Pulse
A baseline you can complete online.
- Who it suits
- You want a first view of where your security may need attention.
- What you receive
- A snapshot of the strengths and possible gaps you identify.
- Cost
- Free
- Time
- About 15 minutes, self-guided.
Risk & assurance
Cyber maturity assessments
Choose a free baseline to identify possible gaps, or a full vCISO-led assessment to verify controls and agree an improvement plan.
Compare the assessmentsWhich assessment fits your team?
To arrange either free baseline by email, contact checkyourpulse@vambrace.co.uk.
The full vCISO-led assessment
The full Cyber Maturity Assessment (CMS) is a paid engagement. It usually takes three to seven days. A focused review may take two days, while a larger or more complex scope may take up to ten. We agree the scope, price and time commitment before work starts.
A virtual CISO interviews the people responsible for security, reviews policies and operational evidence, and tests how consistently controls are applied. The handover explains the business impact of the gaps and a prioritised improvement roadmap with owners.
Discuss the full Cyber Maturity AssessmentAssessment framework
How consistently do your controls work?
Vambrace uses a five-level internal scale to describe how consistently practices operate in the agreed organisation, department or location. For each level, record observed evidence, gaps, the owner and the target state. Where helpful, map the evidence to your chosen framework; the five levels are Vambrace’s advisory scale.
LevelPracticeWhat it means
01Ad hocControls depend on individuals.
Evidence to look for
Work happens in response to an event. Look for a recent example and establish who carried it through.
- Controls are largely informal, undocumented, and dependent on individual or manual effort.
- Limited accountability or measurement.
- Security incidents handled on a case-by-case basis without consistent documentation.
02InconsistentBasic practices exist, but coverage varies.
Evidence to look for
Compare how two teams handle the same security task. Identify where ownership and records differ.
- Controls that are in place have not been adopted across the whole organisation.
- Patch management / scanning is performed regularly for some systems but not tracked or validated across the environment.
- There is a lack of experienced governance, risk, and compliance leadership.
03RepeatableTeams follow a documented process.
Evidence to look for
Identify the policy owner, how the process is communicated and a sample record showing it in use.
- Clear evidence of reviews into access controls and privileges.
- Regular scanning in place with tracked remediation.
- Compliance with key information security frameworks can be evidenced.
04ManagedControl performance is measured and reviewed.
Evidence to look for
Look for trends, exceptions, management review and follow-up when a measure falls below expectation.
- Data and metrics drive continuous risk reduction and accountability.
- Experienced CISO level led governance is in place.
- Incident trends are tracked over time and lessons learned incorporated into security posture.
05EmbeddedEvidence drives continuous improvement.
Evidence to look for
Trace a change from observation through decision, implementation and verification.
- Strong evidence of continuous improvement.
- Automation is being used effectively to help and accelerate tasks, reduce error, and enhance human expertise.
- Intelligence driven decision making with reliable, up-to-date, and accurate data is the norm.
When to commission an assessment
- Before an investment decision
- Security leaders need to explain where the next tranche of budget will reduce risk.
- Before an audit or supplier review
- IT and assurance teams need a clear picture of control ownership, evidence and gaps.
- As the organisation grows
- Leaders need to know which practices are repeatable across teams and locations.
Leadership briefing
Put the findings to work.
Illustrative assessment finding
Can you show that a critical system can be restored?
- Finding
- Backups are scheduled, but the last restore test has no recorded result. Leadership cannot yet tell how long recovery would take.
- Owner
- The IT operations lead coordinates the test with the owner of the business service.
- Next action
- Restore a test copy, record the recovery time and compare it with the agreed target. Take any gap to the next risk review.
Protect the bottom line
Show which weaknesses could interrupt operations or expose important information, and who owns the decision to act.
Direct the budget
Compare the current position with the target level. Agree the improvements that justify investment first.
Track improvement
Use the baseline, agreed owners and repeat assessments to see whether changes are working.
Cyber Maturity Assessment FAQs
What does the full Cyber Maturity Assessment (CMS) cover?
A cyber maturity assessment is a structured evaluation that measures how effectively an organisation manages and protects its data, IP, and assets. It examines the people, processes, and technology across key security domains to determine the current maturity level and identifies practical steps to strengthen resilience.
How is cyber maturity measured?
We measure maturity on a five-level scale, from Level 1 (poor) to Level 5 (Excellent). Each level reflects how consistent, repeatable, and proactive your security practices are. The result is a maturity score and roadmap showing exactly where to focus for maximum impact.
How long does a Cyber Maturity Assessment take?
A full assessment usually takes three to seven days. A focused review can take two days and a wider engagement can take up to ten. Your vCISO agrees the scope, timetable and handover with you before work starts.
What happens after the assessment?
We don’t just leave you with a report. Your vCISO will walk you through the findings, explain the implications, and help prioritise next steps. You’ll get a custom improvement roadmap and the option for ongoing support to track your progress.
How often should a Cyber Maturity Assessment be undertaken?
We recommend performing a maturity assessment annually or after major organisational or infrastructure changes (e.g. an acquisition). Regular assessments help track progress and demonstrate continuous improvement.
Which frameworks can the assessment support?
Yes. Our assessment methodology aligns with globally recognised frameworks including NIST Cybersecurity Framework (CSF), ISO 27001, CIS Controls, and Cyber Essentials. This means your maturity results can support or feed directly into certification efforts.