Executive Summary

This Security Maturity Assessment Report evaluates the cybersecurity posture of the organization across thirteen domains aligned to the NIST Cybersecurity Framework 2.0 and CIS Controls v8.1. Based on the survey responses, the assessment reveals an overall maturity level that indicates a largely ad-hoc and reactive program. Key themes include significant gaps in governance, access control, cloud security, and detection capability alongside relative strengths in physical security controls and some incident response documentation.

The organization demonstrates limited formal structures for security leadership and policy, with many areas relying on informal or incomplete processes. This leaves the organization exposed to common threats including unauthorized access, data breaches, and operational disruption that would have material impact on client trust and regulatory standing.

Opportunities for improvement are significant, beginning with quick wins such as enforcing multi-factor authentication and designating a security owner. Over the longer term, aligning security with business goals and building tested response capabilities will materially improve resilience and satisfy the requirements of cyber insurers and enterprise clients.

Overall Maturity Snapshot

The overall score reflects an initial level where security efforts are present in isolated pockets but are not consistent, formalized, or integrated into operations. The sections below detail each domain and set out a prioritized remediation plan.

Governance & Leadership

Maturity Level 1 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Policies & Documentation

Maturity Level 2 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Asset & Risk Management

Maturity Level 1 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Access Control

Maturity Level 1 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Cloud Security

Maturity Level 1 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Device & Endpoint Security

Maturity Level 2 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Data Protection

Maturity Level 1 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Email & Security Awareness

Maturity Level 1 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Vendor & Third-Party Risk

Maturity Level 1 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Detection & Monitoring

Maturity Level 1 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Incident Response

Maturity Level 2 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Continuity & Backup

Maturity Level 2 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

Physical & Operational Security

Maturity Level 3 / 5

Findings

The organization's current practices in this domain reflect limited formal controls. Policies and accountability structures are absent or incomplete, and the processes that do exist are applied inconsistently across the organization. Several foundational elements required for audit readiness and insurer acceptance have not been implemented.

Risks

Without addressing the gaps identified in this domain, the organization faces elevated exposure to data loss, unauthorized access, and operational disruption. These risks are compounded by the absence of governance structures that would otherwise provide early warning and coordinated response capability.

Recommendations

Implement foundational controls aligned to NIST CSF 2.0 and CIS Controls IG1/IG2. Assign a named owner, document the required policies, and establish a review cycle. Specific implementation steps are provided in the 30-day and 90-day roadmap sections of the full report.

30-Day Quick Wins

• Quick win action item 1: Implement foundational control addressing the highest-priority gap identified in this assessment, requiring minimal procurement and achievable within existing resources.

• Quick win action item 2: Implement foundational control addressing the highest-priority gap identified in this assessment, requiring minimal procurement and achievable within existing resources.

• Quick win action item 3: Implement foundational control addressing the highest-priority gap identified in this assessment, requiring minimal procurement and achievable within existing resources.

• Quick win action item 4: Implement foundational control addressing the highest-priority gap identified in this assessment, requiring minimal procurement and achievable within existing resources.

• Quick win action item 5: Implement foundational control addressing the highest-priority gap identified in this assessment, requiring minimal procurement and achievable within existing resources.

90-Day Improvement Plan

• 90-day action item 1: Structured improvement building on the 30-day foundation, requiring defined ownership, documented process, and staff communication to achieve measurable maturity uplift.

• 90-day action item 2: Structured improvement building on the 30-day foundation, requiring defined ownership, documented process, and staff communication to achieve measurable maturity uplift.

• 90-day action item 3: Structured improvement building on the 30-day foundation, requiring defined ownership, documented process, and staff communication to achieve measurable maturity uplift.

• 90-day action item 4: Structured improvement building on the 30-day foundation, requiring defined ownership, documented process, and staff communication to achieve measurable maturity uplift.

• 90-day action item 5: Structured improvement building on the 30-day foundation, requiring defined ownership, documented process, and staff communication to achieve measurable maturity uplift.

12-Month Strategic Roadmap

Phase 1 — Months 1–3: Governance Foundation

Establish security ownership, approve core policies, allocate budget, and initiate quarterly executive reviews aligned to this report's findings.

Phase 2 — Months 4–6: Technical Controls

Deploy multi-factor authentication across all accounts, implement endpoint protection, verify encryption coverage, and activate centralized logging on critical systems.

Phase 3 — Months 7–9: Resilience & Response

Test disaster recovery, conduct incident response tabletop exercise, verify backup recoverability, and document breach notification process aligned to PIPEDA obligations.

Phase 4 — Months 10–12: Visibility & Vendor

Activate monitoring and alerting, evaluate managed detection capability, complete Tier 1 vendor security reviews, and benchmark against Year 2 maturity targets.

Domain	Score	Priority	Top Recommendation
Governance & Leadership	1/5	HIGH	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Policies & Documentation	2/5	MEDIUM	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Asset & Risk Management	1/5	HIGH	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Access Control	1/5	HIGH	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Cloud Security	1/5	HIGH	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Device & Endpoint Security	2/5	MEDIUM	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Data Protection	1/5	HIGH	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Email & Security Awareness	1/5	HIGH	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Vendor & Third-Party Risk	1/5	HIGH	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Detection & Monitoring	1/5	HIGH	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Incident Response	2/5	MEDIUM	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Continuity & Backup	2/5	MEDIUM	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.
Physical & Operational Security	3/5	LOW	Designate a named owner, formalize documentation, and implement foundational controls aligned to CIS IG1 baseline for this domain.