<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: performing-security-program-review
subdomain: security-leadership
title: "Performing Security Program Review"
description: "Techniques and methodologies for performing security program review"
tags:
  - program-review
  - maturity-assessment
  - gap-analysis
  - NIST-CSF
  - continuous-improvement
metadata:
  mitre-attack: []
---

# Performing Security Program Review

> Conduct comprehensive reviews of security program effectiveness including maturity assessment, gap analysis, and improvement recommendations.

## Overview

Security program reviews provide a structured assessment of the overall security program's maturity, effectiveness, and alignment with organizational objectives. This technique covers maturity modeling, control effectiveness evaluation, and prioritized improvement planning.

## Core Concepts

- **Maturity modeling**: Assess capabilities against frameworks (NIST CSF, CMMI, C2M2)
- **Control effectiveness**: Measure whether implemented controls achieve their intended purpose
- **Gap analysis**: Identify discrepancies between current state and target maturity
- **Benchmarking**: Compare program maturity against industry peers
- **Improvement planning**: Prioritize remediation based on risk impact and feasibility

## Workflow

1. Define review scope and assessment framework (NIST CSF, ISO 27001)
2. Gather evidence: policies, procedures, metrics, audit reports
3. Conduct stakeholder interviews across security and business teams
4. Assess maturity level for each framework domain
5. Evaluate control effectiveness with testing and metrics
6. Perform gap analysis between current and target state
7. Benchmark against industry peers and regulatory expectations
8. Prioritize improvement recommendations by risk impact
9. Build improvement roadmap with resource estimates
10. Present findings to leadership with executive summary

## Implementation

```python
from dataclasses import dataclass, field
from typing import Optional


@dataclass
class MaturityDomain:
    name: str
    current_level: float  # 0-5 scale
    target_level: float
    evidence: list[str] = field(default_factory=list)
    findings: list[str] = field(default_factory=list)

    @property
    def gap(self) -> float:
        return round(self.target_level - self.current_level, 1)

    @property
    def gap_severity(self) -> str:
        g = self.gap
        if g <= 0:
            return "met"
        if g <= 1:
            return "minor"
        if g <= 2:
            return "moderate"
        return "critical"


class SecurityProgramReview:
    """Comprehensive security program maturity review."""

    def __init__(self, framework: str = "NIST CSF") -> None:
        self.framework = framework
        self.domains: list[MaturityDomain] = []

    def add_domain(self, domain: MaturityDomain) -> None:
        self.domains.append(domain)

    def overall_maturity(self) -> float:
        if not self.domains:
            return 0.0
        return round(sum(d.current_level for d in self.domains) / len(self.domains), 2)

    def critical_gaps(self) -> list[MaturityDomain]:
        return [d for d in self.domains if d.gap_severity in ("moderate", "critical")]

    def review_summary(self) -> dict:
        return {
            "framework": self.framework,
            "overall_maturity": self.overall_maturity(),
            "domains_assessed": len(self.domains),
            "critical_gaps": len(self.critical_gaps()),
            "domains_at_target": sum(1 for d in self.domains if d.gap <= 0),
        }

    def improvement_priorities(self) -> list[dict]:
        return sorted(
            [{"domain": d.name, "gap": d.gap, "severity": d.gap_severity} for d in self.domains if d.gap > 0],
            key=lambda x: x["gap"],
            reverse=True,
        )
```

## Best Practices

- Use an established framework (NIST CSF, ISO 27001) as the assessment baseline
- Gather evidence from multiple sources—don't rely solely on self-assessment
- Interview both security practitioners and business stakeholders for balanced view
- Present maturity scores as ranges, not precise numbers—false precision undermines credibility
- Focus improvement recommendations on highest-risk gaps first
- Conduct full program reviews annually with lightweight quarterly check-ins

## NIST CSF Function Coverage

| Function | Domains Assessed | Key Metrics | Maturity Indicators |
|---|---|---|---|
| Identify | Asset management, risk assessment, governance | % assets inventoried, risk register completeness | Automated discovery, risk scoring |
| Protect | Access control, data security, awareness, hardening | MFA coverage, patch SLA compliance, training completion | Zero-trust progress, configuration baseline |
| Detect | Monitoring, SIEM coverage, anomaly detection | ATT&CK coverage %, MTTD | Detection engineering maturity |
| Respond | IR plan, playbooks, exercises | MTTR, tabletop frequency | Automation rate, decision latency |
| Recover | BCP, DR testing, lessons learned | RTO/RPO compliance, test frequency | Recovery automation, runbook currency |

## Maturity Scale

| Level | Label | Characteristics |
|---|---|---|
| 1 | Initial | Ad-hoc, undocumented, reactive |
| 2 | Developing | Some processes defined, inconsistently applied |
| 3 | Defined | Documented, consistently applied, measured |
| 4 | Managed | Quantitative metrics, continuous improvement |
| 5 | Optimizing | Automated, predictive, industry-leading |

## Related Techniques

- [Implementing Security Risk Appetite Framework](../implementing-security-risk-appetite-framework/SKILL.md)
- [Implementing Security Roadmap Planning](../implementing-security-roadmap-planning/SKILL.md)
