<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-security-program-maturity-assessment
description: >-
  Assess security program maturity using CMMI, NIST CSF, and C2M2 models to identify capability gaps, prioritize improvements, and track maturity progression over time.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - maturity-assessment
  - cmmi
  - nist-csf
  - c2m2
  - capability-maturity
  - program-assessment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Program Maturity Assessment

## Overview

Maturity assessments measure how well security processes are defined, managed, and optimized. This technique covers conducting assessments against industry maturity models, scoring capability domains, identifying improvement priorities, and building roadmaps to target maturity levels.

Mode: `[MODE: ARCHITECT]` — Security program maturity assessment and improvement planning.

## Prerequisites

| Requirement | Details |
|---|---|
| Maturity model selection | CMMI, NIST CSF tiers, or C2M2 |
| Program documentation | Policies, procedures, evidence |
| Python 3.10+ | For agent tooling |

## Workflow

### 1. Maturity Model Levels

```
CMMI-based security maturity:
├── Level 1 — Initial (Ad-hoc)
│   ├── Processes are unpredictable, reactive
│   ├── No formal documentation
│   └── Success depends on individual heroics
├── Level 2 — Managed (Repeatable)
│   ├── Basic processes established
│   ├── Some documentation exists
│   └── Reactive with some planning
├── Level 3 — Defined (Proactive)
│   ├── Processes standardized organization-wide
│   ├── Comprehensive documentation
│   └── Proactive risk management
├── Level 4 — Quantitatively Managed (Measured)
│   ├── Metrics-driven decision making
│   ├── KPIs and KRIs actively monitored
│   └── Process performance predictable
└── Level 5 — Optimizing (Continuous Improvement)
    ├── Continuous process optimization
    ├── Innovation and automation
    └── Industry-leading practices

NIST CSF Implementation Tiers:
├── Tier 1 — Partial: ad-hoc, limited awareness
├── Tier 2 — Risk Informed: risk-aware, not org-wide
├── Tier 3 — Repeatable: formal policy, org-wide
└── Tier 4 — Adaptive: lessons learned, continuous
```

### 2. Assessment Domains

```
Maturity assessment domains:
├── Governance & Strategy
│   ├── Security charter and policy framework
│   ├── Risk management program
│   └── Board/executive engagement
├── Risk Management
│   ├── Risk assessment methodology
│   ├── Risk register and treatment
│   └── Third-party risk management
├── Security Operations
│   ├── Incident detection and response
│   ├── Vulnerability management
│   └── Threat intelligence
├── Identity & Access Management
│   ├── Identity governance
│   ├── Privileged access management
│   └── Authentication mechanisms
├── Data Protection
│   ├── Data classification
│   ├── Encryption and key management
│   └── Data loss prevention
└── Resilience
    ├── Business continuity planning
    ├── Disaster recovery capabilities
    └── Crisis management
```

### 3. Improvement Roadmap

```
Roadmap structure:
├── Current state: Level 2.3 average (Managed)
├── Target state: Level 3.5 (Defined+) within 18 months
├── Priority improvements:
│   ├── Q1: Formalize incident response (2.0 → 3.0)
│   ├── Q2: Implement risk register (1.5 → 3.0)
│   ├── Q3: Deploy PAM solution (2.0 → 3.5)
│   └── Q4: Automate compliance monitoring (2.0 → 4.0)
├── Resource requirements:
│   ├── 2 FTE security engineers
│   ├── $500K tooling budget
│   └── Executive sponsorship
└── Success metrics:
    ├── Overall maturity score progression
    ├── Domain-level improvements
    └── Audit finding reduction
```

## Verification

- [ ] Process documented and approved
- [ ] Stakeholders identified and engaged
- [ ] Tooling configured and automated where possible
- [ ] Outputs reviewed and validated
- [ ] Reporting integrated into GRC program
- [ ] Periodic review schedule established
