MATURITY SELF-ASSESSMENT AND SCORECARD

Tier Self-Scoring · Pillar Domains · Gap Output · Re-Measurement

Table of Contents

1. Purpose and Scope
2. How the Assessment Works
3. The Tier Scale
4. Scoring Rules
5. The Assessment: Governance Domains
6. The Assessment: Engineering Domains
7. The Assessment: Risk Domains
8. The Assessment: Cross-Pillar Domains
9. Scoring the Result
10. The Scorecard Output
11. Turning Gaps Into Work
12. Quarterly Gap Checkpoint
13. Document Control

1. Purpose and Scope

CERG-GOV-FRM-001 §6 sets the target: the CERG model is designed to produce NIST CSF Adaptive-tier behavior. That is the aspiration. This document supplies the missing instrument: a way for an adopter to measure where the program actually sits today, and what stands between today and Adaptive.

It is a self-assessment. An organization scores itself against 24 domains, each tied to real CERG artifacts and observable evidence. The output is a tier per domain, a tier per pillar, an overall tier, and a ranked list of the gaps worth closing first.

It applies program-wide. It is run at day 1 of adoption to set a baseline, at day 90 to measure first-quarter movement (see CERG-GOV-IMP-001 §5), and annually after that.

A Self-Assessment Is Only Useful If It Is Honest

The temptation in any self-scoring exercise is to score the intention rather than the evidence. CERG maturity scoring has one rule above all others: a domain scores at a tier only if the organization can produce the evidence named for that tier. Not “we do that,” but “here is the artifact.” A maturity score that cannot survive an auditor reading it is worth nothing. Score what you can show.

2. How the Assessment Works

The assessment has four moving parts.

1. Domains. 25 assessment domains, grouped by pillar (Governance, Engineering, Risk) plus a Cross-Pillar group. Each domain is a coherent slice of the program tied to specific CERG artifacts.
2. The tier scale. Each domain is scored against the four NIST CSF tiers: Partial, Informed, Repeatable, Adaptive. Section 3 defines them.
3. Evidence anchors. Each domain lists what the organization must be able to show to claim each tier. Scoring is anchored to evidence, not opinion.
4. The scorecard. Domain scores roll up to pillar scores and an overall score, and the lowest-scoring domains become the gap list.

The assessment is run by the Governance Pillar Leader, scored with the pillar leaders, and reviewed by the CISO. It is not run by one person in a room. A domain tier is agreed by the pillar that owns the work, and challenged by Governance.

This Maps to the Same Tiers the Framework Uses

The four tiers here are exactly the four tiers in CERG-GOV-FRM-001 §6.1. This is deliberate. The framework says where CERG aims; this assessment says where you are on the same ruler. The gap between them is your roadmap.

3. The Tier Scale

A domain never scores above the evidence. If a domain has consistent practice but no metric driving improvement, it is Repeatable, not Adaptive, no matter how well it runs.

4. Scoring Rules

1. Score to the evidence floor. A domain scores at the highest tier for which every evidence anchor at that tier and below can be produced. One missing anchor caps the domain at the tier below.
2. A domain with no adopted artifact is Partial. Tier 2 and above require the governing CERG artifact to be adopted. An un-adopted domain is Partial by definition, score 1.
3. Partial implementation counts as half. Where a domain is genuinely between two tiers, score the lower tier. Do not round up. This mirrors the anti-shallow-metrics discipline in CERG-GOV-MTR-001 §8.
4. Score the domain, not the document. A standard can be beautifully written and score Partial because no one follows it. The score reflects practice and evidence, not prose.
5. One scorer cannot self-clear. The pillar that owns the work proposes the tier; Governance challenges it; the CISO accepts the final score. A domain tier is never set by a single unchallenged voice.
6. Record the evidence. Every domain score is recorded with the specific artifact, register, or report that supports it. A score with no recorded evidence is not a score.

5. The Assessment: Governance Domains

Score each domain 1 to 4 against the tier scale. The evidence column names what supports the Repeatable (3) tier; Adaptive (4) additionally requires a metric or review loop driving improvement.

6. The Assessment: Engineering Domains

7. The Assessment: Risk Domains

8. The Assessment: Cross-Pillar Domains

These domains measure how well the pillars work as one program. They are where the CERG model either delivers on its premise or does not.

9. Scoring the Result

9.1 Domain to Pillar

For each pillar, average its domain scores. Exclude any domain scored N/A (for example, E7 OT for an organization with no operational technology) from both the sum and the count.

Pillar score = sum of in-scope domain scores / count of in-scope domains

9.2 Pillar to Overall

The overall program tier is the average of the four group scores (Governance, Engineering, Risk, Cross-Pillar), then mapped:

9.3 The Honesty Check

Before the score is accepted, the CISO applies one test: the weakest-link read. If any single domain is scored Partial, the program is not Repeatable overall in practice, regardless of the average. A Partial domain is a hole, and an average cannot fill a hole. The CISO records the overall tier and the count of Partial domains. Both numbers are reported.

The Average Can Lie. The Partial Count Cannot.

An organization with twenty Repeatable domains and four Partial ones averages out near Repeatable. But those four Partial domains are four places the program does not function. CERG reports the average and the Partial count side by side, exactly as the metrics standard reports score-sum alongside raw count. A program is only as mature as its weakest in-scope domain.

10. The Scorecard Output

The assessment produces a one-page scorecard. It is the artifact the CISO carries into the Cyber Oversight Group brief.

10.1 Scorecard Layout

CERG MATURITY SCORECARD
Organization: {{ORG_NAME}}        Assessment date: {{ADOPTION_DATE}}
Assessed by: Governance Pillar Leader   Accepted by: CISO

OVERALL TIER:  [ Partial | Informed | Repeatable | Adaptive ]
Overall average: X.XX        Partial domains: N

PILLAR SCORES
  Governance     X.XX   [tier]
  Engineering    X.XX   [tier]
  Risk           X.XX   [tier]
  Cross-Pillar   X.XX   [tier]

DOMAIN RADAR
  A four-axis radar (one axis per group) or a 24-spoke radar (one
  spoke per domain), each axis plotted 1 to 4. The shape shows
  concentration of weakness at a glance.

THIS ASSESSMENT vs LAST
  Per pillar: arrow up / flat / down, with the delta.

TOP FIVE GAPS
  The five lowest-scoring in-scope domains, lowest first, each with
  its governing artifact and the tier it needs to reach.

10.2 Radar Specification

The radar is the headline visual. Plot one axis per assessment domain (24 spokes) or, for a board-altitude view, one axis per group (4 spokes). Each axis runs 1 (center) to 4 (edge). The current assessment is one filled shape; the prior assessment is an outline overlaid on top. A program moving toward Adaptive grows the shape outward over successive assessments. A dent in the shape is a gap, visible without reading a number.

This pairs with the trend-over-snapshot principle in CERG-GOV-MTR-001 §2: the radar is only fully useful from the second assessment onward, when it carries an overlay.

10.3 Cadence

11. Turning Gaps Into Work

A scorecard that is filed and forgotten is vanity. The assessment is only finished when its gaps become tracked work.

1. Every Partial domain becomes a risk register entry. A domain scored Partial is an accepted gap until it is closed. It goes in the register per CERG-PRC-RM-001, with an owner and a target tier.
2. The top five gaps get named owners and dates. The lowest five in-scope domains are the program’s improvement backlog for the period. Each gets a pillar leader as owner and a target date.
3. The next assessment measures the close. A gap is closed when the domain re-scores at its target tier with evidence. The radar overlay shows it.
4. Adaptive is a destination, not a checkbox. A domain reaches Adaptive only when a metric or review loop is demonstrably driving its improvement. Closing gaps to Repeatable is the bulk of the work; reaching Adaptive is the last and hardest step, and it is what CERG-GOV-FRM-001 §6 describes.

The Assessment Is Not the Goal

Scoring the program is half a day of work. Closing the gaps it finds is a year of work. An organization that runs the assessment, files the scorecard, and changes nothing has measured its program without improving it. The deliverable of this document is not a tier. It is the next five things the program will fix.

12. Quarterly Gap Checkpoint

Between annual full assessments, the program operates with a 12-month blind spot. If a gap remediation stalls in month 3, the organization does not discover it until month 12. An Adaptive program runs lightweight quarterly checkpoints to verify that the top gaps are closing on schedule.

12.1 Cadence and Ownership

Quarterly, aligned with the CERG leadership review (GOV-CAL-001 Section 5), the Governance Pillar Leader runs a gap remediation checkpoint. This is NOT a full re-score : domains are not re-evaluated. Only the in-progress gap remediation actions from the most recent full assessment are reviewed.

12.2 Checkpoint Questions

For each open gap committed after the last full assessment, the checkpoint answers four questions:

12.3 Escalation Rules

• Any gap marked “At Risk” for two consecutive checkpoints is escalated to the CISO with a remediation demand.
• Any gap marked “No” (off track) is escalated to the CISO immediately.
• Any domain where evidence has degraded since the last assessment is treated as a new gap and entered into the improvement register (IMPREG-001) with the source “Maturity Checkpoint QN YYYY.”

12.4 Output

The checkpoint produces a one-page Gap Checkpoint Summary, appended to the quarterly CISO brief (MTR-001). It shows:

12.5 Annual Assessment Integration

The quarterly checkpoint feeds the annual full assessment in two ways:

1. Evidence currency. By checking evidence quarterly, the annual assessment runs against evidence that is at most 90 days old, rather than scrambling to collect 12 months of evidence at assessment time.
2. Gap transition. Gaps that transition from simple remediation to complex multi-domain program changes may be moved from MAT-001 tracking to the improvement register (IMPREG-001). The checkpoint is the decision point where a gap owner may request this transition.

The annual assessment remains the authoritative tier re-score. The quarterly checkpoint is a progress review, not a re-score.

13. Document Control

Revision History

Review Triggers

• Any artifact added to or retired from the V1 library, which changes the domain set
• A standalone threat intelligence procedure is added to the catalog (updates domain R6)
• Material change to the tier definitions in CERG-GOV-FRM-001 §6
• Adopter feedback indicating a domain is missing or mis-scoped
• Direction from the CISO

Governance owns this document. The Governance Pillar Leader (Document Control) is responsible for initiating reviews, managing the revision cycle, and obtaining CISO approval for all changes.

Related Documents

Source: governance/CERG-GOV-MAT-001_Maturity_Self_Assessment_and_Scorecard.md · Download .md · View on GitHub