Skip to content
ENExplore Calculators

Governance Maturity Calculator

Score security governance maturity across eight dimensions on a 1–5 CMMI-style scale, with the weakest dimension and a roadmap estimate.

About Governance Maturity Calculator

The dimensions are unweighted because governance is a system: strong policy with no measurement produces documents nobody checks, and good measurement with no resourcing produces reports nobody can act on. Spread is reported alongside the average since a programme at 4, 4, 4, 1 behaves like its lowest dimension in practice, not like its mean of 3.25. Maturity scores are what boards and regulators use to compare year on year, and the dimension breakdown is what turns a score into a plan. It is a self-assessment producing management estimates, not an appraisal against any formal maturity model.

Formula

Governance Maturity

Maturity = unweighted mean of the eight dimension levels on the 1–5 scale; the gap is target − mean, and roadmap length ≈ 9 months per level plus 2 months per level of spread.

1–5
Initial, Managed, Defined, Measured, Optimising
spread
Highest dimension minus lowest, a measure of how lopsided the programme is
roadmapMonths
Indicative elapsed months, not effort

Worked example

With the default values below, Governance Maturity Calculator returns Governance Maturity of 2.75. Change any input above and every figure here is recalculated in your browser.

Inputs used

Strategy and policy frameworkone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
3 — Defined
Organisation, roles and accountabilityone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
3 — Defined
Risk management processone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
3 — Defined
Compliance and obligations managementone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
2 — Managed
Performance measurement and KPIsone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
2 — Managed
Board and committee reportingone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
3 — Defined
Awareness and trainingone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
4 — Measured
Resourcing and budgetone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
2 — Managed
Target maturity levelone of 1 — Initial, 2 — Managed, 3 — Defined, 4 — Measured, 5 — Optimising
4 — Measured

Results

Governance Maturity
2.75 of 5
Share of the Maximum Level
55.0%
Gap to Target Level
1.25 levels
Spread Across Dimensions
2 levels
Indicative Roadmap Length
16 months
Current Level
Level 2 — Managed: repeatable in places, still reactive
Weakest Dimension
Compliance and obligations management
Strongest Dimension
Awareness and training
Balance Note
Slightly uneven — level up the laggard before deepening the leaders

Step by step

  1. 1Values used
  2. 2Governance Maturity
  3. 3Governance Maturity= 2.75 of 5
  4. 4Share of the Maximum Level= 55.0
  5. 5Gap to Target Level= 1.25 levels
  6. 6Spread Across Dimensions= 2 levels
  7. 7Indicative Roadmap Length= 16 months
  8. 8Current Level= Level 2 — Managed: repeatable in places, still reactive

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Governance Maturity calculated?

Maturity = unweighted mean of the eight dimension levels on the 1–5 scale; the gap is target − mean, and roadmap length ≈ 9 months per level plus 2 months per level of spread. The dimensions are unweighted because governance is a system: strong policy with no measurement produces documents nobody checks, and good measurement with no resourcing produces reports nobody can act on. Spread is reported alongside the average since a programme at 4, 4, 4, 1 behaves like its lowest dimension in practice, not like its mean of 3.25.

Why does Governance Maturity matter?

Maturity scores are what boards and regulators use to compare year on year, and the dimension breakdown is what turns a score into a plan. It is a self-assessment producing management estimates, not an appraisal against any formal maturity model.

What values do I need to enter?

This calculator takes 9 inputs: Strategy and policy framework, Organisation, roles and accountability, Risk management process, Compliance and obligations management, Performance measurement and KPIs, Board and committee reporting, Awareness and training, Resourcing and budget, Target maturity level. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should every organisation target level 5?

No. Level 5 costs real money to sustain and only pays back where the risk justifies it; most organisations should aim for a solid 3 across the board and 4 in the dimensions that carry their biggest risks. A uniform level 3 is a stronger position than an average of 4 with one dimension at 1.

Why does spread add to the roadmap estimate?

Because levelling up an uneven programme means doing several different kinds of work in parallel — writing policy, hiring, building measurement — and those compete for the same scarce attention. An even programme can move on one front at a time.

Related Calculators

Governance Maturity Calculator | Calcrivo