A cyber security maturity assessment scores your current controls against a recognised framework — NCSC Cyber Assessment Framework, NIST CSF 2.0, or ISO 27001 Annex A — and rates each domain from ad hoc to fully managed. The output is a maturity score per domain, not a single pass/fail grade, so you see exactly where identify, protect, detect, respond and recover controls fall short. The real work starts after the scoring: a low result on asset management or vendor risk usually means remediation before you can pursue a certification like ISO 27001 or Cyber Essentials.
Why this matters
Certifications like ISO 27001 and Cyber Essentials tell an auditor you meet a checklist. A cyber security maturity assessment tells you and your board how capable the security programme actually is — which matters more when a customer's security questionnaire asks about detection and response, not just a policy sitting on a shelf.
Insurers and enterprise buyers increasingly ask for maturity evidence, not just a certificate, before signing a contract in 2026. Running the assessment first means you catch weak domains — vendor risk, incident response, asset inventory — before they turn into audit findings or lost deals.
OneClickComply automates the evidence collection that most maturity assessments get stuck on, so the scoring reflects what's actually documented, not what someone remembers from an audit two years ago.
How to run a cyber security maturity assessment
- Pick a framework. NCSC CAF, NIST CSF 2.0, or ISO 27001 Annex A, depending on your sector and what your buyers ask for.
- Score each domain. NIST CSF 2.0 uses six functions — Govern, Identify, Protect, Detect, Respond, Recover. NCSC CAF splits into four objectives and 14 principles.
- Gather evidence per control — policies, logs, training records, vendor contracts. This step is where most assessments stall.
- Rate each domain against the five maturity levels: Initial, Repeatable, Defined, Managed, Optimized.
- Prioritise gaps by risk and buyer pressure, not by which fix is easiest.
- Build a remediation roadmap with named owners and dates, then re-score annually.
Here's how the three main frameworks compare on structure:
| Framework | Structure | Best for |
|---|---|---|
| NCSC Cyber Assessment Framework (CAF) | 4 objectives, 14 principles, outcome-based scoring | UK critical infrastructure and regulated or public-sector suppliers |
| NIST CSF 2.0 | 6 functions, 4 implementation tiers | Tech and SaaS businesses benchmarking against a global standard |
| ISO 27001:2022 Annex A | 93 controls across 4 themes, no built-in maturity scale | Businesses pursuing certification who want gap analysis to double as maturity scoring |
Running an ISO 27001 gap analysis first gives you Annex A coverage in one pass — then you lay a maturity score on top of it instead of running two separate exercises.
The five levels of cyber security maturity
Level 1: Initial — ad hoc controls
Security happens reactively. No documented process, no consistent ownership, controls exist because someone set them up once. Best for: businesses with no formal security programme yet — this is a starting point, not a resting place. Verdict: fix now.
Level 2: Repeatable — documented but inconsistent
Some processes exist on paper, but execution depends on who's doing the work that week. Evidence is scattered across inboxes and spreadsheets. Best for: early-stage businesses that have started writing policies but haven't standardised them. Verdict: move up before an audit.
Level 3: Defined — standardised across the business
Processes are documented, consistent, and followed the same way regardless of who's on shift. This is roughly where a business needs to sit to pass a Cyber Essentials Plus audit or an ISO 27001 certification audit. Best for: businesses actively pursuing or holding a certification. Verdict: solid baseline.
Level 4: Managed — measured and monitored
Controls are tracked with metrics, reviewed on a schedule, and adjusted based on what the data shows. Incident response has been tested, not just written down. Best for: businesses handling regulated data or enterprise vendor contracts. Verdict: strong position.
Level 5: Optimized — continuously improved
The programme adapts on its own: lessons from incidents and audits feed back into controls automatically, and maturity reviews happen more often than once a year. Best for: businesses where security is a competitive differentiator, not a compliance checkbox. Verdict: rare, and usually not necessary for SMEs.
Why maturity scores vary
- Company size and IT complexity — more systems and vendors means more domains to score and more places for gaps to hide.
- Regulatory exposure — FCA-regulated firms, NHS DSPT submitters and DORA-in-scope entities face stricter baseline expectations than an unregulated retailer.
- Existing certification — businesses already holding ISO 27001 or Cyber Essentials typically score higher on documentation and process domains.
- Tooling — manual spreadsheets slow evidence-gathering and drag down scores on asset management and vendor risk specifically.
- Staff turnover in IT and security roles — undocumented tribal knowledge lowers repeatability and consistency scores.
- Board engagement — programmes with named executive ownership score higher on governance domains almost every time.
If you're not sure which framework fits your sector, work through the decision points built around buyer expectations and regulatory exposure before you start scoring — picking the wrong one wastes the assessment.
Automate the evidence, not just the score
OneClickComply handles evidence collection for ISO 27001, SOC 2 and Cyber Essentials end-to-end.
How is a cyber security maturity assessment different from a gap analysis?
A gap analysis measures compliance against one framework's specific requirements — ISO 27001:2022's 93 Annex A controls, for example — to show what's missing before certification. A maturity assessment scores capability across every domain regardless of certification target, so it still works even if you're not pursuing a named certificate in 2026.
Do you need a maturity assessment before ISO 27001 certification?
A maturity assessment isn't required for ISO 27001, but it surfaces the same gaps a formal gap analysis would find, scored on capability rather than a strict checklist. Businesses that run one first tend to walk into certification audits with fewer surprises and less last-minute remediation.
How often should you repeat a cyber security maturity assessment?
Most businesses repeat it annually, timed alongside a Cyber Essentials renewal or an ISO 27001 surveillance audit, since staff, vendors and threat exposure all shift over a year. Frameworks change too — NIST CSF 2.0 added a sixth function, Govern, that an older assessment run before the update won't have scored at all.
Frequently asked questions
One last thing
Vendor and third-party risk is the domain most businesses score lowest on — not because the technical controls are hard, but because nobody owns the supplier list until an assessment forces the question. If your result flags vendor risk as Initial or Repeatable, that's the fastest domain to move up: a documented vendor risk process closes more gap-analysis findings per hour of work than almost any other control area. OneClickComply keeps vendor evidence and control evidence in one place, so the next assessment starts from Defined instead of zero.
Seriously simple cyber compliance means the assessment tells you what to fix, and the platform handles the paperwork that proves you fixed it.