Skip to content
Calcrivo

Governance Maturity Calculator

Score security governance maturity across eight dimensions on a 1–5 CMMI-style scale, with the weakest dimension and a roadmap estimate.

Inputs

Governance Maturity

2.75of 5

Share of the Maximum Level

55.0%

Gap to Target Level

1.25levels

Spread Across Dimensions

2levels

Indicative Roadmap Length

16months

Current Level

Level 2 — Managed: repeatable in places, still reactive

Weakest Dimension

Compliance and obligations management

Strongest Dimension

Awareness and training

Balance Note

Slightly uneven — level up the laggard before deepening the leaders

Step by step

  1. Values used

    Strategy and policy framework = 3 — Defined; Organisation, roles and accountability = 3 — Defined; Risk management process = 3 — Defined; Compliance and obligations management = 2 — Managed; Performance measurement and KPIs = 2 — Managed; Board and committee reporting = 3 — Defined; Awareness and training = 4 — Measured; Resourcing and budget = 2 — Managed; Target maturity level = 4 — Measured

  2. Governance Maturity

    Maturity = unweighted mean of the eight dimension levels on the 1–5 scale; the gap is target − mean, and roadmap length ≈ 9 months per level plus 2 months per level of spread.

  3. Governance Maturity

    = 2.75 of 5

  4. Share of the Maximum Level

    = 55.0

  5. Gap to Target Level

    = 1.25 levels

  6. Spread Across Dimensions

    = 2 levels

  7. Indicative Roadmap Length

    = 16 months

  8. Current Level

    = Level 2 — Managed: repeatable in places, still reactive

How it works

The dimensions are unweighted because governance is a system: strong policy with no measurement produces documents nobody checks, and good measurement with no resourcing produces reports nobody can act on. Spread is reported alongside the average since a programme at 4, 4, 4, 1 behaves like its lowest dimension in practice, not like its mean of 3.25. Maturity scores are what boards and regulators use to compare year on year, and the dimension breakdown is what turns a score into a plan. It is a self-assessment producing management estimates, not an appraisal against any formal maturity model.

Formula

Governance Maturity

Maturity = unweighted mean of the eight dimension levels on the 1–5 scale; the gap is target − mean, and roadmap length ≈ 9 months per level plus 2 months per level of spread.

1–5
Initial, Managed, Defined, Measured, Optimising
spread
Highest dimension minus lowest, a measure of how lopsided the programme is
roadmapMonths
Indicative elapsed months, not effort

Frequently Asked Questions

How is Governance Maturity calculated?

Maturity = unweighted mean of the eight dimension levels on the 1–5 scale; the gap is target − mean, and roadmap length ≈ 9 months per level plus 2 months per level of spread. The dimensions are unweighted because governance is a system: strong policy with no measurement produces documents nobody checks, and good measurement with no resourcing produces reports nobody can act on. Spread is reported alongside the average since a programme at 4, 4, 4, 1 behaves like its lowest dimension in practice, not like its mean of 3.25.

Why does Governance Maturity matter?

Maturity scores are what boards and regulators use to compare year on year, and the dimension breakdown is what turns a score into a plan. It is a self-assessment producing management estimates, not an appraisal against any formal maturity model.

What values do I need to enter?

This calculator takes 9 inputs: Strategy and policy framework, Organisation, roles and accountability, Risk management process, Compliance and obligations management, Performance measurement and KPIs, Board and committee reporting, Awareness and training, Resourcing and budget, Target maturity level. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should every organisation target level 5?

No. Level 5 costs real money to sustain and only pays back where the risk justifies it; most organisations should aim for a solid 3 across the board and 4 in the dimensions that carry their biggest risks. A uniform level 3 is a stronger position than an average of 4 with one dimension at 1.

Why does spread add to the roadmap estimate?

Because levelling up an uneven programme means doing several different kinds of work in parallel — writing policy, hiring, building measurement — and those compete for the same scarce attention. An even programme can move on one front at a time.

You might also need