NS-CMMF v1.0
The most comprehensive, consultable, and regulatory-aligned cybersecurity maturity framework available — replacing fragmented compliance checklists and opaque maturity ratings with a single, evidence-based instrument for measurement and continuous improvement.
Ask any experienced CISO whether their organisation is compliant, and you'll hear 'yes'. Ask them whether it is secure, and the conversation becomes considerably more nuanced. This gap is a structural failure of frameworks relied on for more than two decades.
A single Level 3 rating for 'Endpoint Protection' can conceal an enormous range of operational realities — full-coverage behavioural EDR, automated patch management, and application allowlisting scores identically to legacy antivirus on 70% of endpoints with no formal patch process. The difference is the difference between containing a ransomware attack and losing 60% of systems before detection.
NS-CMMF addresses this through Cybersecurity Maturity Intelligence — 270 specific, auditable controls replacing broad categories, with control-level regulatory mapping at article granularity, and financial quantification of every finding.
Domain Weights & Coverage
NS-CMMF maps to the 6 NIST CSF 2.0 domains. Domain weights reflect empirical observation of where organisations actually fail under regulatory scrutiny — PROTECT carries the highest weight at 27%.
Framework Specification
NS-CMMF scores every control across five independent dimensions, applies seven non-negotiable hard gates, and maps each finding to its applicable regulatory obligations at the article level — producing an assessment that is simultaneously board-ready, audit-ready, and investment-grade.
Design · 20% |
Is the control well-designed for its intended purpose? Policy documented and reviewed within 12 months; regulatory mapping explicit; design addresses the specific threat scenario; approved by the appropriate authority. |
Coverage · 25% |
Is the control deployed across 100% of the in-scope population? Coverage ≥ 95% of in-scope assets; exceptions formally documented with named owner and expiry; scope confirmed through automated discovery. |
Operating · 25% |
Does the control operate consistently in production? 3-month operational evidence available; SLA adherence ≥ 95%; exceptions trigger formal exception process; no evidence of control bypassing or workarounds. |
Monitoring · 20% |
Is the control independently tested and validated? KPI or KRI defined and measured; annual independent test; exceptions trigger formal escalation; trend reporting active. |
Automation · 10% |
Is the control automated, self-healing, and continuously evidenced? Partial automation of evidence generation; alert on control failure; evidence does not rely entirely on manual collection. |
Framework Alignment |
32 frameworks and regulations mapped at article and section level — NIST CSF 2.0 · ISO/IEC 27001:2022 · CIS Controls v8 · GDPR · NIS2 · DORA · Cyber Resilience Act · HIPAA · SOX · PCI DSS v4 · FedRAMP · EU AI Act · NIST AI RMF · ISO 42001 · OWASP LLM Top 10 · IEC 62443 and more. |
Hard Scoring Gates |
Seven non-negotiable ceiling constraints prevent any composite score from exceeding a defined level regardless of the five-axis score:
No owner → Max L2
No 3-month evidence → Max L3
No KPI/KRI → Max L4
No automation → Max L5
Reg obligation unmet → Max L2
Interview-only evidence → Max L2
Attestation-only → Max L1.5
|
Assessment Tool |
Excel-native workbook with auto-scoring, 1,350 auto-generated recommendations (5 per control × 270 controls), priority roadmap auto-sorted by Gap × Domain Weight, 32-framework filter for instant regulatory evidence packaging, 44-row assessment history for longitudinal tracking, and 200-row evidence register with expiry management. |
Delivery Model |
10–12 business day engagement from scoping to final delivery. 188+ stakeholder interviews across CISO, CTO, DPO, Head of IT, AppSec, Cloud, and OT leads. Deliverables: scored assessment tool, regulatory exposure matrix, prioritised 12-month roadmap, board presentation, and 32-framework compliance reports. |
AI, Cloud & OT — Natively Addressed
Legacy frameworks respond to new threats at the pace of their governance committees — typically 3–5 years between major updates. NS-CMMF was built from the ground up for today's attack landscape, not retrofitted from a 2018 baseline.
What an NS-CMMF Assessment Produces
The output is not a report — it is an evidence base, a precision roadmap, and a financial model that any board member, regulator, or investor committee can act on directly.
Board-Ready Maturity Score
A weighted overall score defensible before a board audit committee — based on specific, documented evidence at the control level, not a traffic-light dashboard. A board member who asks "how do we know this control works?" gets directed to 3-month operational evidence and KPI trend data.
Regulatory Evidence Packages
The 32-framework filter generates instant regulatory evidence packages. When a regulator requests DORA ICT risk management capability evidence, the package for all DORA-mapped controls is immediately available — assembled during the assessment, not reconstructed under time pressure.
Prioritised Improvement Roadmap
1,350 auto-generated recommendations sorted by Priority Score (Gap × Domain Weight). A control currently at L2 receives the L2→L3 recommendation — not generic advice to 'improve'. Each recommendation includes effort estimate, target quarter, owner assignment, and status tracking.
Longitudinal Assessment History
44-row assessment history providing a board-presentable, audit-ready evidence trail demonstrating consistent security programme maturity over 3–5 years of quarterly or semi-annual assessments — one of the most compelling evidence artefacts in regulatory investigations and M&A due diligence.
Cybersecurity Maturity Platform
Purpose-built for continuous NS-CMMF assessment, scoring, and executive reporting. Turns point-in-time audits into a live maturity index that boards can track and regulators will accept. Auto-populates the roadmap from assessment findings, generates 32-framework regulatory evidence packages on demand, tracks evidence expiry through a 200-row evidence register, and produces board-ready reports with a single export.