Overview
Each subcategory in the NIST CSF 1.1 framework must be rated to contribute to your organization's maturity score. This article explains how to rate a subcategory in Hyver, when to create a finding, and how linked findings influence the assessment.
How to Rate a Subcategory
Open the subcategory assessment pane
Navigate to the Maturity page
Select a Function, then a Category, then a Subcategory
Check for an automatic rating
If Hyver has already linked findings, technologies, or processes, a system-calculated score may be shown
You can accept the score or override it manually
Select a manual maturity level
Click Current level to enable the dropdown
Choose a value from 1 to 5
Select Unknown if unsure or Not Relevant if the subcategory doesn’t apply
Refer to [Maturity Levels in Detail] for help selecting the right score.
Creating a Finding Based on Your Rating
If you select a maturity level of 1 to 3 and no finding is linked to the subcategory:
Hyver will suggest creating a finding that corresponds to the selected maturity level
Click Create finding to review and confirm
If you select Don’t create, the suggestion remains available in case you change your mind later
You may be prompted again to create a finding if you change the maturity level afterward.
Managing Linked Findings
Once added, the finding appears in the Linked findings section
Click a finding to open it on the Findings page, where you can:
Edit it
Add it to a mitigation plan
Change its status
Use the NIST filters on the Findings page to search by subcategory, severity, or framework
Use the Unmapped Framework filter to identify findings not yet mapped to NIST CSF subcategories
Wrap-up / Next Steps
Rating a subcategory is a key part of your maturity assessment. Be sure to link meaningful findings where appropriate to reinforce low maturity ratings and use the platform’s suggestions to guide you through creating or updating them.