<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-security-benchmarking
description: >-
  Benchmark security program performance against industry peers, maturity
  frameworks, and best-practice standards to identify improvement areas,
  justify investments, and track progress over time.
domain: cybersecurity
subdomain: security-leadership
tags:
  - benchmarking
  - maturity-assessment
  - peer-comparison
  - security-metrics
  - program-evaluation
  - industry-standards
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Benchmarking

## Overview

Security benchmarking compares program performance against external standards
and peer organizations to identify gaps, validate investments, and set
realistic improvement targets. Effective benchmarking uses multiple frameworks
and normalizes for industry and company size.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Maturity assessment data | Current program scores |
| Industry benchmark reports | Peer comparison data |
| Framework mappings | CIS, NIST CSF, ISO 27001 crosswalks |
| Historical metrics | Trend analysis baseline |

## Key Concepts

- **Maturity scoring**: Quantitative assessment against framework levels
- **Peer normalization**: Adjust benchmarks for industry and company size
- **Gap-to-peer**: Distance between current state and industry median
- **Investment efficiency**: Security spend per employee vs. outcomes
- **Trend analysis**: Progress over time against fixed benchmarks

## Workflow

### Step 1: Select Benchmark Frameworks

```python
BENCHMARK_FRAMEWORKS = {
    "nist_csf": {
        "categories": ["identify", "protect", "detect", "respond", "recover"],
        "scoring": "1.0-4.0 tier scale",
    },
    "cis_controls": {
        "categories": ["ig1", "ig2", "ig3"],
        "scoring": "implementation_percentage",
    },
    "iso_27001": {
        "categories": ["annex_a_controls"],
        "scoring": "implemented / total controls",
    },
}
```

### Step 2: Collect and Normalize Scores

```python
def normalize_benchmark(
    raw_scores: dict,
    framework: str,
    industry: str,
    company_size: int,
) -> dict:
    """Normalize benchmark scores for peer comparison."""
    industry_medians = {
        "technology": {"nist_csf": 2.8, "cis_ig1": 0.92},
        "financial": {"nist_csf": 3.2, "cis_ig1": 0.97},
        "healthcare": {"nist_csf": 2.4, "cis_ig1": 0.85},
    }
    median = industry_medians.get(industry, {}).get(framework, 2.5)
    return {
        "framework": framework,
        "raw_score": raw_scores.get(framework, 0),
        "industry_median": median,
        "gap_to_median": median - raw_scores.get(framework, 0),
        "percentile": "estimated_from_distribution",
    }
```

### Step 3: Generate Benchmark Report

```bash
node agent.js assess --frameworks nist_csf,cis_controls --industry technology
node agent.js compare --current scores.json --peer-data industry_benchmarks.json
node agent.js report --format executive --include-trends
```

## Verification

| Check | Method |
|---|---|
| Frameworks assessed | All selected frameworks scored |
| Peer data current | Benchmark data within 12 months |
| Normalization valid | Industry and size adjustments applied |
| Trends accurate | Year-over-year comparison consistent |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [CIS Controls v8](https://www.cisecurity.org/controls)
- [ISO 27001](https://www.iso.org/standard/27001)
