Cybersecurity Maturity: From Tier 1 to Tier 4 with NIST CSF 2.0

1. Introduction

Cybersecurity maturity measures the degree to which your organization has formalized, consistent and improvable capabilities to identify, protect, detect, respond and recover. It is not the same as sophistication: a small business can be mature for its risk profile without a red team, and a multinational with the most expensive tools on the market can be deeply immature if nobody knows who operates them or what their data actually decides.

In this article we will explain how to assess your company’s cybersecurity maturity with NIST CSF 2.0, what Tiers 1 to 4 really mean, how to complement the analysis with C2M2, ENS and ISO 27001, and which KPIs to present to the board so that security stops being a matter of opinion. We will also propose a phased roadmap with quick wins deliverable in less than six months, aligned with NIS2 and DORA.

2. What Is Cybersecurity Maturity and Why Measure It

Maturity has three dimensions: technical capability (tools and their configuration), organizational capability (processes, roles, documentation and metrics) and strategic capability (integration of security with the business and its leadership). A company that buys a SIEM but has nobody to operate it and no documented response procedures is technically advanced and organizationally immature.

Measuring cybersecurity maturity serves five purposes: prioritizing investment (where the next euro reduces the most risk), communicating with the board in an understandable language (a number or a Tier), meeting regulatory requirements, benchmarking against the sector and preparing for audits or due diligence when a customer or partner requires it. Without that measure, security decisions are made by intuition and available budget rather than evidence.

A key finding of maturity analysis is that it reduces the frequency and impact of incidents, but does not eliminate them. A mature program does not promise zero incidents: it promises early detection and systematic organizational learning.

3. NIST CSF 2.0: Six Functions and Four Tiers

The NIST Cybersecurity Framework 2.0, published in February 2024, is the most widely adopted maturity framework in the world. Its most relevant novelty is the sixth function: Govern (GV), which recognizes that security starts at the top: business priorities, roles, risk policy, supply chain management and active oversight.

NIST CSF 2.0 defines four maturity tiers that describe how the organization behaves, not which tools it owns:

Tier 1 (Partial): ad hoc response, no defined processes and no formal governance; security depends on specific individuals.
Tier 2 (Risk Informed): partially formalized but inconsistent.
Tier 3 (Repeatable): formalized and documented processes, with policy approved by management.
Tier 4 (Adaptive): continuous improvement based on lessons learned, with security integrated into the organizational culture.

In practice, around 75% of the organizations that assess themselves sit between Tier 2 and Tier 3: they already document processes, but consistency and continuous improvement remain pending subjects. The realistic goal for most companies is to stabilize at Tier 3 with elements of Tier 4 in critical functions.

An important nuance: an organization can be Tier 1 in Governance and Tier 3 in Detection. Evaluation by function, not as a global label, is what enables prioritization. The board report should show that distribution instead of a single number that hides the gaps.

4. Complementary Frameworks: C2M2, ENS, ISO 27001 and NIS2

NIST CSF says what to do; the Cybersecurity Capability Maturity Model (C2M2 v2.1, from the US Department of Energy, July 2022) says with what maturity to do it. C2M2 covers 10 domains and defines three MIL levels: MIL1 (Initiated, ad hoc), MIL2 (Performed, defined, planned and documented) and MIL3 (Managed, measured with KPIs, reviewed and improved). It is a natural complement to NIST CSF for assessing concrete capabilities.

In Spain, the Esquema Nacional de Seguridad (ENS, RD 311/2022) provides the mandatory reference for the public sector and a highly indicative one for the private sector: Basic level (limited impact and minimal measures), Medium (serious impact, with additional controls) and High (very serious impact, full control set and mandatory biennial external audit). Indicative equivalences with NIST CSF tiers: Basic between Tier 1 and 2, Medium between Tier 2 and 3, and High between Tier 3 and 4.

Framework	Levels	Approximate NIST CSF equivalent	Recommended use
NIST CSF 2.0	Tier 1 to 4	Reference itself	Global view by function
C2M2 v2.1	MIL1 to MIL3	MIL1≈Tier 1-2, MIL2≈Tier 2-3, MIL3≈Tier 3-4	Capabilities by domain
ENS	Basic, Medium, High	Basic≈Tier 1-2, Medium≈Tier 2-3, High≈Tier 3-4	Public sector and contractors
ISO/IEC 27001:2022	Certified or not	Sustained certification ≈ Tier 3	Third-party trust

Fig. 1 – Maturity frameworks and their approximate equivalents.

ISO/IEC 27001:2022 brings certification with its Annex A of 93 controls in four themes (organizational, people, physical and technological). Sustained certification and the progressive extension of its scope is a solid maturity indicator because it requires measuring, auditing and improving continuously.

5. How to Assess Your Company’s Maturity in Practice

The recommended assessment combines three approaches: a structured self-assessment with the NIST CSF and C2M2 questionnaires, a complementary technical assessment (pentest, configuration review and identity audit to verify that the real posture matches the documented one) and an independent external assessment, annual or biennial, that removes self-perception bias.

# NIST CSF 2.0 self-assessment checklist for Governance (GV)
1. Is there a cybersecurity policy approved by management?
2. Is there a security owner with budget and authority?
3. Is risk analysis updated at least once a year?
4. Are third-party and supplier risks assessed systematically?
5. Are security investment decisions based on data?
6. Are security KPIs reviewed with the board?
7. Is continuous improvement documented and owned?
   (7 "yes" answers = Tier 3; fewer than 5 = Tier 2 or below)

Fig. 2 – Minimum checklist to assess the Governance function of NIST CSF 2.0.

Technical assessment is essential: many organizations score well on paper and poorly in practice. A simple comparison between documented and real posture in three controls (universal MFA, EDR coverage and patching) usually reveals the real maturity.

6. Maturity KPIs and How to Report to the Board

Maturity only holds if it is measured with stable indicators. The most useful KPIs are: MTTD (mean time to detect), MTTR (mean time to respond and recover), percentage of users with MFA (target 100%), EDR coverage and percentage of patched assets (targets: 14 days for CVSS greater than or equal to 7, 7 days for CISA KEV catalog vulnerabilities).

Two indicators deserve special attention. The simulated phishing rate must show a sustained downward trend. And SOC notifications: a decreasing figure can be a bad sign if it means employees report fewer incidents, not that fewer occur. The board report must always distinguish between a real risk reduction and a reduction in visibility.

The board report should be quarterly or semi-annual, with a consistent format, stable indicators with trends, incidents of the period contextualized, investment made with its estimated return and an improvement plan aligned with the master plan. Compare results with the sector and with your own historical baseline: that comparison is the only one that reflects real progress.

7. Phased Roadmap: Quick Wins First

The cybersecurity maturity roadmap has three phases, and no organization goes from Tier 1 to Tier 4 in six months. Phase 1, quick wins with delivery in less than six months, reduces risk with configuration and policy changes: universal MFA, 100% EDR, immutable backups with tested restorations, prioritized patching, mandatory full disk encryption and awareness training with simulated phishing.

# Typical quick win: universal MFA rollout
1. Identity inventory (Entra ID, Google, SaaS, VPN).
2. Conditional access policy with mandatory MFA for all.
3. Documented temporary exception list with review dates.
4. 20-minute training per team and help materials.
5. Sign-in inspection for 30 days (baseline).
6. Exceptions closed and 100% coverage reported.
   (Target: full coverage within 90 days maximum)

Fig. 3 – Practical sequence for implementing a maturity quick win.

Phase 2 builds operational layers: SIEM with use cases and 24/7 operation (in-house or with MDR), a SOC with centralized telemetry and basic hunting, vulnerability management with SLAs, modern IAM with PAM and just-in-time access, a DLP program, a documented, tested and signed incident response plan, and business continuity aligned with ISO 22301. Phase 3 adds proactive capabilities: regular red team exercises, threat hunting with MITRE ATT&CK, threat intelligence integrated with the SOC, formal third-party risk management and certifications such as ISO 27001 or ENS High level.

The whole journey must be captured in a multi-year master plan of two to three years, approved by management with budget by year and measurable milestones with dates and owners. A master plan that is not reviewed is a document; measuring progress against it is what builds maturity.

8. Regulatory Compliance and Maturity: NIS2 and DORA

In 2026, cybersecurity maturity is no longer optional for many European companies. Directive NIS2, transposed in Spain by Royal Decree-Law 7/2025, requires in its article 21 a minimum set of measures: risk management, incident management, business continuity, supply chain security, cryptography, access control and awareness. Fines reach millions of euros, personal liability of executives is explicitly contemplated, and INCIBE acts as the competent authority.

DORA adds, for the financial sector, the obligation of advanced digital resilience testing (TLPT) for significant entities, under supervision of the Bank of Spain, CNMV and DGSFP. Assessing maturity with NIST CSF 2.0 is a reasonable basis to demonstrate compliance: a documented and measured Tier is far better evidence than a policy without execution.

To deepen this view, we recommend our articles on risk analysis for companies and on the PDCA cycle of an ISMS and its certification audit, which complement maturity assessment with practical risk management and management system practice.

9. Conclusion

Cybersecurity maturity is the diagnosis every board should request before deciding the next investment: it places the company on a NIST CSF 2.0 tier, identifies the weakest functions and turns security into continuous risk management with data, KPIs and a master plan with dates. Sustained progress with periodic reviews is what separates programs that work from programs that only spend.

No organization goes from Tier 1 to Tier 4 in six months, but every organization can complete quick wins in that timeframe and stabilize at Tier 3 with adaptive elements in two or three years. Measuring is the first step: the next euro or dollar is invested where measurement proves it is needed.

Need help with Cybersecurity maturity?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.