Skip to content
ENExplore Calculators

Security Maturity Score Calculator

Work out security maturity score instantly with clear inputs, formula shown and shareable results.

About Security Maturity Score Calculator

Scoring the NIST Cybersecurity Framework functions separately exposes the imbalance that an aggregate hides. Organisations routinely invest heavily in Protect while Detect and Respond lag, which produces exactly the profile where a breach goes unnoticed for months. The spread between strongest and weakest is often a more actionable number than the average.

Formula

Maturity aggregation

overall = mean of the function scores; spread = highest - lowest; tier bands at 2, 3 and 4

Worked example

With the default values below, Security Maturity Score Calculator returns Overall maturity level of 2.75. Change any input above and every figure here is recalculated in your browser.

Inputs used

Identify function maturity (1-5)accepts 1–5
3
Protect function maturity (1-5)accepts 1–5
3.5
Detect function maturity (1-5)accepts 1–5
2.5
Respond and Recover maturity (1-5)accepts 1–5
2

Results

Overall maturity level
2.75
Weakest function
Respond and Recover at level 2
Spread between strongest and weakest
1.5
Maturity tier
Risk informed - practices exist but are inconsistent

Step by step

  1. 1Values used
  2. 2Maturity aggregation
  3. 3Overall maturity level= 2.75
  4. 4Weakest function= Respond and Recover at level 2
  5. 5Spread between strongest and weakest= 1.5
  6. 6Maturity tier= Risk informed - practices exist but are inconsistent

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Is a higher maturity always the goal?

No. The framework's own guidance is to choose a target profile appropriate to your risk, not to reach level 5 everywhere. Over-investing in low-risk areas is a real failure mode.

Why is Detect so often the weakest?

Detection needs continuous telemetry, tuning and staffed analysis rather than a one-off deployment, so it carries ongoing cost that preventive controls do not.

Related Calculators

Security Maturity Score Calculator | Calcrivo