Maturity Model

The Maturity Model module lets you assess, score, and track the maturity of your security program over time using industry-standard or custom frameworks. It supports multi-framework assessments (CMMC 2.0, NIST CSF, ISO 27001:2022, CIS Controls, and custom frameworks), a hybrid approach combining auto-calculated scores from other SecureHive modules with manual expert assessments, multi-dimensional capability scoring across policy, process, technology, people, and metrics dimensions, and historical trend tracking with improvement planning tied to projects and CISO goals.

Frameworks

A maturity framework defines the structure your organization is assessed against — the domains, capabilities, and maturity levels that represent progressive degrees of security program sophistication.

Supported framework types

Framework hierarchy

Each framework is organized into a two-level hierarchy:

Domains represent broad functional areas of security (e.g., Access Control, Risk Management, Incident Response). Each domain has a name, description, code, display order, and a weight that determines how much it contributes to the overall maturity score.

Capabilities sit within domains and represent specific practices or controls that can be individually assessed. Each capability has a name, description, code, order, weight, optional framework control reference, maturity dimension, scoring method, applicability flag, reference links, tags, and metadata. Capabilities also define criteria — structured descriptions of what each maturity level looks like for that specific capability — and can include auto-calculation configuration for pulling scores from other modules.

Maturity levels

Maturity levels define the scale used for scoring. While the default is a five-level scale (L1 through L5), levels are fully customizable per tenant. Each level has a name, description, code (e.g., L1, L2), display order, and active/inactive status. Level codes must be unique within a tenant.

Framework marketplace

SecureHive provides a framework marketplace where you can license pre-built, industry-standard frameworks. When you license a framework from the marketplace, it is cloned into your tenant with a reference back to the platform source (platformMaturityFrameworkId). Domains and capabilities also maintain their platform references, so you can receive updates from the marketplace while preserving your local customizations.

Each tenant can designate one framework as the default for quick access, and frameworks can be deactivated without deletion when no longer needed.

Assessments

A maturity assessment evaluates your organization’s current state across all (or selected) domains and capabilities in a chosen framework. Assessments produce a scored snapshot of your maturity posture at a point in time.

Assessment types

Assessment coverage

Assessments support three coverage modes:

Partial and targeted coverage modes are useful for focused assessments — for example, assessing only the Access Control domain after a major identity management project, or targeting specific capabilities that were previously scored as low maturity.

Assessment lifecycle

Creating an assessment

Score calculation

Maturity scores are calculated using a weighted averaging system that rolls up from individual capabilities to domains to the overall framework score.

Individual capability scores

Each capability’s score is derived from its assigned maturity level:

Score = Level Order x 20

Where level order is the position of the maturity level (1 through 5). This produces scores on a 0-100 scale: Level 1 = 20, Level 2 = 40, Level 3 = 60, Level 4 = 80, Level 5 = 100.

Overall maturity score

The overall maturity score is calculated as a weighted average of all capability scores:

Overall Score = Sum(Capability Score x Weight) / Sum(Weight)

Each capability’s weight determines how much it contributes to the overall calculation. Domains also have weights, and the domain-level score is the weighted average of its capabilities.

Overall maturity level

The overall maturity level is derived from the overall score:

Overall Level = ceil(Overall Score / 20), clamped between 1 and 5.

For example, an overall score of 47.3 would produce ceil(47.3 / 20) = ceil(2.365) = 3, corresponding to maturity level L3.

Multi-dimensional scoring

Beyond the primary maturity score, each capability assessment supports five scoring dimensions that provide a more nuanced view of maturity:

Each dimension has its own score (0-100) and level (1-5), along with a dimension rationale field for documenting the reasoning behind each dimensional score. This multi-dimensional view helps identify whether a capability is strong in policy but weak in technology, or well-staffed but lacking metrics — enabling targeted improvement planning.

Auto-calculation

Capabilities can be configured for auto-calculation, pulling maturity scores directly from data in other SecureHive modules rather than requiring manual assessment:

Audit Module — Control test pass rates feed into capability scores, reflecting how well controls are performing in practice.

Risk Module — Risk treatment completion rates contribute to maturity scores, showing how effectively identified risks are being addressed.

Policy Module — Policy coverage percentages and acknowledgment rates indicate the maturity of governance documentation and organizational awareness.

When auto-calculation is enabled for a capability, the system computes the score automatically based on the configured data source. Assessors can still manually override an auto-calculated score when expert judgment differs from the computed result — the autoCalculated and manualOverride flags track which method produced the current score.

Improvement planning

Maturity assessments are most valuable when they drive action. Each capability assessment supports improvement planning through several mechanisms:

Target maturity level — Set a target level for each capability (and for the overall assessment), establishing a clear goal for where the organization wants to be.

Project linking — Associate specific projects with capability improvements via relatedProjectIds. These projects track the work needed to move from the current level to the target level.

CISO goal alignment — Link capability improvements to CISO goals via relatedCISOGoalIds, connecting maturity advancement to strategic security objectives tracked in Security Direction.

Framework outcomes — Each capability assessment can record framework-specific outcomes as structured metadata, documenting what was achieved against the framework’s specific requirements.

Trend tracking

Maturity trends are tracked over time through the MaturityTrend records associated with each assessment. Trends capture how maturity scores change across successive assessments of the same framework, enabling you to demonstrate progress to leadership and board-level stakeholders.

Run assessments on a regular cadence — quarterly or semi-annually — to build a meaningful trend baseline. Use the trend data to validate that improvement projects are producing measurable maturity gains.

Getting started

Permissions

Managing maturity frameworks and assessments requires the maturity-model:manage permission. Users with this permission can license frameworks, create assessments, score capabilities, and configure improvement plans. Users without this permission can view maturity data in read-only mode.