HRM Maturity ModelVersion 2.0Aligned to NIST CSF 2.0CC BY 4.0
Five levels.Six practices.
The HRM Maturity Model describes how a human risk management program grows from complying with a training requirement to preempting attacks before they land, in five levels scored over six practices: See, Understand, Act, Prove, Govern and Culture. Each practice has observable criteria, evidence to ask for and the actions that move it one level up, so a security leader can place a program in one meeting and plan the next 90 days.
Aligned to NIST CSF 2.0 Implementation Tiers. Levels 1 to 4 map to Tiers 1 to 4; level 5 goes beyond Tier 4. NIST states that tiers are not a maturity model, so read the mapping as an aid. The crosswalk
-
Level 1
NIST CSF 2.0 Implementation Tier: Tier 1 · Partial
The program meets the training requirement and counts activity: training completion and simulation clicks.
-
Level 2
NIST CSF 2.0 Implementation Tier: Tier 2 · Risk Informed
The program observes behavior across several risk domains and knows who reports.
-
Level 3
NIST CSF 2.0 Implementation Tier: Tier 3 · Repeatable
Threat, access and behavior are joined per person, and the riskiest cohorts are ranked and targeted first.
-
Level 4
NIST CSF 2.0 Implementation Tier: Tier 4 · Adaptive
Playbooks orchestrate controls across the stack as risk changes, and the program proves its lift.
-
Level 5
NIST CSF 2.0 Implementation Tier: Beyond Tier 4
AI predicts which attack sequences are forming, and the program acts before the next step, at machine speed, for people and AI agents on one risk model.
Each level is an active verb for what the program does with risk, so a board sentence works: "At level 3, we prioritize." The chip under each name is its NIST CSF 2.0 Implementation Tier; each level page holds the crosswalk to NIST CSF 2.0 tiers and SANS.
The practices
Six practices,each scored on its own.
Each practice is scored from 1 to 5 by the initial assessment. The overall level is the weighted mean of the six, capped one level above the weakest practice: a program cannot prove or automate what it cannot see.
- 014 questions See Which signals can you see, for whom, and how fresh are they? Five levels of See
- 023 questions Understand How do you decide who needs attention, and what tells you the decision was right? Five levels of Understand
- 033 questions Act What changes when risk is found, how fast, and who or what makes the change? Five levels of Act
- 043 questions Prove Can you show, with your own numbers, that risk went down? Five levels of Prove
- 052 questions Govern Who owns human risk, and what decision rights, budget and policy do they hold? Five levels of Govern
- 063 questions Culture Do people report, ask for help, and tell you the truth about friction? Five levels of Culture
The matrix
One line per practice and level.
Open a cell for the full criteria, the evidence to ask for and what moves the practice up.
Scroll sideways to see every level.
HRM Maturity Assessment
Where does your program stand?
An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.
- Questions
- 18
- Minutes, about
- 4