Overview
This article explains how the Cye Exposure Management Platform calculates your maturity score using NIST Cybersecurity Frameworks (CSF 1.1 or 2.0). It also covers key completion requirements, scoring logic, and how to link technologies and processes that influence the assessment.
If you're starting a maturity assessment for the first time, be sure to review prerequisites and familiarize yourself with the recommended scoring workflow.
How the Cye platform Calculates Maturity
the Cye platform combines several data points to calculate your organizational maturity score:
Ratings you apply to each NIST subcategory
Linked processes and technologies
Existing findings from assessments
Automated insights from the Cye platform
For example, you might assess subcategory [PR.AC-2] Physical access to assets is managed and protected. You’ll rate your organization’s implementation level on a scale from 1 (low maturity) to 5 (high maturity). If you’ve deployed controls like Endpoint Detection and Response (EDR), you can link those technologies to reinforce your score.
Completion Requirements
To calculate your maturity at different levels (Category, Function, and Organization), make sure the following thresholds are met:
Category-level score: Rate at least 50% of subcategories within the category
Function-level score: Complete at least 50% of categories within the function
Organizational maturity score:
For NIST CSF 2.0: Complete at least 4 out of 6 functions (67%)
For NIST CSF 1.1: Complete at least 3 out of 5 functions (60%)
Connecting Technologies and Processes
You can strengthen your subcategory assessments by associating relevant technologies (e.g., firewalls, identity tools) and processes (e.g., patch management, access reviews). These additions give a more complete view of your cybersecurity posture.
For details on adding these, refer to:
Wrap-up / Next Steps
Understanding how the Cye platform calculates your maturity score helps ensure your assessment reflects reality — not just optimism. If you’re ready, explore the scoring interface and begin rating the subcategories that matter most to your business.