Overview
Findings represent security issues identified in your organization — and they play a key role in assessing cybersecurity maturity. In Hyver, you can link findings to specific NIST subcategories to reflect their impact on your maturity scoring. This article introduces how findings support your maturity program and how they interact with the NIST CSF framework.
How Findings Support Maturity
Findings provide real-world evidence of security gaps or weaknesses. When linked to NIST subcategories in the maturity assessment screen, they contribute to the calculated maturity score. Their presence can lower the maturity score, while their resolution can improve it — giving you a dynamic view of your security posture over time.
How Findings Are Linked
Findings can be associated with NIST subcategories in a few ways:
Automatically, based on issue type and detection logic
Manually, when creating a finding
Through the right-hand pane of a finding on the Findings page
Via the Standards tab, where you can add or remove NIST CSF 1.1 or 2.0 subcategories
The primary framework is shown first, but you can update mappings for either framework if you're using both.
Updating Maturity After Fixing a Finding
Once a finding is remediated, you can:
Accept the default maturity score applied by Hyver
Or manually adjust the maturity level to better reflect the improved state
Edits can be made from the NIST subcategory section in the Standards tab
Wrap-up / Next Steps
Findings are more than just issues to fix — they’re signals that inform your maturity score. Keep them up to date and accurately mapped to ensure your maturity assessment reflects your organization’s real-world risk and progress.