For decisions that need more than a score
An IT leader may know the estate needs investment while the board needs a clearer explanation of where to start. A service partner may need a consistent basis for a client business review. A maturity assessment helps those audiences discuss the same evidence and the decisions it supports.
ThreatShield combines available technical signals with recorded programme context. The review can help distinguish a control that is operating, one that is only partly applied, an observed gap, and an area the current collection cannot assess. That distinction makes an improvement plan more useful than a single percentage.
What informs the assessment
Supported evidence includes Microsoft identity and access posture, device management, endpoint protection, vulnerability context, network-security signals and security-awareness sources where connected. Recorded risks, approved policies and roadmap items can add programme context to the review.
The maturity model uses selected CIS-aligned control references and NIST CSF perspectives to organise discussion. Its coverage follows the controls and signals implemented in the platform. It does not assess every framework requirement, and a framework label is not evidence that a control is effective.
A baseline, a briefing and a practical next step
The IT maturity reporting workflow supports a business review of assessed areas, current adherence and recommended improvements. Related vCISO reporting brings leadership briefings, risk context and available technical evidence into the client workspace.
Use the findings to separate operational work from decisions about funding, ownership or accepted risk. For each priority, agree the intended outcome and the evidence that would demonstrate it. A device-compliance issue, for example, may need an inventory check, a policy decision and a later configuration review before it can be considered addressed.
How to make later reviews meaningful
Start by agreeing the business questions, connected sources and assessment boundary. Check collection health, review the findings with the people responsible for the systems, and retain gaps or assumptions alongside the recommendations.
At the next review, compare the scope and freshness of the evidence as well as the findings. A newly connected source may expose work that was previously invisible. A reduced finding count may reflect missing collection. Progress should be explained through verified changes and reviewed outcomes, rather than a score or closed ticket alone.
How it works, step by step
- Agree the questions and boundary. Decide what leadership needs to decide, then confirm the connected sources and the areas in scope for the review.
- Bring the evidence together. Combine supported identity, device, network, vulnerability and awareness signals with recorded programme context.
- Assess control coverage. Separate a control that is operating, one only partly applied, an observed gap and an area the current collection cannot assess.
- Brief and prioritise. Produce a business review and leadership briefing that connects findings to funding, ownership and accepted-risk decisions.
- Review with fresh evidence. At the next review, compare scope and evidence freshness as well as findings, so progress reflects verified change.
What the maturity assessment can distinguish
Rather than a single percentage, the assessment aims to separate states that need different responses. Depending on the connected evidence, it can distinguish:
- Controls that are operating with supporting evidence, from those that are only partly applied.
- Observed gaps that need remediation, from areas the current collection cannot assess.
- Identity, device, endpoint-protection and vulnerability posture across the estate.
- Network-security and security-awareness signals where those sources are connected.
- Recorded risks, approved policies and roadmap items that add programme context.
- Change between reviews driven by verified work, not only by a moved score or a closed ticket.
The view is directional and follows the controls and signals implemented in the platform. It does not assess every framework requirement, and a framework label is not evidence that a control is effective.
Framework alignment
The maturity model uses selected CIS-aligned control references and NIST Cyber Security Framework perspectives to organise the discussion, and it can be read alongside the themes of a UK Cyber Essentials review. This gives leadership and technical teams a shared, framework-anchored baseline to work from.
Its coverage follows the controls and signals implemented in the platform, so it remains a directional assessment rather than a certification or a formal compliance audit. Certification requires the applicable scope, evidence and an independent assurance process.
Questions about IT maturity assessment
Is this a certification or compliance audit?
No. The assessment provides a directional view from available evidence and selected framework mappings. Certification or a formal compliance audit requires the applicable scope, evidence and independent assurance process.
What happens when a control has no evidence?
The maturity workflow distinguishes unassessed or not-managed areas from observed failures and applied controls. Missing evidence should lead to an explicit scope or collection decision.
Can the assessment support regular business reviews?
Yes. IT maturity and related vCISO reporting can support repeated review. Meaningful comparison depends on understanding changes in collection scope, evidence freshness and assessment coverage.
Can MSPs use the IT maturity assessment across client workspaces?
Yes. The maturity and vCISO reporting workflow is designed to give service partners a consistent basis for client business reviews, with each client workspace scoped to its own connected sources and evidence.
How often should we run a maturity assessment?
Many organisations run it as part of a regular business or board review cycle. Meaningful comparison between reviews depends on understanding changes in collection scope and evidence freshness, not only the headline finding count.