Maturity assessment

# How cyber secure is your organisation?

Get your free, instant compliance score. Answer 20 quick questions built on key parameters from the NCA and NIST frameworks, and see your gaps, your maturity level and where to improve.

20 questions · about 5 minutes · free

## Let’s talk about your security

## What we assess

Questions span the five NIST Cybersecurity Framework functions, aligned with NCA requirements.

### Identify

Policy, ownership, roles, risk management and third-party risk.

### Protect

Awareness, phishing, assets, technology, access, email, data, change and patching.

### Detect

Threat detection and how security alerts are monitored.

### Respond

Whether incidents would be handled with confidence.

### Recover

Recovery readiness, backups and restore testing.

## What cybersecurity maturity means

Maturity describes how well your security practices are defined, followed, measured and improved. Having a firewall is not maturity. A documented process for managing firewall rules, followed consistently, reviewed regularly and improved over time, is.

## Maturity levels explained

Most models, including the SAMA Cyber Security Framework, use similar levels:

| Level | Name | What it looks like |
| --- | --- | --- |
| 0 | Non-existent | No practice in place. |
| 1 | Ad hoc | Security happens informally and depends on individuals. |
| 2 | Repeatable but informal | Some practices repeat, but they are not documented or approved. |
| 3 | Structured and formalised | Practices are documented, approved and followed. The minimum expected for SAMA-regulated organisations. |
| 4 | Managed and measurable | Practices are measured with metrics and reviewed regularly. |
| 5 | Adaptive | Practices improve continuously based on data and changing threats. |

## Self-assessment or expert assessment?

This online assessment gives you a quick, useful snapshot. For audit preparation, an expert-led assessment adds interviews, document review and control testing, producing evidence regulators accept. That is part of our GRC consulting service.

## Frequently asked questions

### How long does the assessment take?

About five minutes. There are 20 multiple-choice questions, and you see your score as soon as you finish.

### What is the assessment based on?

Key parameters from the NCA and NIST cybersecurity frameworks, covering the Identify, Protect, Detect, Respond and Recover functions.

### Is it free?

Yes. The assessment and your compliance score are free and instant.

### What happens after I finish?

You get your maturity score, a breakdown by NIST function and your biggest gaps. Your results are emailed to you, and our team will be in touch to talk through closing the gaps.

### What maturity level should we aim for?

SAMA-regulated entities should reach at least level 3. For others, the right target depends on your risks and regulatory obligations.

## Ready to protect your business?

Book your free security consultation today.

---

Canonical page: https://cybrt.sa/maturity/
Guide for AI agents: https://cybrt.sa/llms.txt