Security Maturity Models: Common Levels of Maturity & How They’re Evaluated

With an ever-changing landscape of security threats and available tools and resources, it is important for organizations to periodically evaluate their security maturity and seek to make improvements to maintain a well-balanced security posture. Throughout this blog, we will explore the concept of the capability maturity model with a focus on security maturity in an effort to provide some insight into where your organization may fall with respect to security maturity and resources to identify areas of improvement. Additionally, we will dive into some key information security processes and procedures that can improve an organization’s security maturity.

What is the Security Maturity Model Concept?

In general, any type of maturity model is a set of practices or processes that depict the levels of progression based on an organization’s capabilities. Many maturity models stem from compliance framework suggestions or requirements. A security maturity model focuses on the progression of security processes and controls to achieve an efficient and optimized security posture.

A security maturity model can be used as a tool to identify areas that need to be prioritized for improvement and benchmark progress during an organization’s journey of building out its security controls environment. An example of an industry-tailored security maturity model is the C2M2 (Cybersecurity Capability Maturity Model) which was developed by the U.S. Department of Energy (DoE) and industry experts. The C2M2 may be used by organizations in the process of obtaining the Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC). Here is additional guidance regarding the CMMC.

Although there may be different flavors of security maturity models, varying by some degree of detail and level of assessment, there are common themes and progress goals that seem to stand within each maturity model.

 

What Are the Five Levels of Maturity?

There are different security and capability maturity models out there that can be used to benchmark and analyze an organization’s progress, but there are five common themes/levels that appear in some aspect of each reputable security or capabilities maturity model. Below is a high-level summary of typical levels used to define an organization’s capability maturity tailored to the perspective of information security.

• Level 1 – Unstructured and unorganized. An organization at Level 1 may just be starting out with its information security processes and defining what those look like. To advance to Level 2, areas of opportunity here may include developing policies and process documents for security-related activities.
• Level 2 – Repeatable. At Level 2, security processes are documented so that actions and responses can be repeated by different members of a specific team. However, there may be some disconnect between departments where each security process is performed or documented slightly differently.
• Level 3 – Standardized. Processes and procedures at Level 3 are standardized across the entire organization. Guidance on security procedures and policies is provided organization-wide and the culture of proactive responses to security is communicated by leadership.
• Level 4 – Managed and Monitored. Security controls are monitored and can be measured by the organization. Often, analytical tools are in place by Level 4 to report quantitative statistics related to security controls and events.
• Level 5 – Optimized level where information security processes are continuously analyzed and improved.

Where does your organization fall in the security maturity model? What is being done to progress forward with respect to security maturity?

How Can Maturity Models Be Used to Assess Weaknesses?

A security maturity model can help identify processes that are struggling and need to be optimized. When analyzing where an organization falls in a given security or capabilities maturity model, processes can be identified as reactive or proactive. Areas, where common security practice is to take a reactive approach, can be redesigned to follow a proactive approach.

For example, if a security breach occurs and the organization’s response is reactive to just block the attack, lessons learned might not be documented and the same issues will persist with the next breach. Using a proactive response by implementing a risk-based approach to vulnerabilities and including an incident response plan that evolves and is continuously optimized over time will yield better results and place the organization further along in its security maturity. Read here to learn more about vulnerability management programs and vulnerability management maturity models.

 

How to Self-Assess Security Maturity Level & the Benefits

There is no one “right” way to perform a self-assessment and there are lots of tools and resources available to organization management and security personnel. The Program Review for Information Security Assistance (PRISMA) review developed by NIST (National Institute of Standards and Technology), part of the U.S. Department of Commerce, is a great resource to help determine an organization’s security maturity level.

The security maturity levels included in PRISMA are based on the Software Engineering Institute’s (SEI) Capability Maturity Model (CMM) where each level has integrated components of the CMM. The review criteria include policies, procedures, implementation, testing, and integration. A formal review and results from the PRISMA methodology provide organizations with scores in key security areas to show where improvement is needed; however, organizations can internally utilize the criteria to perform their own self-assessments and identify key pain points where they may be lacking security controls.

Other Resources for Evaluating Security Controls

PRISMA is just one example of a methodology and guidance on security processes and procedures to evaluate maturity. NIST also provides a cybersecurity framework that provides guidance for preventing, detecting, and responding to security threats. Other compliance frameworks, such as the AICPA’s Trust Services Criteria used for SOC reporting, can also be useful to an organization when self-assessing their information security maturity progress as they provide compliance-driven objectives for organizations.

The results of a self-assessment can be used by internal security personnel and management to create a road map for changes, both small and large, to be considered by leadership and can also be used as input to external assessments, such as an annual SOC audit. When an organization has already established an internal initiative to improve its security maturity, more than likely it will benefit the organization while undergoing an external assessment as the activities performed from this initiative can be used to satisfy audit requirements such as internal control monitoring.

 

What Are Some Key Capabilities to Build Security Maturity?

Security topics cover a broad scope of people, processes, and technology. There are endless options and opinions on which security capabilities or activities are the most important. Here are just a few key security capabilities and topics that, when fully implemented appropriately, can have a large impact on an organization’s security maturity. This is by no means an exhaustive list of capabilities to be mastered.

• Effective and Involved Leadership – Something that might not necessarily first come to mind when thinking about security maturity, but a very important factor is having buy-in from executive management. The tone at the top is indicative of how effective the implementation of security processes and procedures will be.
• Security Policies – See our blog post here on the importance of documenting information security policies.
• Security Awareness Training – Choosing and enforcing a comprehensive security awareness training program is crucial to educating the entire organization on the importance of upholding security controls and best practices.
• Data Security – Identifying sensitive or confidential data that an organization needs to protect may seem like an obvious first step in determining where to start with securing information, but may be easily overlooked in the process of implementing security controls.
• Incident Management Program – Having a robust incident response program to proactively identify and mitigate security threats is key to maintaining and optimizing an organization’s security posture.
• Risk Management – An annual risk assessment is a great start to self-assessing whether key security controls are in place to address specific risks that the organization may face.

Summary

In summary, security maturity models can be useful tools for organizations to benchmark where their capabilities stand. Hopefully, this blog sparked some insight into how an organization can evaluate its own security maturity and key capabilities that can progress security maturity.

At L&C, service auditors work closely with organizations to evaluate and report on security controls with respect to compliance frameworks. Please contact us if you are in need of compliance or advisory services for SOC1, SOC2, FedRAMP, HITRUST, or HIPAA audits and assessments.