Governance Maturity Calculator
Score security governance maturity across eight dimensions on a 1–5 CMMI-style scale, with the weakest dimension and a roadmap estimate.
Inputs
Governance Maturity
2.75of 5
Share of the Maximum Level
55.0%
Gap to Target Level
1.25levels
Spread Across Dimensions
2levels
Indicative Roadmap Length
16months
Current Level
Level 2 — Managed: repeatable in places, still reactive
Weakest Dimension
Compliance and obligations management
Strongest Dimension
Awareness and training
Balance Note
Slightly uneven — level up the laggard before deepening the leaders
Step by step
Values used
Strategy and policy framework = 3 — Defined; Organisation, roles and accountability = 3 — Defined; Risk management process = 3 — Defined; Compliance and obligations management = 2 — Managed; Performance measurement and KPIs = 2 — Managed; Board and committee reporting = 3 — Defined; Awareness and training = 4 — Measured; Resourcing and budget = 2 — Managed; Target maturity level = 4 — Measured
Governance Maturity
Maturity = unweighted mean of the eight dimension levels on the 1–5 scale; the gap is target − mean, and roadmap length ≈ 9 months per level plus 2 months per level of spread.
Governance Maturity
= 2.75 of 5
Share of the Maximum Level
= 55.0
Gap to Target Level
= 1.25 levels
Spread Across Dimensions
= 2 levels
Indicative Roadmap Length
= 16 months
Current Level
= Level 2 — Managed: repeatable in places, still reactive
How it works
The dimensions are unweighted because governance is a system: strong policy with no measurement produces documents nobody checks, and good measurement with no resourcing produces reports nobody can act on. Spread is reported alongside the average since a programme at 4, 4, 4, 1 behaves like its lowest dimension in practice, not like its mean of 3.25. Maturity scores are what boards and regulators use to compare year on year, and the dimension breakdown is what turns a score into a plan. It is a self-assessment producing management estimates, not an appraisal against any formal maturity model.
Formula
Governance Maturity
Maturity = unweighted mean of the eight dimension levels on the 1–5 scale; the gap is target − mean, and roadmap length ≈ 9 months per level plus 2 months per level of spread.
- 1–5
- Initial, Managed, Defined, Measured, Optimising
- spread
- Highest dimension minus lowest, a measure of how lopsided the programme is
- roadmapMonths
- Indicative elapsed months, not effort
Frequently Asked Questions
How is Governance Maturity calculated?
Maturity = unweighted mean of the eight dimension levels on the 1–5 scale; the gap is target − mean, and roadmap length ≈ 9 months per level plus 2 months per level of spread. The dimensions are unweighted because governance is a system: strong policy with no measurement produces documents nobody checks, and good measurement with no resourcing produces reports nobody can act on. Spread is reported alongside the average since a programme at 4, 4, 4, 1 behaves like its lowest dimension in practice, not like its mean of 3.25.
Why does Governance Maturity matter?
Maturity scores are what boards and regulators use to compare year on year, and the dimension breakdown is what turns a score into a plan. It is a self-assessment producing management estimates, not an appraisal against any formal maturity model.
What values do I need to enter?
This calculator takes 9 inputs: Strategy and policy framework, Organisation, roles and accountability, Risk management process, Compliance and obligations management, Performance measurement and KPIs, Board and committee reporting, Awareness and training, Resourcing and budget, Target maturity level. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should every organisation target level 5?
No. Level 5 costs real money to sustain and only pays back where the risk justifies it; most organisations should aim for a solid 3 across the board and 4 in the dimensions that carry their biggest risks. A uniform level 3 is a stronger position than an average of 4 with one dimension at 1.
Why does spread add to the roadmap estimate?
Because levelling up an uneven programme means doing several different kinds of work in parallel — writing policy, hiring, building measurement — and those compete for the same scarce attention. An even programme can move on one front at a time.
You might also need
- ISO 27001 Compliance CalculatorCommonly used together
- GRC Health Score CalculatorCommonly used together
- NIST CSF Maturity CalculatorCommonly used together
- Enterprise Risk Score CalculatorCommonly used together
- Security Investment ROI CalculatorAlso in Compliance & GRC
- Disaster Recovery RTO CalculatorAlso in Compliance & GRC