A cybersecurity maturity assessment scores how well an organization’s security program is defined, practiced, and improved, using a model with named levels, so leadership can see where it stands and decide what to fix first. It differs from an audit, which tests controls against a standard, and from a risk assessment, which ranks threats and exposures. It matters most when a board, a regulator, an insurer, or a customer asks how mature the program is and no one can answer with evidence. In banking the question sharpened when the FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025. This article explains the models, how an assessment runs, what it should produce, and how often to repeat it.
What a Cybersecurity Maturity Assessment Measures
Maturity, Compliance, and Risk Are Different Questions
Maturity asks how consistently and effectively security practices are carried out. Compliance asks whether a specific requirement is met, and risk asks how much exposure remains. A program can be compliant on the audit date and still immature, because it relies on one person’s effort. It can also be mature and still fall short of one regulation’s detail. A security maturity assessment answers the first question, which is why boards use it to track progress over time. Elevate’s guide to cybersecurity risk assessment services covers the third.
What Gets Scored
An assessment looks at governance first: who owns security, how risk decisions are made, and how the program is measured. It then examines the technical and operational practices across the lifecycle of identifying assets, protecting them, detecting incidents, responding, and recovering. For each area the question is not only whether a practice exists but whether it is defined, followed consistently, measured, and improved. That progression, from ad hoc to managed to optimized, is what a maturity level describes.
Cybersecurity Maturity Models Compared
The Models Most Organizations Use
| Model | How it scores | Best for | Note |
|---|---|---|---|
| NIST CSF 2.0 Tiers | Four tiers: Partial, Risk Informed, Repeatable, and Adaptive | Most organizations, and a common language for boards and regulators | Tiers describe the rigor of governance and risk management practices |
| C2M2 | Maturity indicator levels across defined domains | Energy and critical infrastructure, adaptable to others | The Cybersecurity Capability Maturity Model from the U.S. Department of Energy |
| CIS Controls | Groups safeguards into Implementation Groups by organization size and risk | Organizations that need prioritized, practical safeguards | A prioritization tool more than a maturity scale |
| CRI Profile | A financial-sector profile built on the NIST CSF | Banks, insurers, and other financial institutions | Adds sector-specific expectations to the CSF structure |
The table shows that the choice depends on audience and sector more than on technical merit. Most organizations are well served by the NIST Cybersecurity Framework Tiers, because boards, examiners, and insurers already read them. The important discipline is to pick one model and keep it across assessments, because switching models breaks the trend line that makes a maturity assessment useful. Elevate’s NIST CSF and CRI Profile work cover the two most common choices.
NIST CSF Maturity Assessment in Practice
NIST published version 2.0 of the Cybersecurity Framework in February 2024 and added a sixth function, Govern, to the original five. A NIST CSF maturity assessment compares the current state to a target state, usually by scoring each category on the four Tiers, and records both in an Organizational Profile. The target is set by risk and regulatory expectation, not by aiming for the top tier everywhere. NIST has also published guidance on applying the Tiers to a Profile, which is worth reading before scoring begins.
What Replaced the FFIEC Cybersecurity Assessment Tool
The FFIEC announced in August 2024 that it would retire its Cybersecurity Assessment Tool, and the tool was retired on August 31, 2025. The FFIEC chose not to update it and pointed institutions to newer government resources, including NIST CSF 2.0 and the CISA Cybersecurity Performance Goals. Institutions that still report the old maturity levels in board packages need to convert them to a current model before the next examination. Elevate’s FFIEC and financial services pages cover the transition for banks.
How a Cybersecurity Maturity Assessment Works
Scope the Assessment and Choose the Model
Decide whether the assessment covers the whole organization or a business unit, which model it uses, and who the audience is. A board-facing assessment needs a model the board can read, and a regulator-facing one needs a model the regulator recognizes. Fix these choices before scoring begins, because they cannot be changed midway without losing comparability.
Assess the Current State With Evidence
A self-scored questionnaire is a starting point, not a result, because people rate their own programs generously. A credible assessment combines interviews with documents and samples of records, and it scores each area against the model’s descriptors rather than against a feeling. A rating of Repeatable, for example, should be supported by evidence that a practice is performed the same way each time, not by the existence of a policy.
Set a Target State
The target reflects risk, size, and regulatory expectations. A regional bank, a software company, and a clinic do not need the same profile, and aiming for the highest level everywhere wastes money on areas that carry little risk. The gap between the current and target states, area by area, is what the roadmap addresses.
Build the Roadmap
Rank the gaps by risk reduction and effort, assign an owner and a date to each, and estimate the cost. A good roadmap has a small number of funded initiatives for the next year and a longer list for later, not a hundred items with no sequence. A Virtual CISO can own the roadmap and report progress for organizations without a full-time security leader.
What a Security Maturity Assessment Should Produce
Deliverables to Expect
Expect a scorecard that shows maturity by function or domain, a gap list tied to the target state, a prioritized roadmap with owners and dates, and a short summary written for the board. The scorecard becomes the baseline for the next assessment, so the method and scoring rules should be documented. If the output is a long report of observations without a score, a target, and a sequence, the assessment has not done its job.
Questions to Ask the Assessor
Ask which model they use and why, how scores are supported by evidence, whether the target is set by risk or defaulted, and how the result will be repeated next year for comparison. Ask who will present it to the board. Elevate’s risk assessment work and its banking compliance practice both use the same evidence-based approach.
How Often to Repeat the Assessment
Repeat the assessment at least annually, and after a major change such as an acquisition, a new platform, or a significant incident. The first assessment sets the baseline and the later ones show whether the roadmap is working. Tie the results to the budget cycle, since a maturity score that never changes a spending decision is a report, not a management tool. To scope an assessment against the model your board or regulator expects, book a call with an Elevate advisor.
Conclusion
A cybersecurity maturity assessment turns a vague question, how good is our program, into a score, a target, and a plan. Its value comes from three disciplines: using one model consistently, scoring from evidence instead of opinion, and setting a target by risk. Organizations that skip any of the three end up with a number they cannot defend or a roadmap nobody funds.
For banks, the retirement of the FFIEC Cybersecurity Assessment Tool makes the choice of a current model urgent, and for other sectors the NIST Cybersecurity Framework Tiers are the most widely understood option. The assessment is most useful when it is repeated and when its results reach the board and the budget.
Elevate Consult helps regulated organizations assess their programs, set targets, and build roadmaps, and prepares them for the audits that follow. Book a call with an Elevate advisor to plan your assessment.
Key Takeaways
A maturity assessment is useful when it is scored from evidence, repeated, and connected to decisions.
- Maturity is not compliance or risk. It measures how consistently and effectively practices are carried out.
- Pick one model and keep it. Switching models breaks the trend line.
- NIST CSF 2.0 Tiers are the common choice. They run from Partial to Adaptive and are widely read by boards and regulators.
- Banks need a replacement for the FFIEC CAT. The tool was retired on August 31, 2025.
- Score from evidence. A policy does not prove a Repeatable practice.
- Set the target by risk. The highest level everywhere is rarely the right goal.
Frequently Asked Questions
What is a cybersecurity maturity assessment?
A cybersecurity maturity assessment scores how well an organization’s security program is defined, practiced, measured, and improved, using a model with named levels. It identifies the current state, sets a target state based on risk, and produces a roadmap for closing the gap. It differs from an audit, which tests controls against a standard, and from a risk assessment, which ranks threats and exposures.
What are the cybersecurity maturity levels?
The levels depend on the model. The NIST Cybersecurity Framework 2.0 uses four Tiers: Partial, Risk Informed, Repeatable, and Adaptive, which describe the rigor of governance and risk management practices. The Department of Energy’s C2M2 uses maturity indicator levels across defined domains. Choose one model and keep it across assessments so results can be compared over time.
How is a maturity assessment different from an audit or a risk assessment?
A maturity assessment measures how consistently and effectively security practices are carried out and scores them against a model. An audit tests controls against a defined standard and produces an opinion or findings. A risk assessment identifies and ranks threats and exposures. The three answer different questions, and organizations commonly use all of them in sequence.
How often should a maturity assessment be repeated?
At least annually, and after a major change such as an acquisition, a new platform, or a significant incident. The first assessment sets the baseline and later ones show whether the roadmap is working. Tying the results to the budget cycle keeps the assessment connected to decisions.
What replaced the FFIEC Cybersecurity Assessment Tool?
Nothing was mandated as a single replacement. The FFIEC retired the tool on August 31, 2025 and pointed institutions to newer government resources, including NIST CSF 2.0 and the CISA Cybersecurity Performance Goals. Many banks use the NIST CSF Tiers, and some use the CRI Profile, which is a financial-sector profile built on the CSF. Institutions should convert any reporting based on the old maturity levels.