A maturity assessment is one of the most requested and least standardised artefacts in governance. Two organizations can each score a 3 out of 5 on ostensibly the same model and mean entirely different things by it — one measuring how thoroughly a control is documented, the other measuring how consistently it is actually operated.The Ambiguity Hiding Inside a Single NumberMost maturity models blend several distinct questions into one score: does the control exist, is it documented, is it consistently performed, is it measured, is it improved over time. An organization can score well on the first two and poorly on the last three, and the blended number gives no way to tell which. A board that hears 'we are a 3.5' has learned almost nothing about where the actual gap is.Questions Worth Asking Before Adopting a ModelWhat exactly does each level measure: existence, documentation, consistency, or effectiveness — pick the model that measures what you actually need to know, not the one with the most familiar name.Who assessed it, and how: a self-assessment and an independent assessment of the same control routinely disagree by a full level or more.Is the model current for what you run: a maturity model built for on-premise infrastructure asks different questions than one built for a cloud-native estate, and applying the wrong one produces a plausible-looking, meaningless score.What decision does the score inform: a number with no attached decision is a data point collected for its own sake, not a governance input.“A maturity score answers the question you asked the model. Most of the disappointment with maturity assessments comes from asking the wrong one.”Using a Score HonestlyA maturity assessment is most useful measured against your own organization over time — this year against last year, on the same model, assessed the same way — rather than against an external benchmark whose assessment method you cannot verify. External comparison has a place, but only once the internal trend line is trustworthy enough to be worth comparing at all.Share this articleX (Twitter)LinkedInFacebookCopy Link
Research ReportJun 19, 2026The Difference Between a Report and a DecisionA well-produced report can sit on a governance committee's agenda for months, cited approvingly, without ever changing what the organization actually does. That is not the report's failure. It is what happens when reading one is mistaken for acting on it.
Benchmark StudyAug 16, 2026Why Cross-Industry Benchmarks Rarely Transfer to Your OrganizationA benchmark built from a mixed sample of industries tells you what an average organization does. It rarely tells you what your organization, with your specific risk profile, should do.
Industry SurveyMay 13, 2026What Self-Reported Survey Data Usually Gets WrongA survey asking security leaders to rate their own programme's maturity is measuring confidence as much as it is measuring maturity, and the two are not always the same thing.
