Cybersecurity Maturity Assessment

The NIST Cybersecurity Framework (CSF) is a voluntary guidance framework developed by the U.S. National Institute of Standards and Technology. Originally published in 2014 and updated to version 2.0 in February 2024, it provides a structured approach to managing cybersecurity risk that is applicable to organizations of any size, sector, or maturity level.

While NIST CSF originated in the United States, it has become a globally recognized standard. Many European organizations use it alongside EU regulations like NIS2 and DORA, as the framework's structure maps well to these regulatory requirements. The framework is technology-neutral and outcome-focused, making it adaptable to any environment.

NIST CSF 2.0 organizes cybersecurity activities into six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. The addition of "Govern" as a separate function in version 2.0 reflects the growing importance of cybersecurity governance and management accountability — a theme echoed by NIS2's management liability provisions.

Govern (GV) is the newest function, added in CSF 2.0. It establishes and monitors the organization's cybersecurity risk management strategy, expectations, and policy. It addresses how cybersecurity decisions are made, who is responsible, and how performance is measured. This function underpins all others.

Identify (ID) focuses on developing organizational understanding to manage cybersecurity risk. This includes asset management, risk assessment, business environment understanding, and supply chain risk identification. You cannot protect what you do not know you have.

Protect (PR) outlines safeguards to ensure delivery of critical services. This includes access control, security awareness training, data security, information protection processes, and maintenance of protective technology.

Detect (DE) defines activities to discover cybersecurity events in a timely manner. Effective detection requires security monitoring, anomaly detection, and continuous monitoring of systems and networks.

Respond (RS) covers actions taken regarding a detected cybersecurity incident. This includes response planning, communications, analysis, mitigation, and improvements based on lessons learned.

Recover (RC) addresses activities to maintain resilience and restore any capabilities or services impaired due to a cybersecurity incident. This includes recovery planning, improvements, and communications.

Level 1 — Initial: Cybersecurity activities are ad hoc and reactive. There are no formal processes, documentation is minimal or absent, and responses depend on individual heroics rather than systematic approaches. Most startups begin here.

Level 2 — Developing: Some processes exist but are inconsistently applied. Documentation may exist for certain areas but is incomplete. The organization is aware of the need for security but has not yet standardized its approach.

Level 3 — Defined: Processes are documented, standardized, and consistently followed across the organization. Policies are approved by management, roles are assigned, and there is a systematic approach to security. This is often the minimum target for regulatory compliance.

Level 4 — Managed: Security processes are measured using metrics and KPIs. Performance is monitored and reported to management regularly. The organization uses data to make informed decisions about security investments and improvements.

Level 5 — Optimizing: The organization continuously improves its security posture based on lessons learned, threat intelligence, and industry developments. Processes are adaptive and predictive. Security is deeply integrated into business strategy and culture.

These are the statements the tool above asks you to rate, by function. Each one names the NIST CSF 2.0 subcategories it comes from and, where there is one, the NIS2 article it supports, so you can use your answers as a starting point for a NIS2 gap analysis. The same questions are available to AI assistants through our MCP server.

Govern (7 questions)

• Cybersecurity strategy is documented and aligned with business objectives (CSF GV.OC-01, GV.RM-01; NIS2 Art. 21(2)(a))
• Cybersecurity roles, responsibilities, and authority are clearly defined (CSF GV.RR-02)
• Management body actively oversees and is accountable for cybersecurity (CSF GV.RR-01, GV.OV-01; NIS2 Art. 20(1)-(2))
• Cybersecurity budget is allocated, tracked, and reviewed regularly (CSF GV.RR-03)
• Cybersecurity policies are documented, approved, and communicated (CSF GV.PO-01, GV.PO-02; NIS2 Art. 21(2)(a))
• Regulatory and legal cybersecurity requirements are identified and tracked (CSF GV.OC-03)
• Cybersecurity risk appetite and tolerance are defined by management (CSF GV.RM-02; NIS2 Art. 21(1))

Identify (6 questions)

• All hardware, software, and data assets are inventoried and classified (CSF ID.AM-01, ID.AM-02, ID.AM-05, ID.AM-07; NIS2 Art. 21(2)(i))
• Critical business processes and their dependencies are documented (CSF GV.OC-04, GV.OC-05; NIS2 Art. 21(2)(c))
• Risk assessments are conducted regularly with a defined methodology (CSF ID.RA-05; NIS2 Art. 21(2)(a))
• Threats and vulnerabilities relevant to your environment are identified (CSF ID.RA-01, ID.RA-03; NIS2 Art. 21(2)(e))
• Supply chain and third-party risks are identified and assessed (CSF GV.SC-01, GV.SC-07; NIS2 Art. 21(2)(d), 21(3))
• Data flows are mapped showing how information moves through systems (CSF ID.AM-03)

Protect (8 questions)

• Access control follows least privilege with regular reviews (CSF PR.AA-05; NIS2 Art. 21(2)(i))
• Multi-factor authentication is enforced for remote and privileged access (CSF PR.AA-03; NIS2 Art. 21(2)(j))
• Data at rest and in transit is encrypted with strong algorithms (CSF PR.DS-01, PR.DS-02; NIS2 Art. 21(2)(h))
• Security awareness training is provided to all staff regularly (CSF PR.AT-01, PR.AT-02; NIS2 Art. 20(2), 21(2)(g))
• Endpoint protection is deployed and centrally managed (CSF PR.PS-05, DE.CM-09; NIS2 Art. 21(2)(g))
• Secure configuration baselines are defined and enforced (CSF PR.PS-01; NIS2 Art. 21(2)(e))
• Network segmentation separates critical systems from general access (CSF PR.IR-01; NIS2 Art. 21(2)(e))
• Change management processes are followed for system changes (CSF ID.RA-07, PR.PS-01; NIS2 Art. 21(2)(e))

Detect (6 questions)

• Security monitoring covers critical systems and networks (CSF DE.CM-01, DE.CM-09; NIS2 Art. 21(2)(b))
• Security logs are collected, retained (6+ months), and reviewed (CSF PR.PS-04, DE.CM-09; NIS2 Art. 21(2)(b))
• Anomaly detection identifies unusual behavior and access patterns (CSF DE.AE-02, DE.AE-03; NIS2 Art. 21(2)(b))
• Vulnerability scanning is performed regularly on all assets (CSF ID.RA-01; NIS2 Art. 21(2)(e))
• Threat intelligence is consumed and integrated into detection (CSF ID.RA-02)
• Detection capabilities are tested through exercises (red team, simulations) (CSF ID.IM-02; NIS2 Art. 21(2)(f))

Respond (6 questions)

• Incident response plan is documented, approved, and regularly tested (CSF RS.MA-01, ID.IM-04; NIS2 Art. 21(2)(b))
• Incident classification and severity scheme is defined and used (CSF RS.MA-03; NIS2 Art. 23(3))
• Incident response team with clear roles and escalation paths exists (CSF GV.RR-02, RS.MA-01; NIS2 Art. 21(2)(b))
• Communication procedures for incidents (internal and external) are defined (CSF RS.CO-02, RS.CO-03; NIS2 Art. 23(1)-(2))
• Forensic and evidence preservation capabilities are available (CSF RS.AN-03, RS.AN-07)
• Regulatory notification procedures meet required timelines (24-72h) (CSF RS.CO-02; NIS2 Art. 23(4))

Recover (6 questions)

• Business continuity and disaster recovery plans are documented and tested (CSF RC.RP-01, ID.IM-04; NIS2 Art. 21(2)(c))
• Backups are performed regularly, encrypted, and geographically separated (CSF PR.DS-11; NIS2 Art. 21(2)(c))
• Backup restoration is tested at least annually (CSF PR.DS-11, RC.RP-03; NIS2 Art. 21(2)(c))
• Recovery Time and Point Objectives (RTO/RPO) are defined for critical systems (CSF GV.OC-04, PR.IR-03; NIS2 Art. 21(2)(c))
• Post-incident lessons learned process improves future response (CSF ID.IM-03, ID.IM-04; NIS2 Art. 21(2)(f))
• Crisis communication plan covers stakeholders, customers, and regulators (CSF RC.CO-03, RC.CO-04; NIS2 Art. 21(2)(c))

You rate each statement from 1 (Initial) to 5 (Optimizing). A question you skip counts as level 1, so an unfinished assessment errs on the low side rather than flattering you. Each function's score is the average of its questions, and the overall score is the average of the six function scores, rounded to the nearest level for the label.

Because every function carries the same weight, a strong Protect score cannot hide a weak Recover score. Look at the radar chart before the overall number: the shape shows where you are lopsided, and the lowest function is usually the best place to start.

The 1 to 5 scale is ClevSec's, not NIST's. NIST CSF 2.0 does not define maturity levels. It has four Tiers (Partial, Risk Informed, Repeatable, Adaptive) that describe how rigorous your risk management practices are, and NIST does not certify or score organisations. Our five levels follow the common capability-maturity pattern (initial, developing, defined, managed, optimizing) so that you can rate individual practices. Treat the result as a structured self-assessment, not a NIST rating. Our article NIST CSF 2.0 for small businesses explains the Tiers and the six functions in practice.

1. Set a target. Level 3 (Defined) everywhere is a sensible first goal: documented, approved and applied consistently. That is also what an auditor or a NIS2 supervisor will look for first.
2. Fix Govern and Identify first. Without an owner, a policy and an asset inventory, improvements elsewhere do not last. You cannot protect what you have not listed.
3. Then raise every question at level 1. Moving a practice from "nothing" to "something documented" reduces more risk than polishing one that already works.
4. Collect evidence as you go. For each level-3 answer, note the document, ticket or log that proves it. If you cannot point to evidence, the honest answer is level 2.
5. Reassess and compare. Run the assessment again after 6 to 12 months and show management the change per function.

Useful next steps: the security policy generator for the policies behind Govern and Protect, the vendor risk assessment for supply chain questions, and the incident response plan guide for Respond.