CSF Security Tiers vs Security Maturity Level

7/22/2020

CSF Security Tiers vs Security Maturity Level
This post is to clarify the different between CSF Tiers and Maturity level.

A security maturity model is a set of characteristics or indicators that represent capability and progression within an organization’s security program.

The Cyber Security Framework Implementation Tiers are not intended to be maturity levels. The Tiers are intended to provide guidance to organizations on the interactions and coordination between cybersecurity risk management and operational risk management. The key tenet of the Tiers is to allow organizations to take stock of their current activities from an organization wide point of view and determine if the current integration of cybersecurity risk management practices is sufficient given their mission, regulatory requirements, and risk appetite. Progression to higher Tiers is encouraged when such a change would reduce cybersecurity risk and would be cost-effective.

NIST CSF Tiers

The NIST CSF Tiers represent how well an organization views cybersecurity risk and the processes in place to mitigate risks. This helps provide organizations a benchmark on how their current operations.

Tier 1 – Partial: Organizational cybersecurity risk is not formalized and managed in an ad hoc and sometimes reactive manner. There is also limited awareness of cybersecurity risk management.
Tier 2 – Risk-Informed: There may not be an organizational-wide policy for security risk management. Management handles cybersecurity risk management based on risks as they happen.
Tier 3 – Repeatable: A formal organizational risk management process is followed by a defined security policy.
Tier 4 – Adaptable: An organization at this stage will adapt its cybersecurity policies based on lessons learned and analytics-driven to provide insights and best practices. The organization is constantly learning from the security events that do occur in the organization and will share that information with a larger network.

You can use the NIST CSF to benchmark your current security posture. Going through each category and subcategories in the core Function can help you determine where you stand on the NIST CSF Tier scale.

Maturity Levels

Level 1: Initial

At this level, there are no organized processes in place. Processes are ad hoc and informal. Security processes are reactive and not repeatable, measurable, or scalable.

Level 2: Repeatable

At this stage of maturity, some processes become repeatable. A formal program has been initiated to some degree, although discipline is lacking. Some processes have been established, defined, and documented.

Level 3: Defined

Here, processes have become formal, standardized, and defined. This helps create consistency across the organization.

Level 4: Managed

At this stage, the organization begins to measure, refine, and adapt their security processes to make them more effective and efficient based on the information they receive from their program.

Level 5: Optimizing

An organization operating at Level 5 has processes that are automated, documented, and constantly analyzed for optimization. At this stage, cybersecurity is part of the overall culture.

Reaching Level 5 doesn’t mean that an organization’s maturity has peaked, however. It means that they are constantly monitoring and evolving their processes to make them better.