjusted under Admin › Settings › Master data.
- 0Non-existent
- 1Present but not documented or implemented
- 2Documented
- 3Reviewed
- 4Managed with KPIs
- 5Optimized
What the levels mean in practice is shown by an example – the control “backup”:
| Level | Meaning | Example: backup |
|---|---|---|
| 0 | Non-existent | There is no backup. |
| 1 | Present but not documented or implemented | Data is backed up, but without a defined approach; nobody knows exactly what is backed up and how often. |
| 2 | Documented | A backup concept defines scope, frequency, retention and owners. |
| 3 | Reviewed | Restore tests take place regularly and are recorded; deviations are fixed. |
| 4 | Managed with KPIs | KPIs such as backup success rate and restore time are evaluated against targets and reported. |
| 5 | Optimized | Lessons from tests, KPIs and incidents continuously feed into improvements. |
The levels build on each other. Level 3 assumes that there is something documented that can be reviewed. A control that is tested but described nowhere is therefore closer to level 1 than to level 3.
Other scales: the ICT Minimum Standard and other models
There are many maturity models. The ICT Minimum Standard rates each measure from 0 to 4 – from “not implemented” to “dynamic, implemented, continuously reviewed and improved” – and places the overall picture in four tier levels based on the Implementation Tiers of the NIST Cybersecurity Framework. Widely used models such as COBIT or CMMI also work with five or six levels.
The scales are similar but not identical: the ICT Minimum Standard combines definition and implementation in one level, while the Audhive scale separates documentation, review and management with KPIs. Values therefore cannot be converted one to one. What matters is to stick to one scale within an organisation – otherwise results are not comparable over the years. More on the standard’s scale in The ICT Minimum Standard for SMEs.
Rating consistently
The biggest weakness of maturity levels is arbitrariness: two people rate the same control differently. This can be avoided:
- Write down criteria per level. What has to be in place for a control to count as “documented” or “reviewed”? The expected documentation per control is a good starting point.
- Rate only what is proven. Intentions and plans do not count. What cannot be demonstrated gets the lower level.
- Note the reason. A short sentence on what the rating is based on makes it traceable for others – and for yourself next year.
- Calibrate. If several people rate, discuss a few controls together at the start to build a shared understanding.
- Separate design and effectiveness. A well-described control may still not work. Check both.
The right target: not level 5 everywhere
Level 5 for every control is neither realistic nor sensible. The effort for KPIs and continuous optimisation pays off where a failure would cause major damage. For many controls a documented and reviewed state – level 3 – is a solid target; levels 4 and 5 are reserved for the topics with the highest risk.
The ICT Minimum Standard also stresses that every organisation sets its own protection level based on its risk appetite. Record the target and justify it. The assessment then becomes a clear statement: where are we below target, and by how much?
Reading the results correctly
- Averages hide gaps. An average of 3 per function can include a control at level 0. Look at individual high-risk controls.
- Consider maturity and risk together. A low maturity level with low risk is less urgent than level 2 on a critical system.
- The trend counts. Comparing with the last assessment shows whether measures are working.
- Choose the right view. A radar chart with actual and target per topic shows at a glance where the largest gaps are.
Frequently asked questions
Can a control skip a level?
In the rating, yes; in substance, rarely. If you evaluate KPIs (level 4), you usually also have something documented and reviewed. If a foundation is missing, the lower level is usually the more honest rating.
How do I handle controls that do not apply?
Exclude them from scope with a reason instead of rating them 0 or 5. Otherwise they distort the averages.
Should I use the ICT Minimum Standard’s scale?
If you want to compare results with the standard’s assessment tool or with other organisations, yes. For internal management a finer scale can make sense. What matters is to stick to one scale.
How Audhive helps
In Audhive you rate the maturity level of each control, plus design, effectiveness and risk, and record findings and evidence. Dashboards show the maturity per policy or function against the target, each chart with an explanation of how it is calculated. More under Catalogues › Rating and Workflows.
Sources
- Federal Office for Cybersecurity (BACS): ICT minimum standards (page in German) – rating scheme and tier levels, version May 2023
- NIST: Cybersecurity Framework – Implementation Tiers