<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Security Maturity Assessment

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js assess --framework sans --evidence evidence/` | Run maturity assessment |
| `node agent.js gap-analysis --current-level 2 --target-level 4` | Perform gap analysis |
| `node agent.js roadmap --gaps gaps.json --timeline 18m` | Generate improvement roadmap |
| `node agent.js benchmark --industry healthcare --size mid-market` | Benchmark against industry peers |

### Examples

```bash
# Primary workflow
node agent.js assess --framework sans --evidence evidence/

# Secondary analysis
node agent.js gap-analysis --current-level 2 --target-level 4

# Generate deliverable
node agent.js roadmap --gaps gaps.json --timeline 18m

# Measure and report
node agent.js benchmark --industry healthcare --size mid-market
```

## External Tools

| Tool | Command | Purpose |
|---|---|---|
| SANS Maturity Model | `reference` | Five-level maturity framework |
| Survey tool | `surveymonkey --create assessment-survey` | Stakeholder assessment surveys |
| Excel/Sheets | `export-csv maturity-data.csv` | Assessment data collection |

## SANS Security Awareness Maturity Model

| Level | Name | Description |
|---|---|---|
| 1 | Non-Existent | No awareness program |
| 2 | Compliance-Focused | Annual checkbox training |
| 3 | Promoting Awareness | Regular content and simulations |
| 4 | Long-Term Behavior Change | Continuous reinforcement, culture shift |
| 5 | Metrics Framework | Data-driven optimization, executive reporting |
