# A Dynamic and Adaptive Cybersecurity Governance Framework
## 6 Performance Indicators of the Proposed Security Governance Framework
Cybersecurity governance requires a simple, adaptive, and standardized way to measure and visualize the level of security controls that are implemented or the capability to mitigate cyber-risk. In general, security maturity assessment is meant to describe the security posture concisely and standardly. Here, the security process maturity model can be given as a five process maturity scale as shown in Figure 9. The maturity model can then generate a graph showing the gaps between the real and the anticipated level of maturity for different security programs, controls, and objectives. The levels are discussed below:  
1. _Initial:_ This level shows an organization starts implementing security controls, but there are no well-defined standards and best practices, and processes, which the company follows. Therefore, the security process is ad hoc or temporary. The security programs and processes are new and are not evaluated and audited. In general, at this level, security practices are not performed. 2. _Repeatable:_ the security practices, processes, and programs are developed, implemented, and documented so that the processes can be repeated. However, there are no performance metrics, capabilities, and techniques for an organization to evaluate its security posture and readiness to evaluate against a set of standards and best practices. 3. _Defined:_ The Process is defined and confirmed as a standard business process. An organization at this level can proactively analyze its security risk and provide mitigation options. 4. _Managed:_ The Process is quantitatively managed according to a set of agreed standard metrics. In this level, security practices are documented, sufficient resources are allocated to implement the security process, and the security practices are more advanced than in the previous level (Level 3). 5. _Mature:_ An organization in this stage has all security programs in place and begins optimizing and improving the security programs implemented. In this level, security processes and programs are guided by policies and directives, responsibility, accountability, and authority to perform the security activities are well defined and are put in place, and security officers are assigned with sufficient knowledge and skills, the effectiveness of security programs are periodically assessed and evaluated using key performance indicators (KPIs). Figure 9: Security Process Maturity Model. To demonstrate the security capability maturity model shown in Figure 9, it is very well illustrated in Figure 10, which offers the security capability assessment of a sample organization. It implements various security controls with a current maturity level shown in red. Most of the implemented security controls lie with no more than three maturity levels. This indicates the security processes and programs that are defined and confirmed as a set of standard business processes. However, it needs improvement to reach the maximum maturity level labeled as 5 (Mature) in all security processes, plans, and programs. In general, the maturity assessment process model maintains and justifies whether security governance processes, policies, and risk assessments are properly implemented. Moreover, it will allow the CISO, business leaders, risk managers, auditors, and other stakeholders to discuss and view their security posture thoroughly across the enterprise.