1. Why We Measure Maturity
Cybersecurity investment without measurement is opinion. Boards approve budgets based on confidence in numbers. Regulators expect documented programs. Insurers price coverage against demonstrated controls. Counsel defends “reasonable security” against measurable benchmarks. A maturity assessment converts the question “how good is our cybersecurity?” from a subjective answer to a defensible one.
Three audiences benefit from a measured maturity baseline:
- The Board and Executive Team gain a common language to discuss cybersecurity risk alongside enterprise risk, financial performance, and operational priorities. A composite score and tier rating translate technical posture into business terms.
- Regulators, auditors, insurers, and counsel increasingly require evidence of a structured, framework-based approach. The FTC, NYDFS, HHS OCR, FFIEC, and most state attorneys general apply a “reasonable security” standard that effectively expects framework alignment. Cyber insurance underwriting routinely asks for framework-mapped self-attestation.
- Operations and IT gain a prioritization tool. With every NIST subcategory scored, the organization can sequence investment, retire control debt, and demonstrate measurable progress year over year.
Why this matters operationally
A maturity baseline is not an academic exercise. It is the foundational artifact from which every downstream Hartman CRMS deliverable is built: the Plan of Action and Milestones (POAM), the Cybersecurity Roadmap, the Board Reporting Dashboard, and the Enterprise Risk Register.
2. Why the NIST Cybersecurity Framework
NIST CSF is the right scoring framework for mid-market and enterprise organizations across virtually every sector. Six reasons drive that conclusion.
- Risk-based, not prescriptive. CSF defines what outcomes the organization should achieve, not how to achieve them. The framework scales from a fifty-person community health center to a national defense contractor. Smaller organizations achieve the same outcomes with proportionate controls.
- Sector-agnostic by design. CSF 2.0 (February 2024) explicitly broadened applicability beyond critical infrastructure to all organizations regardless of sector or size. CSF is now the de facto common framework across healthcare, financial services, nonprofits, defense, technology, manufacturing, and government.
- Cross-mapped to every major regulation. NIST publishes formal crosswalks to the HIPAA Security Rule, GLBA Safeguards Rule, PCI DSS, SOX ITGC, FFIEC IT Examination Handbook, CMMC, ISO 27001, COBIT, and NIST SP 800-53. One CSF-aligned program satisfies the structural requirements of most overlapping regimes simultaneously.
- Common language with auditors, insurers, regulators, and counsel. The CSF function names (Govern, Identify, Protect, Detect, Respond, Recover) are industry shorthand. Communicating in CSF reduces translation friction in every external interaction.
- CSF 2.0 added the Govern function. The most consequential change from CSF 1.1 to 2.0 was the addition of the Govern (GV) function, which makes cybersecurity strategy, accountability, oversight, and enterprise risk management explicit and central. This change formally connects cybersecurity to board-level oversight and closes the historical gap between technical security and executive governance.
- Recognized standard of care. Courts, regulators, and insurers increasingly treat CSF alignment as evidence of reasonable security. Aligning to CSF, scoring against it, and documenting the improvement journey is the working baseline of due diligence.
3. A Baseline, Not an Audit
A common executive concern is whether a maturity assessment will “fail” the organization, expose it to liability, or create a paper trail of unaddressed gaps. The answer is no, because a maturity assessment is not an audit. The distinction is fundamental.
| Audit | Maturity Assessment |
| Tests compliance against a specified control set at a point in time | Measures how cybersecurity is governed, managed, and operated on a continuum |
| Produces pass/fail or compliant/non-compliant findings | Produces a position on a scale and a roadmap for advancement |
| Answers: “Did you have control X in place on the date we tested?” | Answers: “How disciplined, repeatable, and integrated is the way you manage cybersecurity, and what does it take to advance?” |
| Backward-looking, evidentiary | Forward-looking, strategic |
The maturity assessment is the foundation for the roadmap. Without a measured starting point, every subsequent investment is justified by opinion rather than evidence. With it, the organization can demonstrate year-over-year improvement, defend its security posture to regulators and insurers, and prioritize spend with confidence.
Standard of care
A documented baseline accompanied by a credible improvement trajectory is increasingly the regulatory standard of care. The absence of a baseline, not the presence of gaps within one, is what creates exposure.
4. What the Tiers Mean for the Business
Important note on terminology
NIST is explicit that the four CSF Implementation Tiers are not formal maturity levels in the CMMI sense. NIST CSF 1.0 stated, and CSF 2.0 reaffirms, that Tiers describe the rigor of cybersecurity risk management practices and are not a ladder organizations must climb sequentially. Hartman adopts the Tier construct as our scoring rubric because it preserves NIST’s design intent (the right destination is the tier that fits the organization’s risk appetite, regulatory floor, and resources, not Tier 4 by default) while providing the practical benchmarking value that executives and boards require.
Tier 1 · Partial (Composite score 1.0 to 1.9)
Operating Reality
Cybersecurity is informal, reactive, and dependent on individuals. Risk management happens at the IT or departmental level with limited executive visibility. There are tools but few documented processes. Incidents are detected late, response is heroic rather than rehearsed, and recovery is expensive.
Business implications:
- Cyber insurance premiums are elevated and coverage exclusions are broad
- Regulatory exposure is meaningful and difficult to defend in examination or enforcement
- M&A diligence will identify cybersecurity as a material risk
- Incident response cost is unpredictable and typically substantially higher than at Tier 3
Tier 2 · Risk Informed (Composite score 2.0 to 2.9)
Operating Reality
Leadership is aware of cybersecurity as a business risk. Some policies exist, some controls are implemented, but adoption is uneven across the organization. Cybersecurity is recognized but not yet embedded in operational decision-making or enterprise risk management.
Business implications:
- Insurance coverage is more accessible, but premiums reflect the inconsistency
- Regulatory examinations will identify governance and consistency gaps
- The organization is vulnerable at the weakest department, system, or vendor
- Leadership conversations have shifted from “should we?” to “how do we?”
Tier 3 · Repeatable (Composite score 3.0 to 3.9)
Operating Reality
Cybersecurity is governed, documented, and consistently applied across the organization. Policies are enforced, controls are standardized, risk assessments are routine, and the Board has structured visibility. Cybersecurity is integrated into enterprise risk management. This is the practical target tier for most mid-market and enterprise organizations.
Business implications:
- Cyber insurance underwriting is favorable and renewals are predictable
- Regulatory examinations and audits are defensible without significant remediation pressure
- Incident response is rehearsed, scoped, and substantially lower-cost
- M&A diligence will validate cybersecurity as managed rather than flag it as a risk
Tier 4 · Adaptive (Composite score 4.0)
Operating Reality
Cybersecurity is continuously improved, data-driven, and predictive. The organization adapts to the threat landscape in near real-time, integrates threat intelligence into operational decisions, and treats security as a business enabler. Investment is justified by measured outcomes.
Business implications:
- Cybersecurity is a competitive differentiator and an enabler of regulated business
- Insurance, regulatory, and audit posture is best-in-class
- Investment intensity is high; sustaining Tier 4 requires significant ongoing resources
- Appropriate for high-value targets, large regulated enterprises, federal contractors handling controlled information, and systemically important entities
5. How We Score
Hartman scores maturity at the NIST CSF subcategory level using a four-dimension rubric. Each dimension is scored from 1.0 to 4.0, then averaged to produce the subcategory score.
| Dimension | Question Answered |
| Approach | Is the practice planned and intentional, or ad hoc? |
| Policy | Is the practice documented, authorized, and communicated? |
| Controls | Is the practice technically and operationally implemented? |
| Evidence | Can the practice be demonstrated to an auditor, regulator, or insurer? |
Subcategory scores are aggregated to the CSF function level (Govern, Identify, Protect, Detect, Respond, Recover), then aggregated to a single composite score for the organization.
Understanding the decimal score
Hartman reports both the integer Tier and the decimal composite. The Tier tells the reader where the organization is. The decimal tells the reader where in the Tier the organization sits, and which direction it is moving.
| Score | Tier | What it means |
| 1.8 | Tier 1 (Partial) | Solidly Tier 1, with some Tier 2 practices in evidence but not consistently applied. Improvement momentum is present. |
| 2.2 | Tier 2 (Risk Informed) | Recently entered Tier 2. Foundational governance is in place but consistency across the organization is the next material work. |
| 2.8 | Tier 2 (Risk Informed) | Mature Tier 2. Several CSF functions are operating at Tier 3. The organization is positioned for the inflection point into Tier 3. |
| 3.2 | Tier 3 (Repeatable) | Solidly in the target tier for most mid-market organizations. Focus shifts from building capability to sustaining and measuring it. |
| 4.0 | Tier 4 (Adaptive) | Continuous improvement, real-time adaptation, and predictive risk management are operating across all functions. Appropriate where risk profile justifies the sustained investment. |
Why decimal scoring matters
Decimals show directional momentum within a tier. A client moving from 1.8 to 2.3 over twelve months has demonstrated measurable progress and earned defensible credit for it, even before formally reaching the next tier. This is critical for board reporting, regulatory examinations, and insurance renewals, all of which value documented trajectory.
The right target tier is the intersection of three considerations:
| Consideration | Question to Answer |
| Risk Appetite | How much residual cyber risk is the organization willing to carry, in dollar, operational, reputational, and mission terms? |
| Regulatory Floor | What is required by sector regulators, contractual obligations, insurance underwriters, and counsel? |
| Resource Capacity | Can the organization fund and staff the program at the target tier on a sustained basis, not just to achieve it once? |
Hartman recommendation
For most Hartman CRMS clients, Tier 3 (Repeatable) is the right target. Where a higher target is warranted, Hartman recommends Tier 4 only after explicit Board acknowledgment of the sustained investment commitment and the risk-appetite rationale. The target tier is established as part of the SRA based on the specific intersection of these three factors for the client.
Each overlay is a short framing module that gets inserted into the SRA narrative immediately after Section 2 (Why NIST CSF). The overlay highlights the regulatory framework crosswalks and the practical implications for the client’s sector. Use only the overlay that matches the client. Two overlays may be combined where the client operates across sectors (e.g., a healthcare nonprofit).
Healthcare
For healthcare organizations, NIST CSF maps directly to the HIPAA Security Rule (45 CFR §§ 164.302–164.318), the HIPAA Security Rule NPRM (December 2024), the HHS Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs), and the HITRUST CSF. A CSF-aligned maturity assessment satisfies the documentation and risk analysis requirements of 45 CFR 164.308(a)(1)(ii)(A) and provides defensibility against an OCR enforcement action. For 42 CFR Part 2 programs, FQHCs, and behavioral health entities, the CSF Govern function captures the governance and consent management requirements that an audit-only approach would miss.
Practical target for healthcare
Tier 3 is the practical floor for HIPAA-covered entities. Larger health systems, those handling research data, and those operating across multiple covered functions (covered entity plus business associate plus 42 CFR Part 2) should target Tier 3 with selected Tier 4 capabilities in Govern, Detect, and Respond.
Financial Services
For financial services organizations, NIST CSF maps to FFIEC IT Examination Handbook expectations, NYDFS 23 NYCRR Part 500, the GLBA Safeguards Rule (16 CFR Part 314), SEC Cybersecurity Disclosure Rules (Item 106 of Regulation S-K), and the FFIEC Cybersecurity Assessment Tool successor (the Cyber Risk Institute Profile and CISA’s Sector-Specific Goals). A CSF-aligned program is increasingly the expected posture for examination cycles and is the operating language of cyber insurance underwriting in the sector.
Practical target for financial services
Tier 3 is the regulatory and underwriting baseline. NYDFS Part 500 covered entities, public companies with SEC disclosure obligations, and institutions with significant third-party risk exposure should target Tier 3 with Tier 4 capabilities in Govern (specifically board oversight and risk reporting) and Respond.
Nonprofit
Nonprofit organizations sit at a difficult intersection of risk and resource constraint. Many manage donor records, multi-tiered financial information, healthcare and other privacy data, and beneficiary records with operational complexity comparable to for-profit counterparts but at a fraction of the budget and headcount. Sector research indicates that approximately 64% of nonprofits report limited full-time IT or cybersecurity staffing, and nearly 59% have historically provided no cybersecurity training to staff. The aggregate behavioral pattern across the sector aligns with NIST CSF Tier 1 to Tier 2.
The path forward is not primarily a technology investment. It is a governance and process discipline investment, which is precisely what the CSF maturity framework is designed to support. The transition from Tier 2 to Tier 3 is most often triggered by one of three events: a significant cybersecurity incident, regulatory or grantor compliance pressure, or board recognition of reputational and financial risk.
Practical target for nonprofit
Tier 3 is the right target for most mid-market nonprofits, particularly those with healthcare components (FQHCs, behavioral health), federal grant exposure (HHS, DOJ, NSF), or donor data of material volume. For smaller community organizations with limited regulated data, a high Tier 2 with selected Tier 3 capabilities in Govern, Identify, and Recover may be the appropriate posture.
Defense Industrial Base (CMMC)
For Defense Industrial Base (DIB) organizations, NIST CSF aligns with NIST SP 800-171 Rev. 3 (the controls underlying CMMC Level 2) and NIST SP 800-53 Moderate (the controls underlying CMMC Level 3 enclaves). A CSF-aligned maturity baseline accelerates CMMC readiness by establishing the governance, evidence, and process foundation that C3PAO assessors expect. For organizations handling CUI under DFARS 252.204-7012 and the CMMC Final Rule (32 CFR Part 170), a CSF Tier 3 posture is the practical floor for CMMC Level 2 certification readiness.
Practical target for DIB
Tier 3 is the floor for any organization pursuing CMMC Level 2 or Level 3 certification. CMMC Level 3 organizations should target Tier 3 across all functions with Tier 4 capabilities in Detect, Respond, and Govern. Hartman’s CRMS CMMC service line operates on this baseline.
Government and Public Sector
For state and local government, federal contractors, and public-sector grantees, NIST CSF maps to FISMA, FedRAMP and StateRAMP, NIST SP 800-53 (Moderate or High baseline depending on impact level), and the state-specific data protection and breach notification regimes. CSF alignment is the connective tissue across federal, state, and grant-specific cybersecurity expectations. For systemically important state agencies and entities operating in the .gov ecosystem, the Cybersecurity and Infrastructure Security Agency (CISA) Sector-Specific Goals and the State and Local Cybersecurity Grant Program (SLCGP) review criteria are CSF-aligned.
Practical target for government and public sector
Tier 3 is the operating floor for FISMA Moderate systems and most state agency programs. Federal contractors operating at FISMA High or handling categorized CUI should target Tier 3 with Tier 4 capabilities in Detect, Respond, and Recover.
Reference Notes
NIST CSF 2.0 was published on February 26, 2024 by the National Institute of Standards and Technology. The Implementation Tier model (Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable, Tier 4 Adaptive) was retained from CSF 1.0/1.1 and continues to be described by NIST as a benchmarking tool that is not a formal maturity model. The Hartman scoring rubric adopts the Tier construct as a maturity scoring overlay while preserving NIST’s design intent. Primary source: NIST CSF 2.0 (NIST.CSWP.29, February 2024), NIST SP 1302 (CSF 2.0 Quick Start Guide).
