Organizational cyber-security policy is established and communicated
- Initial – There is no cyber-security practice
- Developing – Cyber-security practice is part of other team as an additional role
- Defined – Cyber-security practice is recently established and security policy / procedure documents are in process of development
- Managed – Matured cyber-security practice with established policies and procedures
- Optimizing – Matured cyber-security practice with established policies and procedures and tools based security assessment framework