CDC Maturity Self-Assessment Checklist
Fill this out interactively: the interactive tool gives you a status control and evidence field per criterion, automatic staged scoring, a score chart against your target profile, a resume link you can save and reopen to carry on later with no account and no cookie, and a JSON snapshot you can export and keep in version control. This document is the single source of the criteria: the function documents link here instead of keeping their own copy, and the tool carries the same text, checked automatically. Use it to read offline, print, or copy into your own system.
Scoring rules: see the maturity model. A level is achieved only when all its criteria and all lower-level criteria are met. A criterion counts as met when its status is
implementedorevidenced; for the stricter, evidence-based reading, count onlyevidenced. Copy this file, date it, and keep assessments in version control to track the trend.NIS2 floor. Criteria marked NIS2 deliver the minimum form of a measure required by NIS2 Art. 20, 21 or 23. For an entity in NIS2 scope they are never above tier; see the NIS2 Article 21 crosswalk. Level 1 has no criteria: it is where every function starts.
Status scale
Record a status for every criterion, not just a tick. The three lower states make work in flight visible without moving the score. The model is staged and does not average up.
| Status | Meaning | Counts towards the level? |
|---|---|---|
not considered |
Not looked at; no decision taken either way. | No |
planned |
Agreed and scheduled, not yet started. | No |
partial |
In place for part of the estate, or done informally / inconsistently. | No |
implemented |
In place and operating across the intended scope. | Yes |
evidenced |
Implemented, with evidence recorded and, where the criterion says so, signed off or reviewed within the stated period. | Yes |
Tick the box when the status is implemented or evidenced. For an
evidence-based reading, closer to how an auditor would score it, count only
evidenced. Scores without recorded evidence tend to come out higher.
Assessment date: | Assessors: | Evidence repository:
GOVERN
Level 2
- Signed CDC charter defining mission, scope and authority — status:
…— evidence: … - Security policies approved and reviewed within last 12 months · NIS2 21(2)(a) — status:
…— evidence: … - RACI for security roles exists — status:
…— evidence: … - Management body has approved the cybersecurity risk-management measures, and its members completed cybersecurity training within the last 12 months · NIS2 Art. 20 — status:
…— evidence: … - Security requirements in contracts with critical suppliers and service providers; list of critical suppliers maintained · NIS2 21(2)(d) — status:
…— evidence: … - Effectiveness of the security measures assessed at least annually, for example with this self-assessment, and reported to management · NIS2 21(2)(f) — status:
…— evidence: …
Level 3
- Cyber risk items appear in the enterprise risk register with owners — status:
…— evidence: … - Quarterly or more frequent reporting to executive management — status:
…— evidence: … - Supplier security requirements in all relevant contracts; supplier risk assessed and reviewed at least annually · NIS2 21(2)(d) — status:
…— evidence: … - Multi-year budget/staffing plan approved — status:
…— evidence: …
Level 4
- Management body took part in a board-level crisis exercise within the last 12 months — status:
…— evidence: … - Resource decisions demonstrably driven by risk/maturity data — status:
…— evidence: …
Function score: ☐ L1 ☐ L2 ☐ L3 ☐ L4
IDENTIFY
Level 2
- Automated asset discovery on core networks · NIS2 21(2)(i) — status:
…— evidence: … - Vulnerability scanning at least quarterly on core estate · NIS2 21(2)(e) — status:
…— evidence: … - Subscribed to national CSIRT / ENISA advisories — status:
…— evidence: … - Crown-jewel services agreed in writing with the business, each with an owner — status:
…— evidence: … - Risk analysis of network and information systems performed and approved within the last 12 months · NIS2 21(2)(a) — status:
…— evidence: … - Short threat profile documented: the threat types and actors most relevant to the sector — status:
…— evidence: …
Level 3
- Inventory accuracy measured, > 90% — status:
…— evidence: … - Documented threat profile mapped to MITRE ATT&CK, reviewed annually — status:
…— evidence: … - Risk-based remediation SLAs defined and tracked — status:
…— evidence: … - Risk assessment results drive budget and backlog, with decisions recorded — status:
…— evidence: …
Level 4
- Continuous attack-surface monitoring incl. cloud/SaaS — status:
…— evidence: … - Threat intel demonstrably drives hunts and new detections, traceably — status:
…— evidence: …
Function score: ☐ L1 ☐ L2 ☐ L3 ☐ L4
PROTECT
Level 2
- MFA enforced for all remote and administrative access · NIS2 21(2)(j) — status:
…— evidence: … - Hardening baselines defined for main platforms · NIS2 21(2)(g) — status:
…— evidence: … - Patching SLA for critical vulnerabilities defined and measured · NIS2 21(2)(e) — status:
…— evidence: … - Backup restore tested within last 12 months · NIS2 21(2)(c) — status:
…— evidence: … - Offline/immutable backup copy for critical data · NIS2 21(2)(c) — status:
…— evidence: … - Cryptography policy approved, covering data in transit and at rest · NIS2 21(2)(h) — status:
…— evidence: … - Security awareness training completed by all staff within the last 12 months · NIS2 21(2)(g) — status:
…— evidence: … - Security requirements applied when acquiring or changing critical systems, including how their vulnerabilities are handled · NIS2 21(2)(e) — status:
…— evidence: …
Level 3
- Phishing-resistant MFA for privileged accounts; PAM operational — status:
…— evidence: … - Network segmentation isolates crown-jewel zones — status:
…— evidence: … - Backup infrastructure separated from the production identity domain, with its own credentials — status:
…— evidence: … - Control coverage measured, such as % endpoints with EDR ≥ 95% — status:
…— evidence: …
Level 4
- Continuous or periodic technical control validation through attack simulation — status:
…— evidence: … - Security requirements embedded in procurement and SDLC with verification — status:
…— evidence: …
Function score: ☐ L1 ☐ L2 ☐ L3 ☐ L4
DETECT
Level 2
- Central log platform; identity, endpoint and email sources onboarded · NIS2 21(2)(b) — status:
…— evidence: … - Use cases documented for the top techniques in the threat profile, each with owner, ATT&CK mapping and runbook — status:
…— evidence: … - Triage runbook with severity matrix · NIS2 21(2)(b) — status:
…— evidence: … - Defined coverage hours with on-call arrangement — status:
…— evidence: …
Level 3
- Detection lifecycle with version control and testing — status:
…— evidence: … - Coverage measured against ATT&CK and crown jewels; gaps drive backlog — status:
…— evidence: … - Coverage hours meet the risk-based target set in GOVERN; out-of-hours escalation tested twice a year — status:
…— evidence: … - MTTD measured per confirmed incident — status:
…— evidence: … - Threat hunting performed on a schedule — status:
…— evidence: …
Level 4
- All production detections validated by firing in test within 12 months — status:
…— evidence: … - Detection-as-code with CI/CD pipeline — status:
…— evidence: … - FP rates and coverage trended, demonstrably driving engineering — status:
…— evidence: …
Function score: ☐ L1 ☐ L2 ☐ L3 ☐ L4
RESPOND
Level 2
- Approved IR plan with severity classification and roles · NIS2 21(2)(b) — status:
…— evidence: … - Playbooks for top scenarios incl. ransomware and data breach · NIS2 21(2)(b) — status:
…— evidence: … - Statutory reporting contacts and templates prepared for NIS2, GDPR and DORA as applicable · NIS2 Art. 23 — status:
…— evidence: … - Tabletop exercise within last 12 months · NIS2 21(2)(b) — status:
…— evidence: … - Reporting drill executed against the statutory deadlines within the last 12 months · NIS2 Art. 23 — status:
…— evidence: … - Escalation from incident to the organisation's crisis management defined, with named decision-makers · NIS2 21(2)(c) — status:
…— evidence: …
Level 3
- Containment authority pre-agreed in charter; isolation technically tested — status:
…— evidence: … - Forensic capability in-house or via retainer, with chain-of-custody procedure — status:
…— evidence: … - Exercises include management and communications, not only the technical team — status:
…— evidence: … - Post-incident reviews with tracked actions for all P1/P2 — status:
…— evidence: …
Level 4
- MTTC trended; containment steps automated with approval gates — status:
…— evidence: … - Cross-functional crisis exercise incl. management and comms within 12 months — status:
…— evidence: …
Function score: ☐ L1 ☐ L2 ☐ L3 ☐ L4
RECOVER
Level 2
- Recovery plans with RTO/RPO for crown-jewel services · NIS2 21(2)(c) — status:
…— evidence: … - At least one crown-jewel service restored end to end and timed against its RTO within the last 12 months · NIS2 21(2)(c) — status:
…— evidence: … - Post-incident review process defined — status:
…— evidence: …
Level 3
- Rebuild-from-known-good procedure; integrity verification before reconnection — status:
…— evidence: … - Credential rotation standard in recovery runbooks — status:
…— evidence: … - Joint BCM/CDC exercise within 12 months — status:
…— evidence: … - Lessons-learned actions tracked to closure — status:
…— evidence: …
Level 4
- Ransomware-scale recovery exercised; measured recovery vs. RTO — status:
…— evidence: … - Demonstrable control/detection changes originating from incidents — status:
…— evidence: …
Function score: ☐ L1 ☐ L2 ☐ L3 ☐ L4
Result
| Function | Score | Target | Gap actions |
|---|---|---|---|
| GOVERN | |||
| IDENTIFY | |||
| PROTECT | |||
| DETECT | |||
| RESPOND | |||
| RECOVER |
Next assessment due: …