Established organizations
A program already exists. What is missing is an independent measure of whether it is working.
Home/Services/Cyber Risk and Maturity
Cyber Risk and Maturity
Know what your security program is worth, in maturity and in dollars
Established organizations need to know where the security program stands, how much risk remains, and whether spending is producing a result. We set a defensible maturity baseline against NIST CSF 2.0 or the CIS Controls, quantify the loss exposure of the scenarios that matter, and re-measure on the cadence your board and budget cycle require.
Frameworks and standards in this practice
- NIST CSF
- CIS Controls
- FAIR
Who it is for
Three situations this practice answers
Boards and audit committees
Oversight and disclosure obligations that need reporting management cannot produce about its own work.
Organizations planning for disruption
Response and recovery depend on plans, playbooks, and recovery objectives nobody has tested.
What it solves
The problems clients bring to this practice
- Security spending is defended with activity counts rather than risk reduction.
- The only assessment of the program was performed by the people who designed it.
- Risk is described in colors, and finance cannot compare it to any other risk the business carries.
- The board pack is rebuilt from scratch every quarter.
- An incident response plan exists on paper and has never been exercised.
- Recovery objectives are contractual commitments that have never been tested.
What you receive
Named deliverables, not a summary of findings
Every engagement in this practice produces artifacts somebody outside your organization can read and rely on.
- A capability maturity baseline scored by domain against NIST CSF 2.0, the CIS Controls, or your regulatory obligations.
- Loss exposure ranges for named risk scenarios, calculated with Factor Analysis of Information Risk (FAIR).
- A risk register, a risk appetite statement, and treatment and acceptance workflows.
- Key performance and risk indicators with data sources and thresholds, and a reporting pack for operators, executives, and the board.
- An incident response plan with scenario playbooks, and tabletop exercises with the decision gaps they exposed.
- A business impact analysis with tested recovery objectives and dependency mapping.
- A reassessment on an agreed cadence, measured against the same baseline.
How an engagement works
The sequence, and what each step produces
Described as a sequence rather than a schedule. Duration depends on scope, and is agreed in the statement of work.
01
Baseline
Measure capability against the framework or obligation that applies, on evidence rather than self-assessment.
02
Quantify
Express the scenarios that matter in financial terms, so they can be compared and ranked.
03
Prioritize
Rank improvements by risk reduction against effort, sequenced for your constraints.
04
Re-measure
Repeat the measurement annually, or quarterly during active improvement, against the same baseline.
Services
14 services in this practice
Each has its own page setting out what it covers, who it is for, and what you receive.
- Cybersecurity Maturity AssessmentA capability maturity assessment mapped to NIST CSF 2.0 or the CIS Controls, establishing a defensible baseline and the improvements that matter most.Risk and maturity
- Periodic Reassessment and Continuous MeasurementAnnual or quarterly re-measurement against your baseline, showing progress over time and keeping leadership current on risk and regulatory change.Risk and maturity
- Cyber Risk QuantificationExpress cyber risk in dollars using FAIR: loss exposure ranges for the scenarios that matter, so boards and finance can prioritize security investment.Risk and maturity
- Enterprise Risk Management Program DesignBuild the risk function: taxonomy, methodology, register, appetite statement, treatment and acceptance workflows, and reporting to leadership and the board.Risk and maturity
- Control Testing and AssuranceIndependent testing of control design and operating effectiveness, producing evidence that supports management assertions, filings, and audit efficiency.Risk and maturity
- Security Metrics and Reporting ProgramDesign the security measurement layer: key performance and risk indicators, data sources, thresholds, and reporting for operators, executives, and boards.Risk and maturity
- Board and Executive Advisory ReportingBoard and executive security reporting packages and briefings that support director oversight and disclosure obligations, prepared and delivered for you.Risk and maturity
- Security Strategy and Investment PlanningA multi-year security strategy aligned to business goals, regulatory trajectory, and budget, including build versus buy decisions and the staffing model.Risk and maturity
- Cyber Insurance Readiness and Application SupportImprove cyber insurance outcomes with accurate application responses, the control evidence underwriters require, and a coverage review against real risk.Risk and maturity
- Ransomware Readiness AssessmentTest your resistance to and recoverability from ransomware: access vectors, privileged access, backup isolation, recovery time, and decision framework.Risk and maturity
- Business Continuity and Disaster Recovery AssessmentEvaluate continuity and recovery capability, including business impact analysis, tested recovery objectives, dependency mapping, and exercise programs.Risk and maturity
- Incident Response Plan and Playbook DevelopmentAn incident response plan and scenario playbooks for ransomware, business email compromise, exfiltration, insider events, and third-party compromise.Risk and maturity
- Tabletop ExercisesTechnical, executive, and board tabletop exercises built on realistic scenarios from your environment, exposing decision gaps before an incident does.Risk and maturity
- Post-Incident Assessment and Root Cause AnalysisIndependent post-incident review of root cause, control failures, and response performance, with findings suitable for boards, regulators, and insurers.Risk and maturity
Questions
Frequently asked questions
What is a cybersecurity maturity assessment?
A cybersecurity maturity assessment measures how well an organization's security capabilities are defined, implemented, measured, and improved, scored on a capability maturity model scale across domains such as governance, protection, detection, response, and recovery. The result is a baseline showing where capability is strong, where it is weak, and which improvements reduce the most risk.
What is FAIR cyber risk quantification?
Factor Analysis of Information Risk (FAIR) is a standard model for expressing cyber risk in financial terms. It estimates how often a loss event is likely to occur and how much it would cost, producing loss exposure ranges that let boards and finance leaders compare security investments by expected loss reduction.
Why does incident planning sit in this practice?
Because readiness is a capability that can be measured like any other. Plans, playbooks, exercises, and tested recovery objectives each have a maturity level, and they are assessed on the same baseline as the rest of the program. Data Fiduciaries advises on readiness and does not provide emergency incident response.
How often should maturity be reassessed?
Most established enterprises reassess annually, in line with budgeting and board reporting cycles. Organizations in active program build-out or certification acceleration benefit from quarterly measurement. Cadence is agreed with each client.
Related
Practices most often engaged alongside
Certification Readiness
Reach a clean SOC 2, ISO 27001, PCI DSS, or HITRUST report without the audit becoming the project.
View practiceThird-Party Risk and M&A
Judge the security of a vendor, a target, or a portfolio company before the commitment is made.
View practicevCISO and Fractional Leadership
Senior security leadership at the commitment level you need, without a full-time executive hire.
View practiceStart with a confidential conversation
Thirty minutes on where your program stands against this standard, and what would have to be true for the answer to hold up.