Gartner IT Scorefor Security &Risk Management
Sample report excerpt

Meet Gartner IT Score for Security & Risk Management
Introduction to Gartner IT Score for Security & Risk Management
Functional leaders use Gartner IT Score for Security & Risk Management to measure the maturity of theirfunction in key activities, prioritize areas of improvement and plot the function’s path to improvement.
This is an excerpt from a full report, which provides detail on a wide range of functional activities. Gartner
IT Score for Security & Risk Management covers 30 functional activities across 7 functional objectives.

Here’s how it works

1. Measure the performance of the functionin terms of:	• Maturity. We ask a series of yes/no questions
about how your function approaches andexecutes each one of a range of key activities
and objectives specific to your function.
• Importance. We ask you to indicate how
important each of those activities is for yourfunction to meet its enterprise objectives.

2. Prioritize.
• See your maturity levels at a glance. On asimple bar graph, we plot the maturity levelof each activity and its importance — andyou get your first glimpse of where maturity
and importance aren’t aligned. For example,
your function may be highly mature in
activities that aren’t very important to driving
business priorities or highly immature inactivities that are.
• See your priorities in rank order, based on
those gaps between maturity and importance.
Immediately you can see what should be
your highest priorities for improvement
if your function is to drive business goals
effectively. You also see which activities
need less attention.

Read on for more insights and recommendations you might receive on an individual activity. A
complete report shows you the current status and improvement path for all activities and objectives
in your function.
© 2024 Gartner, Inc. and/or its affiliates. All rights reserved. CM_GTS_2971795

3. Improve. We provide you with steps to takeon your path to improvement in whatever
activities the data shows to be the biggest
significant opportunities for improvement.
• “A Pathway to Maturity” lists action steps
required to reach the next level in eachspecific activity.
• Recommended related resources provide
associated insights. In some cases, a Gartner
advisor delivers the report and helps withprioritization and action planning.

How mature are your functional activities?
Gartner IT Score for Security & Risk Management benchmarks your self-assessment
to provide you with a current maturity score by activity.

High Maturity

Low Maturity

Medium Maturity

Not Assessed

n=2

Maturity: Measured on a scale ranging from 1 (Low) to 5 (High), maturity measures how advanced
an organization’s development is in a functional activity relative to Gartner’s best practice research.
Maturity scores are refined with a (+) or (-) to indicate intermediate levels of maturity.
The set of activities as mapped here is subject to change.
Source: Gartner© 2024 Gartner, Inc. and/or its affiliates. All rights reserved. CM_GTS_2971795

How do maturity and importance compare?
Gartner IT Score for Security & Risk Management plots your benchmarked maturity
score against the importance you assign to that activity in terms of its criticality foryour function to meet enterprise business objectives.

Maturity

Importance — Functional Maturity Overall = 3-n=2

Select Findings
Lowest Maturity

Highest Importance•	Secure Data•	Secure Applications• Manage Policy• 	Secure Network Edges• Suppport Audit•	Measure Performance© 2024 Gartner, Inc. and/or its affiliates. All rights reserved. CM_GTS_2971795• 	Discover and Remediate
Vulnerabilities•	Plan Budget

What are the high-priority areas for your function?
Gartner IT Score for Security & Risk Management rank-orders your improvement
priorities, based on the gap between maturity and importance. The Activity Priority
Index (API) identifies where the function is less mature in activities of greater
importance. A higher API score indicates a greater priority to the organization.
The Activity Priority Index identifies where the function is less mature in activities of greater importance.

n=2

Highest Priority

Lowest Priority• Manage Policy• Manage Security Events•	Support Audit• Define and Conduct Risk Assessments• 	Measure Performance and More Activities• Identify and Track Threats

Source: Gartner© 2024 Gartner, Inc. and/or its affiliates. All rights reserved. CM_GTS_2971795

High-priority area: Manage Policy
How the SRM function structures and documents a policy program to ensurebusiness requirements are met
Path to MaturityStart doing the following to achieve
the next level of maturity:• Account for variations in business needs

Source: Gartner© 2024 Gartner, Inc. and/or its affiliates. All rights reserved. CM_GTS_2971795

Manage Policy
Sample recommended resources

Featured resources

Progressive practices

Information Security Policy Library
Download and use security policies based on peer practice.

IDEXX’s Power User-Led Policy Development
Incorporate feedback from power users within the company in orderto tune and update policies in line with how work is changing.

Foundational practices

Usable Policy for Decision Makers (SRI International)
SRI’s security and risk management leaders rethink information security
policies as a tool to enable independent, informed risk decision making
across the enterprise. To achieve this, SRI collects and implements real-timeuser feedback to make policies, standards and guidelines more usable.

Ignition Guide to Drafting Information Risk Appetite Statements
Align policies with a commonly understood risk appetite statement to ensurerisk mitigation efforts are in the company’s best interests.

Note: Some documents may not be available as part of your current
Gartner subscription.

© 2024 Gartner, Inc. and/or its affiliates. All rights reserved. CM_GTS_2971795

Actionable, objective insight
Position your organization for success. Explore these additional
complimentary resources and tools for cybersecurity leaders:

ReportCybersecurity Trends: Optimize
for Resilience and Performance
Use this report to equip your cybersecurity
function for greater resilience.

Roadmap

IT Roadmap for Cybersecurity
Create a resilient, scalable and agile
cybersecurity strategy.

Download Now

Learn MoreToolGartner Cybersecurity BusinessValue Benchmark
Quantify the value of cybersecurity
investments..

Learn More© 2024 Gartner, Inc. and/or its affiliates. All rights reserved. CM_GTS_2971795

Tool

Gartner Cybersecurity Controls
Assessment
Measure controls implementation
maturity against leading frameworks.

Learn More

Already a client?
Get access to even more resourcesin your client portal. Log In

Connect With Us
Get actionable, objective insight to deliver on your mission-criticalpriorities. Our expert guidance and tools enable faster, smarter
decisions and stronger performance. Contact us to become a client:
U.S.: 1 866 263 8917
International: +44 (0) 03301 628 476
Become a Client

Learn more about Gartner for Cybersecurity Leadersgartner.com/en/cybersecurity

Stay connected to the latest insight© 2024 Gartner, Inc. and/or its affiliat s. All rights reserved. Gartner is a registered trademark of Gartner, Inc. and its affiliat s. This publication may not be reproduced
or distributed in any form without Gartner’s prior written permission. It consists of the opinions of Gartner’s research organization, which should not be construed asstatements of fact. While the information contained in this publication has been obtained from sources believed to be reliable, Gartner disclaims all warranties as tothe accuracy, completeness or adequacy of such information. Although Gartner research may address legal and financial issues, Gartner does not provide legal orinvestment advice and its research should not be construed or used as such. Your access and use of this publication are governed by Gartner’s Usage Policy.
Gartner prides itself on its reputation for independence and objectivity. Its research is produced independently by its research organization without input or influence
from any third party. For further information, see “Guiding Principles on Independence and Objectivity.” Gartner research may not be used as input into or for thetraining or development of generative artificial intelligence, machine learning, algorithms, software, or related technologies. CM_GTS_2971795