Overview
This article outlines the step-by-step process for completing a maturity assessment in Hyver using the NIST CSF 1.1 framework. You'll learn how to review subcategories, assign maturity levels, and trigger the calculation of category, function, and organization-level scores.
Step-by-Step Workflow
1. Access the Maturity Page
Navigate to the Maturity page in Hyver
Choose a Function, then a Category, and then a Subcategory
2. Review the Subcategory
Subcategories may already have an automatically applied maturity level
This could be based on linked findings, technologies, processes, or Hyver insights
If no score is present, select a rating from:
1–5 based on your organization’s current implementation
Unknown if you can’t assess the subcategory
Not Relevant if the subcategory doesn’t apply
Use the maturity model to guide your rating decisions.
3. Respond to Recommendations
If you rate a subcategory 1–3 and no finding is linked, Hyver may recommend that you add a finding
You can also manually create a finding linked to that subcategory
4. Check for Predefined Ratings
Some subcategories may be pre-rated by another user or by the CYE Services Team
You can review and adjust these if needed, depending on your role and permissions
5. Meet Completion Requirements for Score Calculation
To trigger score calculation, ensure the following:
At least 50% of subcategories in a category are rated
Once enough subcategories are completed, category, function, and organization scores are calculated automatically
Refer to the [Maturity Calculation (CSF 1.1)] article for specific scoring logic
6. Set Target Maturity Scores (Optional)
You can define target scores at the organization or function level
Set targets either before or after your initial score is calculated
These targets help guide your long-term improvement plan
Wrap-up / Next Steps
The CSF 1.1 maturity assessment process is flexible and incremental — build your assessment over time by completing subcategories and linking supporting data. Use this workflow to stay organized and ensure your maturity scores reflect the real state of your security posture.