Cybersecurity maturity assessment: one view across four frameworks
Each framework answers a different question. CIS Controls tests technical hygiene, ISO/IEC 27001 tests the management system, NIST CSF 2.0 gives the board a common language, and COBIT links IT to governance. IRM-Advisors assesses you once and maps the results to all four.
- Effort
- Typically 10 to 15 consulting days
- Pricing
- Fixed price, quoted after a 30-minute scoping call.
Who it is for
- Organisations that have never had an independent security assessment
- Boards that want a baseline before investing
- Firms preparing for ISO/IEC 27001 certification or an external audit
- Companies after an incident or a negative audit finding
What you receive
- A maturity score per domain on a 0 to 5 scale
- Findings mapped to CIS Controls, ISO/IEC 27001 Annex A, NIST CSF 2.0 functions and COBIT objectives
- Top risks ranked by business impact
- A 12 to 24-month roadmap with effort and budget ranges
- An executive summary for the board and a detailed report for IT
The 0 to 5 maturity scale
- 0Absent
- 1Initial
- 2Repeatable
- 3Defined
- 4Managed
- 5Optimised
Each domain is scored on this scale, adapted from established capability maturity models, so results stay comparable year after year.
How it works
- ScopingAgree the perimeter, sites, critical processes and the frameworks that matter to you.
- Evidence and interviewsDocument review, interviews with IT, risk and business owners, and targeted technical checks.
- ScoringEach domain is rated on the 0 to 5 scale and mapped across the four frameworks.
- Roadmap and debriefPrioritised actions, presented to management and, if needed, to the board.
Relevant credentials
Selected engagements
- Large Swiss bankDefined and improved the bank’s cybersecurity controls.
- Global healthcare organisationCybersecurity maturity assessment based on the NIST Cybersecurity Framework.
- Large international organisationInsider-threat assessment.
Frequently asked questions
Why combine CIS, ISO 27001, NIST and COBIT?
One framework alone leaves blind spots. A combined assessment shows technical, management-system and governance gaps in one report, so you avoid paying for separate audits.
How long does a maturity assessment take?
Typically 10 to 15 consulting days. The calendar time depends on how quickly your teams are available for interviews.
Is this a certification audit?
No. It is an independent advisory assessment. It tells you how ready you are for certification or a regulatory review, and what to fix first.
What does it cost?
A fixed price, quoted after a 30-minute scoping call.
Discuss your situation in a 30-minute call. No preparation needed.
Book a call