<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-capability-assessment
description: >-
  Conduct comprehensive security capability assessments using maturity
  models, gap analysis, benchmarking, readiness evaluations, and
  improvement planning across all security domains.
domain: cybersecurity
subdomain: security-leadership
tags:
  - capability-assessment
  - maturity-model
  - gap-analysis
  - benchmarking
  - readiness-evaluation
  - improvement-planning
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Capability Assessment

## Overview

Security capability assessment provides structured evaluation of an
organization's security posture across all domains. Covers maturity model
application, gap identification, peer benchmarking, and improvement planning.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Maturity framework | NIST CSF, C2M2, or CMMC criteria |
| Stakeholder access | Security and IT leadership interviews |
| Documentation | Existing policies, procedures, architecture |

## Key Concepts

### Capability Assessment Framework

```python
assessment_domains = {
    "governance": {"weight": 0.15, "functions": ["policy", "risk_management"]},
    "protection": {"weight": 0.20, "functions": ["access_control", "data_security"]},
    "detection": {"weight": 0.20, "functions": ["monitoring", "analytics"]},
    "response": {"weight": 0.20, "functions": ["incident_mgmt", "forensics"]},
    "recovery": {"weight": 0.10, "functions": ["continuity", "disaster_recovery"]},
    "supply_chain": {"weight": 0.15, "functions": ["vendor_risk", "software_supply"]},
}
```

## Workflow

1. **Scope assessment** — Define domains, depth, stakeholders
2. **Collect evidence** — Document review, interviews, testing
3. **Score maturity** — Rate domains against maturity criteria
4. **Identify gaps** — Compare current to target and benchmarks
5. **Prioritize improvements** — Risk-weighted remediation roadmap
6. **Present findings** — Executive summary with domain scorecards
7. **Track progress** — Reassess at defined intervals

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
