Unless you are looking to “sell” cybersecurity internally to leadership, the process of maturing cybersecurity within an organization is not about “good-better-best” or “silver-gold-platinum.” Rather, the organization must understand its current level of maturity, assess the risks to the business objectives and decide how to reach the state of maturity necessary to achieve and exceed the business objectives. The last part requires using some framework around cybersecurity maturity, preferably.
