Measuring Cybersecurity Maturity with the NIST CSF
summary
Replaces Gartner’s vague advice with a concrete roadmap by mapping each of the NIST Cybersecurity Framework’s 23 categories to a six‑point maturity scale (0–5), assessing current versus desired states, flagging gaps as risks, and entering them into an open‑source GRC to plan mitigations. Targets a level 3 baseline for most controls, scores risks on a 0–10 scale (example risk = 6/10), and prioritizes work as burning fires, quick wins, long‑term projects, or management objectives.
AI-written summary · about
chapters (33)
- 0:00Introduction
- 1:20Agenda
- 1:37Background
- 2:19gartner assessment
- 2:46Organizational cybersecurity maturity
- 3:48Cybersecurity maturity roadmap
- 4:56NIST 800171
- 5:34NIST Cybersecurity Framework
- 6:04NIST Cybersecurity Framework Categories
- 6:19Asset Management
- 6:47Assess Current Maturity
- 10:11Be Honest
- 10:37Consider Your Environment
- 11:12Defend Your Responses
- 12:03Assessing Your Maturity
- 13:35Be Reasonable
- 13:45Desired State
- 14:57Assigning Ownership
- 15:47Risk
- 16:07Example
- 17:05Define Controls
- 17:50Capture Risk
- 18:15Risk Factors
- 19:26Risk Score
- 19:44Mitigations
- 21:03Measuring Cybersecurity Maturity
- 22:22Burning Fires
- 22:55Quick Wins
- 23:45Long Term Work
- 24:18Management Goals
- 25:37Ownership
- 27:17Summary
- 28:23Thank you
related talks
35mRevolutionizing Cyber Defense: The NIST CSF 2.0 Advantage
49mNIST Cybersecurity Framework v2.0: What’s changing?
50mIt’s a Journey…Where is NIST Headed with the Cybersecurity Framework
54mComprehensive Cyber Capabilities Framework: A Tech Tree for Cybersecurity
40mProtecting What Matters Most – Tools for Managing Risk
01h 29mFrameworks and Related Standards
43mCSF Over Time: Shifting from Identify/Protect As You Grow
40mCyber Risk Management Programs: Bringing Clarity to Cybersecurity