Overview
Findings represent security issues identified in an organization — and they play a key role in assessing cybersecurity maturity. In the Cye Exposure Management Platform, findings can be linked to specific NIST subcategories to reflect their impact on maturity scoring. This article introduces how findings support the maturity program and how they interact with the NIST CSF framework.
How Findings Support Maturity
Findings provide real-world evidence of security gaps or weaknesses. When linked to NIST subcategories in the maturity assessment screen, they contribute to the calculated maturity score. Their presence can lower the maturity score, while their resolution can improve it — giving a dynamic view of security posture over time.
How Findings Are Linked
Findings can be associated with NIST subcategories in a few ways:
Automatically, based on issue type and detection logic
Manually, when creating a finding
Through the right-hand pane of a finding on the Findings page
Via the Standards tab, where NIST CSF 1.1 or 2.0 subcategories can be added or removed
The primary framework is shown first, but mappings can be updated for either framework if both are in use.
Updating Maturity After Fixing a Finding
Once a finding is remediated, the options are:
Accept the default maturity score applied by the Cye platform
Or manually adjust the maturity level to better reflect the improved state
Edits can be made from the NIST subcategory section in the Standards tab
Wrap-up / Next Steps
Findings are more than just issues to fix — they're signals that inform the maturity score. Keeping them up to date and accurately mapped ensures the maturity assessment reflects the organization's real-world risk and progress.