How to run a cybersecurity maturity assessment with the NIST Cybersecurity Framework (CSF 2.0)

Most organizations have had a cybersecurity assessment. Far fewer have one they still use.

The usual pattern is familiar. A team spends weeks answering control questions, collects a folder of policies, and receives a report with a maturity score and a long list of findings. The report is accurate on the day it’s delivered. Six months later, nobody is sure which findings were closed, the score hasn’t moved, and next year’s assessment starts again from a blank spreadsheet.

A cybersecurity maturity assessment is worth doing when it produces three things: an honest picture of where your program stands, a view of which gaps matter against the threats you actually face, and a cybersecurity roadmap you can execute. The NIST Cybersecurity Framework is the most common place to start.

What a cybersecurity maturity assessment measures

A maturity assessment asks how reliably your organization performs each security outcome, not just whether a control exists. Having an incident response plan is one thing. Testing it, updating it after each exercise, and measuring how well it works is another.

That’s the difference between a compliance checklist and a maturity model. A checklist tells you whether a box is ticked. A cyber security maturity model tells you how far along each capability is, and what the next level looks like.

The NIST Cybersecurity Framework (CSF 2.0)

NIST CSF 2.0 organizes cybersecurity outcomes into six functions:

• Govern: the strategy, roles, policies and oversight that direct the program. This function is new in CSF 2.0.
• Identify: understanding your assets, suppliers and risks.
• Protect: the safeguards that manage those risks, from identity and access to data security and platform security.
• Detect: finding and analyzing possible attacks and compromises.
• Respond: acting on a detected incident.
• Recover: restoring assets and operations after an incident.

Each function breaks down into categories and subcategories. The subcategories are where an assessment does its real work, because each one describes a specific outcome you can assess with evidence.

The framework says what outcomes to achieve. It deliberately doesn’t say how mature you are at each one. That’s the job of the maturity scale you assess against.

NIST CSF maturity levels: a 1–5 scale

The CSF includes Implementation Tiers, which describe how rigorous your overall risk management practices are. Tiers are useful, but they’re not a maturity score for each control. Most teams assess subcategories against a 1–5 maturity scale instead. In general terms:

1. Initial: the outcome happens ad hoc, if at all, and depends on individuals.
2. Managed: there’s basic ownership and the work is repeatable.
3. Defined: the process is documented, consistent and part of a roadmap.
4. Measured: performance is tracked, and the results drive improvement.
5. Optimizing: the capability improves continuously and adapts to change.

The value of a scale like this is consistency. When every subcategory is scored against written criteria for each level, two assessors reach the same answer, and next year’s score can be compared with this year’s.

Where CIS Controls fit

The CIS Controls take a more prescriptive approach. Where the CSF describes outcomes, the CIS Controls describe specific safeguards, grouped into 18 controls. They’re organized into three Implementation Groups:

• IG1 is essential cyber hygiene for every organization.
• IG2 and IG3 add safeguards for organizations with more complex environments and higher risk.

Many teams use both. The NIST Cybersecurity Framework gives the board-level structure, and CIS Controls v8.1 gives a concrete list of security controls to implement. A good assessment maps between them, so the work counts once.

Organizations with federal contracts also need to show their status against NIST SP 800-171 for CMMC 2.0. That’s a separate set of requirements, and it’s worth planning for alongside the CSF.

Evidence beats self-reporting

The weakest point of most maturity assessments is that they’re self-reported. Someone answers “yes, we do that” and the score goes up. Nobody checks whether the policy exists, whether it’s current, or whether it says what the answer claims.

An assessment you can defend ties every answer to evidence. That means policies, standards, procedures, configuration records and logs. When the evidence is missing, outdated or contradicts the answer, the assessment should say so, not quietly score it.

This matters most when the results go to a board, an auditor or a client. A maturity score backed by cited evidence holds up. A score backed by memory doesn’t.

Maturity isn’t the same as threat coverage

A program can score well on maturity and still be exposed. Maturity tells you how well your security controls are run. It doesn’t tell you whether they cover the attacks most likely to hit you.

That’s where MITRE ATT&CK® comes in. ATT&CK catalogs the techniques real threat groups use. Different industries face different groups, and those groups use different techniques. Mapping your controls and tools to the ATT&CK techniques used against your industry shows which gaps actually expose you, and which are low priority for your threat profile.

A maturity assessment that includes threat coverage changes the conversation. Instead of “we’re a 2.4 in Protect”, you can say “our weakest coverage is against the techniques ransomware groups use against our sector, and these three controls close most of it”.

From gaps to a cybersecurity roadmap

Findings don’t improve a program. Work does. The last step of a maturity assessment should turn gaps into a cybersecurity roadmap:

• Prioritize by risk, not by count. Rank gaps by the threat coverage they would add and the maturity targets they would reach, not by how many findings sit in each function.
• Set targets that fit. A regional manufacturer and a national bank shouldn’t aim for the same maturity in every category. Start from benchmarks for your industry and adjust.
• Fit the plan to reality. A roadmap that ignores budget, owners and timeframes won’t be executed. Build those constraints in from the start.
• Link every item to the gap it closes. Then next year’s assessment can show which work moved which score.

How Acuity Essentials runs a NIST CSF maturity assessment

Acuity Essentials was built to make this process repeatable:

• Guided assessments against NIST CSF 2.0 and CIS Controls v8.1, with guiding questions for every control and CIS Implementation Group mapping, plus NIST 800-171 (CMMC 2.0) assessments.
• Documents first: upload your policies and evidence, and Acuity’s AI drafts the self-assessment for your team to review.
• Evidence-checked answers: Acuity checks each control’s answers against your documents, flags unsupported claims and asks targeted follow-up questions, citing the evidence it used.
• Maturity scoring for every CSF 2.0 subcategory on a 1–5 scale, with a rationale and how close you are to the next level.
• Threat coverage against the MITRE ATT&CK techniques that matter for your industry.
• Gap analysis across tools, maturity and policies, with maturity targets pre-filled from industry benchmarks.
• AI roadmaps that take your goals, budget, owners and timeframe, and return prioritized recommendations linked to the gaps they close.

The numbers behind scores, coverage and gaps are computed the same way every time. AI does the reading and writes the narrative. That keeps your results repeatable and explainable, from one assessment to the next.

See it on your own program

If your last assessment is already out of date, we’d like to show you what a cybersecurity maturity assessment looks like when it ends in a roadmap.

Book a demo or explore Acuity Essentials.