Cybersecurity Maturity Model: Levels, Scoring and Next Steps
A cybersecurity maturity model measures how reliably and consistently your security practices work, not just whether they exist. Here is how the levels work and how to use them.
Key Takeaways
- Maturity measures consistency, not just coverage. A control that works only when one person remembers it sits at a low level.
- Most models use four or five steps, from ad hoc to continually improving, though the names and meanings differ by model.
- Higher is not always better. Choose a target level that fits your risk, size and budget.
- Score each area separately. Backups may be well managed while supplier oversight is still informal.
- Evidence beats opinion. Score what you can show, and reassess on a regular schedule.
A cybersecurity maturity model is a scale for judging how dependable your security practices are. Instead of asking whether you have a control, it asks how consistently that control is carried out, who owns it, whether it is measured and whether it improves over time. Most models use a ladder of levels that runs from informal and reactive at the bottom to measured and continually improving at the top.
For a UK SME, a maturity model answers practical questions. Where are we now? Where do we need to be, given our customers, insurers and sector? What should we fix first? It also gives directors a way to see progress without reading technical reports.
This article concentrates on levels, scoring and improvement. It does not walk through the frameworks themselves line by line. If you want an independent view of where you stand, our cyber security audit services provide one, and our managed IT support team can then carry the improvement work.
What maturity means in security
Maturity describes how well a practice is defined, followed and managed. Two businesses can both say they back up their data. In the first, an engineer runs a copy occasionally and nobody has tested a restore. In the second, backups run on a schedule, failures raise a ticket, restores are tested and results are reported to management. The control is the same; the maturity is very different.
That is why a maturity model is more useful than a simple yes-or-no checklist. A checklist tells you what is missing. A maturity score tells you how much you can rely on what is already there, and what it would take to rely on it more.
↑ Back to ContentsThe five common levels, from initial to optimised
Models word their steps differently, but many follow a pattern similar to the one below. Treat this as a general description rather than the definition used by any single model.
- Level 1, Initial: practices are ad hoc and depend on individuals. Outcomes vary and little is written down.
- Level 2, Repeatable: basic practices exist and are usually followed, but they are not consistent across teams or systems.
- Level 3, Defined: practices are documented, approved and applied consistently, with named owners.
- Level 4, Managed: practices are measured. You track coverage, failures and response times and act on the numbers.
- Level 5, Optimised: measurement feeds regular improvement, and the organisation adapts to new threats and business change.
Most small businesses will find a mix of levels across different areas. That is normal, and it is the reason to score each area on its own.
↑ Back to ContentsHow well-known models treat maturity
Several published models use levels, and they are not interchangeable. The summaries below cover only what each source says about its own levels, as at October 2026.
NIST Cybersecurity Framework tiers
NIST describes four implementation tiers, running from Partial (Tier 1) to Adaptive (Tier 4). NIST states that the tiers are not intended to be maturity levels; they describe how an organisation views cyber risk and how well its risk management is integrated with wider risk management. Moving up is encouraged where it reduces risk and is cost-effective. See the NIST Cybersecurity Framework basics.
CIS Implementation Groups
The Center for Internet Security sorts its Controls into IG1, IG2 and IG3, according to risk profile and resources. IG1 is the entry-level baseline described as essential cyber hygiene, IG2 adds further safeguards, and IG3 includes all Controls and Safeguards. CIS advises every organisation to start with IG1. Details are on the CIS Implementation Groups page.
CMMC levels
The US Department of Defense Cybersecurity Maturity Model Certification applies to defence contractors. Level 1 covers basic safeguarding of federal contract information and Level 2 covers broader protection of controlled unclassified information. It matters mainly if you supply into the US defence supply chain; see the Department of Defense CMMC overview.
C2M2
The Cybersecurity Capability Maturity Model, developed by the US energy sector, uses maturity indicator levels (MILs) per domain. It is free and any organisation may use it, though it was designed with energy and operational technology in mind.
NCSC Cyber Assessment Framework
The CAF does not use numbered levels. Assessors judge each outcome as achieved, partially achieved or not achieved, guided by indicators of good practice, and profiles define targets. The NCSC says its guidance is aimed at cyber security professionals, large organisations and the public sector, so most SMEs will use it only if a regulator or customer asks. See the NCSC CAF introduction.
ISO 27001 and Cyber Essentials
ISO 27001 does not define a numbered ladder; its concept of maturity is continual improvement of the management system, which an auditor tests through reviews and corrective actions. Cyber Essentials is better seen as a baseline than a maturity level: it checks that five core technical controls are in place. Our Cyber Essentials certification guide explains the process.
↑ Back to ContentsA simple five-level self-assessment for SMEs
Use the table to score each area on its own. Be strict: if you cannot show evidence, score the lower level.
| Level | What it looks like in practice | Typical evidence |
|---|---|---|
| 1 Initial | Done when someone remembers; no written process | None, or one person's knowledge |
| 2 Repeatable | Usually done, but methods differ between people or sites | Notes, tickets or screenshots |
| 3 Defined | Documented standard, named owner, applied to all in-scope systems | Policy, procedure, asset list |
| 4 Managed | Measured and reported; exceptions tracked and chased | Monthly coverage and failure reports |
| 5 Optimised | Reviewed after incidents and changes; improvements delivered | Post-incident reviews, trend data, completed actions |
Score at least these areas: asset visibility, patching, access and MFA, malware and endpoint protection, backup and recovery, staff awareness, incident response, supplier oversight and governance.
↑ Back to ContentsHow to score without fooling yourself
Self-assessment tends to flatter. A few habits keep the numbers honest.
- Score the weakest part. If patching is excellent on laptops but servers are patched irregularly, the area is not at the higher level.
- Ask for evidence. A report, log or ticket counts. A confident statement does not.
- Involve more than one person. Ask IT, a department head and someone from finance to score the same area, then discuss the gaps.
- Record the date. Scores are a snapshot, and they go stale as systems change.
An outside review adds a neutral view. A penetration test can also show whether controls scored highly on paper hold up in practice.
↑ Back to ContentsSetting a target level for your organisation
Level 5 everywhere is neither affordable nor necessary for most SMEs. A sensible target reflects what you would lose in an incident and what others expect of you.
- Customer and contract requirements. Public sector and larger corporate buyers often ask for specific certification. Our Cyber Essentials requirements checklist is a practical first step.
- Sensitivity of the data you hold. Client financial or health information justifies more rigour than marketing files.
- Operational dependence. The more quickly your business stops without a system, the higher the target for that system's protection and recovery.
- Resources. A target you cannot sustain is worse than a lower one you can.
Write the target down next to the current score so progress is visible to directors and to anyone who asks for assurance. A common pattern is level 3 for most areas and level 4 for the few that matter most, such as backup, access control and incident response.
↑ Back to ContentsBuilding a roadmap to the next level
Aim to move each weak area up one level at a time. Trying to lift everything at once usually stalls, because the same few people end up doing the work and the documentation never gets finished.
The jump from level 1 to level 3 is usually about writing down and applying a standard; level 3 to 4 is about measuring it.
- List the gaps between current and target score, area by area.
- Rank by risk and effort. Fix cheap, high-impact gaps first, such as enforcing MFA or testing a restore.
- Assign an owner and a date to every action, and keep the plan short enough to finish in a quarter.
- Train people. Awareness is often the lowest-scoring area. Our guide on training employees on cybersecurity awareness gives a practical starting point.
- Reassess every six to twelve months, and after any major incident or change.
Smaller organisations can find the work easier to start with a clear baseline; our cybersecurity for small business page outlines the controls most often needed first.
↑ Back to ContentsConclusion: use a cybersecurity maturity model to focus effort
A cybersecurity maturity model turns a vague question, "are we secure enough?", into a scored, evidence-based picture with a clear next step. Score each area strictly, choose a target that fits your risk and resources, and move up one level at a time. The published models differ in what their levels mean, so pick one scale, use it consistently and state which one you are using, as at October 2026.
If you would like an independent score and a prioritised plan, contact NetMonkeys.
↑ Back to ContentsFrequently Asked Questions (FAQs)
What is a cybersecurity maturity model?
A cybersecurity maturity model is a scale that rates how consistently and reliably an organisation carries out its security practices. Levels typically run from ad hoc and informal at the bottom to measured and continually improving at the top. It helps you see where you are, set a target and plan improvements in a sensible order.
How many levels does a cybersecurity maturity model have?
It depends on the model. Many use four or five steps, such as initial, repeatable, defined, managed and optimised. NIST describes four implementation tiers but says they are not intended as maturity levels. CMMC has levels tied to the type of information protected. Always check what the specific model's levels mean.
Is Cyber Essentials a maturity level?
Not strictly. Cyber Essentials is a government-backed baseline that checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. It is a sensible starting point, and many organisations treat it as the floor before working towards a more structured, measured approach.
What level should a small business aim for?
There is no single answer. Many SMEs do well to aim for documented, consistently applied practices across all areas, and a more measured approach for the few that carry the most risk, such as backup, access control and incident response. Customer contracts, insurer requirements and the sensitivity of your data should set the target.
How often should we reassess our maturity?
Every six to twelve months is a reasonable rhythm, plus after any significant incident, acquisition, system change or move to new suppliers. Scores only describe a point in time, so an assessment older than a year may no longer reflect how your systems and people actually work.
Do we need an external assessor to use a maturity model?
No, you can start with an internal self-assessment, and it is worth doing. An external reviewer adds a neutral view and often spots gaps that insiders overlook. Some customer or regulatory schemes do require independent assessment, so check the rules that apply to your contracts.
Speak to a NetMonkeys specialist
Practical, plain-English IT advice for UK businesses, from our Manchester headquarters and our teams in London and Nottingham.
Book a conversation
