<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-maturity-assessment
description: >-
  Perform security awareness maturity assessments using the SANS Security
  Awareness Maturity Model, CMM-based frameworks, gap analysis, and roadmap
  generation to advance organizational security culture.
domain: cybersecurity
subdomain: security-awareness
tags:
  - maturity-assessment
  - sans-model
  - gap-analysis
  - roadmap
  - benchmarking
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Maturity Assessment

## Overview

Security maturity assessments evaluate where an organization stands on the security
awareness maturity spectrum and chart a path to improvement. Using the SANS Security
Awareness Maturity Model and CMM-based frameworks, this skill covers assessment
methodology, stakeholder interviews, evidence collection, gap analysis, and
roadmap generation with prioritized initiatives.

## Prerequisites

| Requirement | Install |
|---|---|
| SANS Maturity Model | Five-level maturity framework reference |
| Stakeholder access | Interviews with security, HR, IT, and business leaders |
| Evidence collection | Training records, policies, metrics, survey data |

## Commands

| Command | Description |
|---|---|
| `node agent.js assess --framework sans --evidence evidence/` | Run maturity assessment |
| `node agent.js gap-analysis --current-level 2 --target-level 4` | Perform gap analysis |
| `node agent.js roadmap --gaps gaps.json --timeline 18m` | Generate improvement roadmap |
| `node agent.js benchmark --industry healthcare --size mid-market` | Benchmark against industry peers |

## Workflow

### Step 1 — Assess Current State

Evaluate existing capabilities and identify gaps before implementing changes.

```bash
# Run assessment with agent tooling
node agent.js assess --framework sans --evidence evidence/
```

### Step 2 — Plan and Design

Define objectives, scope, timeline, and success criteria.

```bash
# Plan implementation
node agent.js gap-analysis --current-level 2 --target-level 4
```

### Step 3 — Execute and Deliver

Implement the planned activities and deliver outputs.

```bash
# Execute delivery
node agent.js roadmap --gaps gaps.json --timeline 18m
```

### Step 4 — Measure and Optimize

Track results against success criteria and iterate.

```bash
# Measure results
node agent.js benchmark --industry healthcare --size mid-market
```

## Verification

- [ ] Prerequisites validated and tools installed
- [ ] Assessment of current state completed
- [ ] Implementation plan documented and approved
- [ ] Execution completed per plan
- [ ] Results measured against defined KPIs
- [ ] Findings documented and next steps identified
