Overview
In Hyver, the NIST CSF 2.0 maturity model uses a combination of inputs—ratings, linked findings, technologies, processes, and system insights—to calculate your maturity score. This article breaks down how scoring works at the subcategory, category, function, and organizational levels.
Organizational Maturity Score: Completion Requirements
To generate an organization-level maturity score, these thresholds must be met:
At least 50% of subcategories must be rated within each category to calculate the category score
At least 50% of categories must be completed to calculate the function score
At least 4 of 6 functions (67%) must be completed to calculate the organization score
How Findings Impact Maturity
Findings linked to multiple subcategories apply their score to all subcategories
Fixed findings positively influence the score
Default level: 3
Automatically fixed by Hyver: 2
Severity-based scores:
Critical/High severity = 1
Low/Medium severity = 2
When multiple findings are linked to a subcategory, the lowest maturity score is used
When multiple fixed findings are present, their average is used
Subcategory Score Calculation
Hyver uses a weighted approach based on the available input sources:
Input Type(s) Used | Weight Applied |
Manual rating + linked findings + technologies + processes | 25% each |
Only manual rating | 100% |
Only linked findings | 100% |
Only linked technologies | 100% |
Only linked processes | 100% |
Rating is "Unknown" or "Not Relevant" | 100% of linked data used (if available); otherwise, no score is calculated |
Special Scenarios
If a linked technology or process has a fixed maturity score of 3, it is only used if it increases the subcategory’s current score
If your selection is Unknown or Not Relevant, the system only relies on linked elements
Manual input takes full precedence when no linked data is available
Wrap-up / Next Steps
Understanding how maturity scores are calculated helps you use the model more effectively. By thoughtfully linking findings, processes, and technologies—and rating subcategories accurately—you can better reflect your organization’s security posture and guide improvement.