Skip to content

Capability Maturity

What is Capability Maturity?

A framework for assessing and improving an organization's processes and capabilities across defined maturity levels from initial to optimized.

Governance

Frameworks that govern capability maturity

COBIT 2019View framework →ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →

What the standards actually require on capability maturity

Requirements naming capability maturity across 5 standards, quoted from the control text.

Telecommunications Sector Security Reforms (TSSR)2 controls

For a critical telecommunications asset owned or operated by a carrier, the program must also include a process or system to comply with one of: the Essential Eight Maturity Model at maturity level two;

telecommunications-sector-security-reforms-tssr::TSRMP-11(4) · TSRMP Rules s 11(4) and (5): uplifted cyber framework for carrier assets →
CSA STAR (Security, Trust, Assurance, and Risk)1 control

Every STAR Certification assessment audits the CCM against a management capability (maturity) model using the CCM and the maturity model grid defined in CSA's guidance document Auditing the Cloud Controls Matrix.

csa-star-security-trust-assurance-and-risk::L2-MATURITY · Have the CCM assessed against the management capability model and keep maturity scores private →
Critical Infrastructure Risk Management Program (CIRMP) Rules 20231 control

Within 12 months after the end of the s 4(2) grace period a responsible entity must establish and maintain a process or system in its CIRMP to comply with a framework in one of the listed documents as in force from time to time and meet its condition: AS ISO/I...

critical-infrastructure-risk-management-program-cirmp-rules-2023::8(3) · s 8(3) Adopt one of five cyber frameworks, or an equivalent, within 12 months of the grace period →
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)1 control

NSS-17 + NSS-42-G require ongoing assurance + regulator interface + reporting + continuous improvement. Assurance activities: internal cyber security audit + management review + control effectiveness testing + penetration testing + red team exercises + ISO 270...

IAEA-NSS17-Assurance-Regulator-Inspection-Reporting-Improvement · IAEA NSS-17 - Assurance Activities + Regulator Interface + Inspection + Reporting + Information Sharing + Continuous Improvement →
NIST SP 800-1371 control

Conduct ISCM Programme Review per Section 4.9 annually + capability maturity assessment + gap analysis + improvement planning aligned with NIST CSF 2.0 implementation tiers.

NISTSP137-8 · Programme Review, Training, and Third-Party ISCM →

Questions people ask about capability maturity

What is Capability Maturity?
A framework for assessing and improving an organization's processes and capabilities across defined maturity levels from initial to optimized.
Why is Capability Maturity important for compliance?
Capability Maturity is a key concept in Governance. Understanding capability maturity helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Capability Maturity?
Capability Maturity appears in the requirement text of Telecommunications Sector Security Reforms (TSSR), CSA STAR (Security, Trust, Assurance, and Risk), Critical Infrastructure Risk Management Program (CIRMP) Rules 2023, IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1), NIST SP 800-137. Across these standards we have identified 6 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Capability Maturity?
Explore our compliance framework pages to see how capability maturity applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Capability Maturity applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.