Maturity Level Matrix for Cyber Security

Most organizations now critically depend on IT services, making business operations vulnerable to cyber security incidents. As IT delivery shifts from purely on-premises to hybrid models that combine on-premises, hosting, and cloud services, organizations gain flexibility and potential cost reduction but face increased complexity in management, compliance, and security. Because business goals, best practices, and technologies constantly evolve—and because regulations such as the EU GDPR raise expectations for data protection—cyber security programs must be regularly reviewed and updated. Cloud adoption also changes accountability by splitting security responsibilities between the cloud service provider (CSP) and the cloud tenant, requiring clarity about who secures which parts of the service delivery stack.

The document frames hybrid IT security through five service delivery planes (from physical data centre through infrastructure to applications and data) and emphasizes that each plane must be managed and secured, with responsibility varying by cloud model (IaaS, PaaS, SaaS). To help organizations evaluate and improve, KuppingerCole provides Maturity Level Matrices aligned with CMM concepts and recommends a five-point maturity scale based on the Carnegie Mellon Maturity Index. Level 1 is ad hoc and reactive, with weak governance, unclear responsibilities, minimal risk management, manual identity processes, and inconsistent controls; it is hard to evidence compliance. Level 4 features integrated governance across cloud and on-premises, strong management support, standardized risk-based controls, automated assurance, and an architecture aligned to recognized standards. Level 5 builds on Level 4 with optimized, self-sustaining processes, automated governance, continuous benchmarking, continuous evidence from suppliers, and full integration across identity, access, and hybrid services.

Assessment is guided by twelve Key Support Attributes: six organizational (governance, standards, management organization, risk management, control processes, audit/assurance) and six technical (architecture, data/access, application security, network security, compute/storage, physical security). The matrices also support board-level communication, for example by visualizing maturity in a spider chart against industry norms to identify risks, savings opportunities, and high-return security investments.

• Organizations increasingly use hybrid IT delivery models combining on-premises, hosting, and cloud services.
• Increased regulation over data protection, including EU GDPR, intensifies the need for strong cyber security.
• In cloud models, responsibility for security is split between the cloud tenant and the cloud service provider depending on the delivery model.
• The IT service delivery stack is described as having five distinct service delivery planes that must be managed and secured.
• KuppingerCole recommends assessing cyber security on a five-point maturity scale based on the Carnegie Mellon Maturity Index.
• Level 1 maturity is characterized as ad hoc and reactive, with multiple manual approaches.
• Level 4 maturity is characterized by automation of processes defined at Level 3, supported by workflows and tools where practical.
• Level 5 maturity adds continuous improvement, benchmarking, and continuous evidence of supplier conformance to standards.
• Twelve Key Support Attributes are used to judge maturity: six organizational and six technology attributes.
• A spider chart is suggested to present maturity across attributes and compare results to industry norms.

• “Failure to properly manage cyber security risks can result not only in operational failure but also in reputational damage as well as regulatory penalties.”
• “The maturity of an organization to manage cyber security must now be judged in the context of this hybrid IT service model.”
• “Only by considering these together is it possible to get a balanced view on the current state of play and where action is needed.”
• “Using maturity is also helpful as a way to communicate the results to the organization’s board of directors.”
• “Organizational and technology maturity is a concept that is grasped by board members while technical details of cyber security may not be readily understood.”
• “One way to present the overall maturity of the organizational cyber security is as a spider chart.”
• “Where the shape fill is green this indicates that, based on KuppingerCole’s experience, this level is ‘good in class’.”
• “Where the shape fill is black this indicates that this level is ‘best in class’.”
• “In effect the processes defined for Level 3 are automated where practical or supported by workflows and other relevant tools.”
• “Few organizations will reach this level without full executive support and a board of directors that understands the importance of this in terms of the business benefits and cyber security protection that this provides.”