Overview
Hyver calculates your organizational maturity score by combining inputs like ratings, linked findings, technologies, processes, and system-generated insights. This article explains how the scoring process works under the NIST CSF 1.1 framework.
Organizational Maturity Score Requirements
To calculate an overall maturity score, your assessment must meet the following thresholds:
50% of subcategories within each category must be rated
50% of categories within a function must be complete
At least 3 out of 5 functions (60%) must be completed to calculate the organizational maturity score
✅ Note: For CSF 2.0, the threshold is 4 of 6 functions (67%).
How Findings Affect Scoring
A finding linked to multiple subcategories applies its maturity level to all of them
If multiple fixed findings are present, their average is used in scoring
When multiple findings are linked to a subcategory, Hyver uses the lowest maturity level
Fixed findings (manual): default to maturity level 3
Automatically fixed findings: assigned maturity level 2
Critical/High severity findings: maturity level 1
Low/Medium severity findings: maturity level 2
Subcategory Score Calculation
Scoring is based on a weighted model depending on which elements are present:
Data Source Used | Weighting |
Rating + findings + tech + processes | 25% each |
Only manual rating | 100% |
Only findings | 100% |
Only technologies | 100% |
Only processes | 100% |
Rating is “Unknown” or “Not Relevant” | 100% of linked items (if any); otherwise, no score |
Hyver ensures a linked technology or process is only used if it improves the score. If it would lower the result, it is not factored in.
Wrap-up / Next Steps
Understanding how maturity scores are calculated allows you to make informed decisions when rating subcategories, linking findings, or setting targets. Review which data sources you’ve contributed to each subcategory to ensure a balanced and accurate maturity profile.