Score security governance maturity across eight dimensions on a 1–5 CMMI-style scale, with the weakest dimension and a roadmap estimate.
The dimensions are unweighted because governance is a system: strong policy with no measurement produces documents nobody checks, and good measurement with no resourcing produces reports nobody can act on. Spread is reported alongside the average since a programme at 4, 4, 4, 1 behaves like its lowest dimension in practice, not like its mean of 3.25. Maturity scores are what boards and regulators use to compare year on year, and the dimension breakdown is what turns a score into a plan. It is a self-assessment producing management estimates, not an appraisal against any formal maturity model.
Governance Maturity
Maturity = unweighted mean of the eight dimension levels on the 1–5 scale; the gap is target − mean, and roadmap length ≈ 9 months per level plus 2 months per level of spread.
Maturity = unweighted mean of the eight dimension levels on the 1–5 scale; the gap is target − mean, and roadmap length ≈ 9 months per level plus 2 months per level of spread. The dimensions are unweighted because governance is a system: strong policy with no measurement produces documents nobody checks, and good measurement with no resourcing produces reports nobody can act on. Spread is reported alongside the average since a programme at 4, 4, 4, 1 behaves like its lowest dimension in practice, not like its mean of 3.25.
Maturity scores are what boards and regulators use to compare year on year, and the dimension breakdown is what turns a score into a plan. It is a self-assessment producing management estimates, not an appraisal against any formal maturity model.
This calculator takes 9 inputs: Strategy and policy framework, Organisation, roles and accountability, Risk management process, Compliance and obligations management, Performance measurement and KPIs, Board and committee reporting, Awareness and training, Resourcing and budget, Target maturity level. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
No. Level 5 costs real money to sustain and only pays back where the risk justifies it; most organisations should aim for a solid 3 across the board and 4 in the dimensions that carry their biggest risks. A uniform level 3 is a stronger position than an average of 4 with one dimension at 1.
Because levelling up an uneven programme means doing several different kinds of work in parallel — writing policy, hiring, building measurement — and those compete for the same scarce attention. An even programme can move on one front at a time.