Organizations today 2.35 The goal
Level 1 |
Level 2 |
Level 3 |
Level 4 |
Level 5 |
INITIAL MANAGED DEFINED QUANTITATIVE OPTIMIZED
Unpredictable, reactive |
Managed at project level, reactive |
Managed at org level, proactive |
Processes measured controlled |
Focus on process improvement |
Scoring based on CMM |
|
|
|
|
The boardroom shift is real, too. Cyber risk is now treated as business risk, debated alongside financial performance and operational resilience.
Attackers don ' t exploit board decks or policy documents. They exploit execution gaps, and that ' s exactly where the progress hasn ' t reached.
Prevention Is the Persistent Weakness
Years of investment have made organizations good at reacting to attacks, just not at preventing them. For the second year running, Protect is the lowest-scoring CSF function, and the gap is basic hygiene: the access controls, patching, and asset hardening that stop incidents before they start.
18