Overview
This article explains how to assign a maturity level to a subcategory in Hyver when working with the NIST CSF 2.0 framework. You'll learn how to recognize system-calculated scores, manually set a maturity level, and explore how linked findings, technologies, and processes contribute to the assessment.
How to Rate a Subcategory
Navigate to the subcategory assessment pane
Go to Maturity Assessment
Select a Function > Category > Subcategory
Check for existing data
You may see a system-calculated score based on linked findings, technologies, or processes
You can accept this score or reassess manually
Set a manual maturity rating
Click Current level to enable the rating controls
Choose a value from 1 to 5, or select:
Unknown – if you can't confidently assess the subcategory
Not Relevant – if the subcategory doesn’t apply to your organization
Understanding Maturity Levels
Each level builds on the one before, layering improvements like formalized processes, clear responsibilities, measurement, and continuous monitoring:
Level | Description |
1 – Initial | Ad hoc or non-existent implementation; no ownership or repeatability |
2 – Developing | Some basic controls or processes in place; inconsistent application |
3 – Defined | Documented and standardized processes; supporting technologies in place |
4 – Managed | Effectiveness is actively measured and policy compliance is tracked |
5 – Optimized | Mature, continuously improved, and adaptable to change |
Linked Findings, Technologies, and Processes
Findings
Automatically factored into the maturity score if linked
Click a finding to view or edit it on the Findings page
Use the Unmapped Framework filter on the Findings page to locate findings not yet linked to subcategories
Technologies & Processes
Linked assets are visible under their respective sections
Click to view or manage them on the Assets page
Wrap-up / Next Steps
Rating a subcategory is a foundational step in building your maturity profile. Combine manual ratings with linked data where possible, and use filters to identify what’s missing — your assessments will be more complete and more actionable.