Cybersecurity Posture Maturity Journey
This page helps you assess and improve the security posture you adopt internally and expect from your clients.
It outlines the journey from having little or no formal security standards through to aligning with advanced frameworks like NIST and CIS.
The model provides clear steps and resources to strengthen your posture at each stage and build trust with clients through consistent, standards-based practices.
Explainer: Driving impact through clarity
Level 0-1
Identify Gaps
Objective: Establish a foundational understanding of what security, risk, and compliance (SRC) services you do and do not currently deliver, so you can begin maturing your capabilities.
Purpose: Before building or improving SRC services, you must first baseline your current state. A lightweight gap assessment identifies missing or underdeveloped processes, reveals risks in your client engagement model, and helps you prioritise future improvements.
Nominate Internal Champion
Objective: Assign responsibility for security governance by nominating an internal staff member to act as a security champion, ensuring someone is accountable for driving early maturity activities.
Purpose: At early maturity stages, security, risk, and compliance responsibilities are often shared informally across various roles, leading to inconsistency and missed obligations. By formally nominating an internal security champion, even in a part-time capacity, the business creates a focal point for action, accountability, and communication on all matters relating to client-facing security and compliance.
The goal is not to appoint a security expert, but to assign responsibility to someone who will coordinate, communicate, and escalate as needed.
Document a Minimal Baseline Security Policy for Internal Awareness
Objective: Create a simple internal security policy that outlines baseline expectations for staff when handling client systems, data, and requests.
Purpose: Without a documented security baseline, staff make inconsistent decisions, rely on assumptions, and risk breaching client trust or compliance obligations. A short, accessible internal security policy sets minimum standards and expectations, even in the absence of a full security framework. It ensures that everyone is on the same page when delivering services that involve sensitive systems or data.
This is not about creating a comprehensive governance document - it is about clarity, consistency, and confidence in day-to-day behaviours.
Establish a Simple Record of Known Client Security Issues or Ad-Hoc Request
Objective: Maintain a basic register of security-related client requests, issues, and incidents to reduce risk, improve responsiveness, and support future maturity planning.
Purpose: At low maturity, many security-related client interactions go undocumented - handled informally through emails, chats, or memory. This leads to missed follow-ups, repeated mistakes, and loss of insight over time. Creating a simple, centralised record of these events builds organisational memory, supports accountability, and enables proactive improvement.
This is not a formal incident register or risk register - just a working list of known security-related events and requests.
Define an escalation process to a trusted external partner for complex security matters
Objective: Establish a clear and repeatable process to escalate complex or high-risk security, risk, and compliance issues to an external expert or partner when internal capabilities are insufficient.
Purpose: At early maturity, internal teams are unlikely to have the depth or capacity to handle all security, risk, or compliance (SRC) matters. Without a defined escalation path, staff are left to guess, delay action, or make decisions outside their area of expertise. A lightweight escalation process ensures timely and consistent access to qualified support, reduces risk to both clients and the business, and demonstrates a commitment to responsible service delivery.
This is about knowing your limits - and having a plan when you hit them.
Draft a one-page statement of your current security capabilities and limitations
Objective: Produce a concise, client-facing summary of the security, risk, and compliance (SRC) services you currently offer - and just as importantly, what you do not - to set clear expectations and reduce misunderstandings.
Purpose: Many client relationships suffer from mismatched expectations. Clients may assume that security advice, compliance guidance, or incident response are included in standard support - when in fact they are not. Creating a short, transparent statement of capabilities helps manage risk, establish trust, and support referrals or escalations to specialist partners.
This is not a marketing brochure - it’s a clarity tool.
Brief staff on why security, risk, and compliance matter in your service model
Objective: Deliver a short internal briefing to help staff understand the importance of security, risk, and compliance (SRC) in the context of your service delivery - and why their actions have real impact on client trust and business outcomes.
Purpose: Even well-meaning teams can treat security and compliance as side issues unless leadership frames them as core to how you deliver services. A short, focused briefing gives context, builds buy-in, and reinforces that security is everyone’s responsibility - not just a technical concern or something for “later.”
This is not formal training - it’s a culture nudge.
Purpose: At the earliest stages of cybersecurity maturity, the goal is to establish a basic foundation of accountability, consistency, and awareness.
This means identifying current gaps, assigning a security champion, setting minimal internal policies, keeping a simple record of client issues, defining when to escalate to trusted partners, clarifying service limitations, and briefing staff on why security matters.
Together, these steps reduce risk, create shared understanding, and build the groundwork for moving beyond ad hoc practices into a more structured and reliable security approach
Explainer: establish a basic foundation
Level 1-2
Develop a basic security awareness training program for clients
Objective: Create and offer a lightweight security awareness training resource to help clients improve baseline staff knowledge and reduce human risk.
Purpose: Most security incidents start with human error, not technical failure. By providing basic training resources to your clients, you help them build internal resilience, reduce avoidable risks, and increase their understanding of shared security responsibilities. This is not a commercial training product or formal certification. It is a practical support offering, designed to lift the security maturity of your client base without excessive effort or overhead.
Implement a standard acceptable use policy template
Objective: Provide clients with a clear, ready-to-use acceptable use policy (AUP) template that defines minimum expectations for secure and appropriate use of technology within their organisation.
Purpose: An acceptable use policy sets clear behavioural standards for staff when using systems, devices, cloud services, and data. Without one, clients face increased risk from accidental data leaks, unauthorised behaviour, and inconsistent enforcement of controls.
Providing a simple AUP template helps clients formalise their internal rules, satisfy compliance requirements, and build a stronger security culture - especially for small and medium-sized organisations that may not have legal or policy resources.
Train staff on foundational security principles
Objective: Ensure internal staff understand and apply basic security practices relevant to their role, especially when delivering or supporting client-facing services.
Purpose: Clients expect your staff to follow secure behaviours when handling systems, credentials, and data. Yet many small or growing service providers assume that “common sense” is enough - until a mistake results in an incident. By delivering foundational training internally, you reduce human error, support consistent behaviour, and reinforce security as part of everyday service delivery. This also increases credibility when offering security-related services to clients.
This is not about deep technical education - it is about establishing a consistent baseline.
Establish an incident reporting procedure for clients
Objective: Provide clients with a clear, simple process to report potential security incidents or concerns, so that risks are identified early and handled consistently.
Purpose: Clients often do not know when or how to report a potential security issue - especially when the incident is unclear, such as a suspicious email or a suspected account breach. Without a defined process, warnings are missed, actions are delayed, and small problems can escalate into major incidents. This task is about making it easy and safe for clients to raise security concerns. It also reinforces your role as a trusted provider who takes security seriously.
Create a simple risk assessment checklist for onboarding
Objective: Introduce a lightweight checklist to identify common client risks during onboarding, enabling early conversations, clear expectations, and improved support alignment.
Purpose: Most service providers dive straight into setup and delivery without considering the client’s current risk profile. This results in missed warning signs - such as shared accounts, poor backup practices, or unmanaged devices - that later lead to incidents or strained relationships. By incorporating a basic risk assessment at the start of each engagement, you demonstrate professionalism, reduce future problems, and improve the quality of service you can deliver. This is not a detailed audit or formal risk register. It is a quick check to identify gaps, red flags, and follow-up actions.
Build an internal security knowledge base
Objective: Create and maintain a centralised, internal repository of key security, risk, and compliance (SRC) information to support consistency, reduce errors, and enable team learning.
Purpose: At this stage of maturity, SRC responsibilities are being shared across delivery, support, and leadership roles. Without a structured knowledge base, information is lost in inboxes, chat threads, or tribal knowledge - leading to repeated mistakes and unclear expectations. A simple, accessible internal knowledge base allows staff to find reliable guidance when responding to client queries, handling credentials, escalating incidents, or applying SRC procedures. It also supports faster onboarding and more scalable service delivery. This is not a full documentation platform - it is a practical knowledge hub tailored to your service model.
Incorporate phishing awareness campaigns
Objective: Introduce periodic phishing awareness activities - such as simulated phishing emails or educational prompts - to help clients and internal staff recognise and respond to common social engineering threats.
Purpose: Phishing remains the leading cause of security incidents in small and medium-sized businesses. Even with good systems in place, a single click can bypass your controls. Running simple, well-targeted awareness campaigns helps reinforce secure behaviour and identify areas where further training is needed.
You do not need a fully managed solution to get started. A lightweight, occasional campaign can deliver significant value and strengthen your reputation as a security-aware service provider.
Offer a cybersecurity fundamentals handbook
Objective: Provide clients with a concise, plain-English handbook that outlines basic cybersecurity principles, best practices, and guidance tailored to small and medium-sized businesses.
Purpose: Clients often struggle to understand cybersecurity concepts without jargon, leading to poor decision-making and risky behaviour. A clear, client-friendly handbook gives them a reference point, supports staff education, and positions your business as a trusted partner - not just a reactive service provider. You do not need to create a textbook. A short, practical guide is enough to make a difference.
Connect with external trainers for advanced awareness
Objective: Build relationships with qualified external trainers who can deliver advanced or role-specific cybersecurity awareness programs to your clients when required.
Purpose: While basic security education can be delivered in-house or through lightweight resources, some client environments or roles require more targeted awareness training. Examples include finance teams, executives, compliance officers, or users in high-risk sectors.
Rather than trying to build deep expertise internally, connecting with credible external training partners allows you to extend your capability, respond to client needs, and position yourself as a facilitator of maturity - without overcommitting your own resources.This is about being partner-ready, not delivering the training yourself.
Purpose: At this stage, the focus is on putting in place consistent, practical foundations for cybersecurity awareness, policy, and response. This includes helping clients and staff understand how to recognise and report risks, introducing lightweight training and handbooks, implementing simple policies like acceptable use, and documenting knowledge so it’s easy to access.
The goal is to reduce avoidable errors, make reporting and risk identification straightforward, and demonstrate professionalism by moving from ad hoc behaviours to structured, repeatable practices
Explainer: Meaningful One-on-Ones
Level 1-2
Adopt a baseline risk management framework
Objective: Select and apply a recognised risk management framework to support consistent identification, analysis, treatment, and communication of security-related risks across your business and client engagements.
Purpose: As you move into Level 3 maturity, SRC activities must become more structured, repeatable, and defensible. Ad hoc risk decision-making is no longer sufficient when engaging with clients that have regulatory exposure or high expectations around governance. By adopting a recognised risk management framework, you introduce a shared vocabulary, a consistent structure for evaluating threats, and a decision model that supports scalable and auditable risk handling. This enables better prioritisation, stronger alignment with client and regulatory expectations, and supports the development of other maturity-aligned artefacts. You are not aiming for certification. You are selecting a framework to apply internally and use as the foundation for how risks are discussed, assessed, and managed.
Develop and apply a formal risk assessment methodology
Objective: Establish and implement a structured methodology to identify, analyse, evaluate, and treat cybersecurity risks in a consistent and repeatable manner across client and internal environments.
Purpose: As maturity increases, risk-related decisions must be evidence-based, repeatable, and defensible. At lower levels, organisations may rely on informal judgment or generalised assessments. But as you build services that support regulatory compliance, client advisory, and risk-aligned service delivery, you must apply a consistent methodology for assessing and managing cybersecurity risk. This task formalises how your team evaluates risk, enabling better prioritisation, clearer accountability, and alignment with external frameworks such as ISO 27001, NIST CSF, or ISO 31000. The intent is to build structure, not bureaucracy.
Introduce a compliance register to track obligations.
Objective: Create and maintain a centralised compliance register to track legal, regulatory, contractual, and internal obligations relevant to your SRC practices and client services.
Purpose: At this level of maturity, you are likely managing multiple obligations - from client contracts and insurance conditions to privacy law and industry-specific frameworks. These obligations may be known by different team members but are rarely centralised or tracked in a structured way. A compliance register provides a single source of truth for what you are required to do, when, and by whom. It helps prevent missed deadlines, supports audit readiness, and ensures accountability. It also demonstrates to clients and partners that you operate with discipline and awareness of your legal and regulatory context.
Document client-specific security risk profiles
Objective: Create and maintain a concise, structured security risk profile for each managed client, reflecting their environment, business context, and key risk considerations to support tailored service delivery and prioritised security decisions.
Purpose: As your maturity increases, a generic or one-size-fits-all approach to cybersecurity is no longer effective. Clients differ in size, industry, data sensitivity, risk tolerance, and regulatory exposure. If you treat all client environments the same, you risk under-serving high-risk clients or over-engineering for low-risk ones. Documenting a client-specific security risk profile helps you understand the business and risk context for each client, enabling tailored advice, better prioritisation, and more effective risk treatment. It also demonstrates maturity to clients, auditors, and insurers.
Develop a basic security awareness training program for clients
Objective: Create a structured set of compliance artefact templates that can be reused across client engagements to accelerate delivery, improve consistency, and support audit and certification processes.
Purpose: As you support more clients with security, risk, and compliance requirements, the effort to build documentation from scratch becomes unsustainable. Inconsistent formats, undocumented practices, and duplicated effort increase delivery risk and undermine credibility. By developing a library of reusable compliance artefacts, you enable your team to respond quickly to client needs, deliver consistent quality, and meet the documentary requirements of certifications such as ISO 27001, SOC 2, or Essential Eight. This is not about creating a one-size-fits-all library. It is about building flexible, editable tools to streamline delivery.
Formalise your security awareness program with periodic refreshes
Objective: Convert your existing ad hoc security awareness efforts into a structured, documented program that includes regular refreshes, tracked participation, and aligned messaging for both internal teams and clients.
Purpose: Basic awareness training is an important early step, but once maturity reaches Level 2, informal or one-time education is no longer sufficient. Users forget. Risks change. Clients expect more than a poster or phishing simulation. A formalised program introduces structure, cadence, accountability, and documentation. It ensures your team, and your clients receive consistent and timely security messaging - tailored to evolving threats and operational relevance. This does not require enterprise-scale investment. It requires discipline and repeatability.
Provide documented onboarding security health checks.
Objective: Introduce a standardised, documented security health check as part of client onboarding to assess baseline posture, identify risks early, and align services with client needs.
Purpose: At Level 2, you are already capturing client risk data through lightweight assessments. As you mature to Level 3, it becomes important to formalise this into a repeatable, documented security health check that sets a clear starting point for each client engagement. This improves alignment, ensures consistent discovery, and helps demonstrate value early in the relationship. It also provides you and the client with an artefact to measure progress against - especially useful during quarterly reviews, improvement roadmaps, or audit preparation. This is not a deep audit. It is a focused, risk-aware intake process that establishes credibility and sets expectations.
Integrate compliance topics into periodic business reviews.
Objective: Include security, risk, and compliance (SRC) status and obligations in your regular business review conversations with clients to promote shared accountability and align service delivery with compliance goals.
Purpose: At Level 2, many SRC activities are established - risk registers, compliance tracking, onboarding assessments. But if this information is not discussed with clients regularly, you miss the opportunity to build trust, demonstrate value, and align service priorities. By integrating SRC topics into your periodic business reviews (PBRs or QBRs), you strengthen client relationships, encourage transparency, and reduce surprises during audits or incidents. This also positions your team as more than a technical provider - it shows your role in supporting business resilience and governance. This is not a formal compliance audit. It is about ensuring SRC matters are on the agenda and communicated clearly.
Engage external partners for complex risk situations.
Objective: Formalise relationships with external partners who can provide specialist advice or services for complex or high-risk SRC scenarios that exceed internal capability.
Purpose: At this level of maturity, your internal team will be managing common SRC tasks confidently. However, certain situations - such as regulatory breaches, advanced risk modelling, or certification preparation - require external expertise. Engaging specialist partners ensures you can respond appropriately when the stakes are high, while maintaining focus on your core service delivery. It also demonstrates to clients and auditors that your SRC program includes access to expert capability without needing everything in-house. This is not about outsourcing responsibility. It is about knowing when to escalate and having trusted experts ready to support.
Purpose: At this stage, the aim is to formalise risk and compliance practices so they are structured, repeatable, and defensible.
This involves adopting recognised frameworks, developing consistent risk assessment methods, and maintaining registers and artefacts that centralise obligations and evidence. It also includes tailoring security activities to each client’s context, embedding awareness programs with regular refreshes, and introducing documented health checks and reviews.
Together, these practices move organisations from ad hoc governance toward disciplined, risk-aligned operations that demonstrate accountability, build client trust, and support audit or regulatory readiness
Explainer: Quarterly Checkpoints to review progress
Level 3-4
13.1 – Client Security Framework
Full Title: Build a unified client security framework aligned to ISO, CIS, SOC 2, ISM
Objective: Develop and implement a structured, scalable framework based on leading standards to ensure consistency, alignment, and maturity across all clients.
Purpose: Provides a repeatable model for delivering security, risk, and compliance (SRC) services. The framework standardises risk management, assessments, and reporting, serving as the foundation for policies, onboarding, roadmaps, and client communication
13.2 – Framework Toolkits
Full Title: Develop framework-specific toolkits (gap analyses, checklists)
Objective: Create structured toolkits aligned to frameworks and standards to enable consistent assessments, tracking, and engagement across client environments.
Purpose: Operationalises the unified framework by providing checklists, gap analysis formats, scoring models, and reporting templates. Ensures repeatability, consistency, and higher quality in service delivery
13.3 – Client Onboarding
Full Title: Provide framework-aligned onboarding for new clients
Objective: Introduce a structured onboarding process that maps client environments to the framework and applies baseline assessments from day one.
Purpose: Establishes alignment between client expectations and security posture early in the relationship. Reduces service drift, accelerates maturity planning, and demonstrates professionalism
13.4 – Remediation Planning
Full Title: Formalise remediation planning aligned to frameworks
Objective: Implement a structured approach to documenting, prioritising, and tracking remediation activities based on framework-aligned gap assessments.
Purpose: Translates findings into actionable, prioritised remediation plans with clear ownership and accountability. Builds transparency, consistency, and credibility with clients and auditors
13.5 – Maturity Assessments
Full Title: Establish periodic maturity assessments
Objective: Conduct structured, repeatable maturity assessments to track progress, guide planning, and demonstrate security improvements over time.
Purpose: Moves SRC from reactive problem-solving to structured improvement. Provides measurable evidence of risk reduction and aligns services with client goals
13.6 – Executive Reporting
Full Title: Offer board and executive-level reporting on SRC posture
Objective: Provide structured, plain-English reporting to executives and boards to improve oversight, align strategy, and support governance.
Purpose: Elevates SRC to a strategic level. Builds trust and ensures leadership understands risk posture, required decisions, and service impact
13.7 – Compliance Reviews
Full Title: Conduct proactive compliance reviews and readiness checks
Objective: Perform forward-looking reviews to assess compliance posture, anticipate obligations, and prepare clients for audits or certifications.
Purpose: Shifts compliance from reactive to proactive. Identifies gaps early, reduces remediation costs, and builds confidence in regulatory and contractual compliance
13.8 – Knowledge Base
Full Title: Maintain a structured SRC knowledge base for internal staff
Objective: Build and maintain an internal knowledge base that provides standardised guidance, templates, and procedures across SRC activities.
Purpose: Consolidates institutional knowledge into a single reference system. Ensures consistent delivery, reduces onboarding time for staff, and improves efficiency
13.9 – Awareness Materials
Full Title: Tailor awareness materials to client sector, maturity, and risk profile
Objective: Deliver targeted awareness content that reflects industry, threat landscape, and maturity instead of relying on generic training.
Purpose: Increases engagement and behavioural impact by tailoring awareness programs to client context. Demonstrates understanding of industry-specific needs and embeds SRC into daily operations
Purpose: At Level 3 maturity, security, risk, and compliance (SRC) delivery shifts from ad hoc problem-solving to structured, scalable, and strategic operations. Together, these nine practices build an integrated SRC model that:
- Establishes a unified security framework as the foundation Equips teams with toolkits and onboarding processes that embed structure from the start
- Converts findings into remediation plans and tracks progress through maturity assessments
- Elevates SRC to the executive level through board-ready reporting
- Moves compliance to a proactive discipline with readiness checks
- Supports delivery with an internal knowledge base
- Extends impact to client organisations through targeted awareness programs
Together, these steps ensure SRC is delivered as a repeatable, professional, and strategic capability. They provide clients with confidence that their security posture is not only aligned with frameworks but also continuously improving, embedded across staff behaviours, and recognised at the highest levels of governance.
Explainer: Provide closure on the year
Level 4-5
Full Title: Implement continuous control monitoring and reporting
Objective: Establish ongoing monitoring and reporting of key security controls to confirm effectiveness and alignment with client risk posture.
Purpose: Moves beyond point-in-time checks by providing real-time or near real-time oversight of critical controls. Detects failures early, supports audit readiness, and proves continuous operational maturity
Full Title: Support attestation or audit with structured evidence packs
Objective: Build curated, framework-aligned evidence packs that simplify audits, certifications, and attestations.
Purpose: Prepares clean, organised, and mapped control evidence ahead of time, reducing audit stress and ensuring reliable proof of compliance. Demonstrates maturity in governance and repeatability
Full Title: Maintain cross-client risk trending and correlation analysis
Objective: Track and analyse risk trends across the client portfolio to identify systemic issues and emerging threats.
Purpose: Shifts SRC oversight from a client-by-client view to portfolio-wide intelligence. Highlights recurring vulnerabilities, sector-specific risks, and patterns that inform proactive improvements
Full Title: Deliver strategic SRC planning aligned to business objectives
Objective: Embed SRC into business strategy to support growth, transformation, and resilience.
Purpose: Positions SRC as a business enabler, not a compliance function. Aligns risk and security initiatives with strategic priorities, resourcing, and executive decision-making
Full Title: Enable board-level oversight with clear SRC governance artefacts
Objective: Provide structured, board-ready artefacts that enable governance bodies to oversee SRC performance and risk.
Purpose: Translates technical activity into governance language, equipping boards with visibility and decision-making tools. Builds confidence with regulators, investors, and executives
Full Title: Maintain a multi-year SRC roadmap across your client portfolio
Objective: : Build structured roadmaps that span multiple years, supporting long-term planning and uplift.
Purpose: Provides direction beyond remediation tasks by forecasting SRC development, aligning with business goals, and enabling portfolio-wide planning. Supports scalability and investment decisions
Full Title: Conduct post-incident reviews and integrate learnings into client programs
Objective: Perform structured PIRs that capture root causes, lessons learned, and corrective actions.
Purpose: Converts incidents into learning opportunities. Ensures changes flow back into remediation, assessments, and roadmaps, driving systemic improvement and resilience
Full Title: Provide anonymised insights to support client benchmarking and sector risk awareness
Objective: Deliver anonymised, aggregated insights to help clients benchmark maturity and understand sector risks.
Purpose: Enhances client perspective by providing context and peer comparison. Builds trust, informs strategic planning, and positions SRC as a competitive advantage Channel Guru - L4 - 13.8 - Prov…
Purpose: At Level 4 maturity, SRC evolves from structured internal practices to strategic, intelligence-led, and board-ready capabilities. These eight practices create an ecosystem where:
- Controls are continuously monitored and evidenced
- Risks are analysed at scale, with trends driving proactive action
- SRC is embedded into business strategy and governance, aligning with growth and board oversight
- Future direction is mapped clearly through multi-year roadmaps
- Incidents fuel continuous improvement through structured PIRs
- Clients gain benchmarking insights from anonymised portfolio intelligence
- Together, these practices demonstrate SRC as a strategic partner to business resilience and growth, not merely a compliance requirement. At this stage, providers deliver maturity through foresight, executive alignment, and measurable outcomes across their client base.