C6.5 Maturity

NIST CSF 2.0 [23]; COSO 2026 [2]

The fifth component requires that each layer of the framework carry a current and a target profile, with a tier from one to four on two dimensions, how risk-informed and how repeatable the practice is, in the mechanism of the cybersecurity framework [23], and that the resulting gap and plan be reported to the governing body alongside the risks themselves; the governance framework's 2026 guidance on maturity is the second source [2]. The mechanism is applied to Frame, to Analyze and to Record exactly as it is applied to cyber, so that an organization can say where it stands on each layer in a form auditors and insurers already read.

What this reconciles is the framework's own progress with its content. The adoption stages described later in the book say what to build first; the maturity profile says how far the building has got, and it respects the source's caution that tiers are not grades of the controls but descriptions of the organization. A tier 2 on Respond means that the hierarchy levels are recorded but the decay profiles are not yet driving re-test frequency; the target, tier 3 by a date, is a plan the board can hold someone to. The marker appears on the principal-risk page as one line, and it is the line that tells the board how much to trust the rest of the page.