See where your cybersecurity practices stand, using evidence and clear assessment criteria. Turn the gaps you identify into prioritized actions, accountable owners and a plan management can review.

A clearer view of cybersecurity capability starts with a consistent way to ask questions, record evidence and decide what to improve. Without a shared approach, different teams may interpret the same practice differently, rely on broad statements rather than evidence, or identify gaps without translating them into owned actions.

The Cybersecurity Maturity Assessment & Action Planner gives organizations an editable starting point for that work. It is intended for security, IT, governance, risk and compliance teams, including managers, control owners and leadership reviewers who need to understand findings and agree on next steps. The toolkit is designed for cross-industry use and can be tailored to an organization’s size, operating model, risk context and assessment scope.

The workflow moves from defining the assessment boundary to reviewing prompts, recording responses and evidence references, examining gaps, setting priorities and creating an action plan. Teams can document what is known, mark items that have not yet been assessed, and explain when an item is not applicable to the agreed scope. Evidence confidence should be considered separately from the maturity judgement. These distinctions help users avoid treating missing information as proof that a practice is absent, or treating a high maturity rating as proof that risk has been eliminated.

The assessment structure covers broad cybersecurity themes and is organized as a RASA InfoCom-designed methodology. It is not an official NIST assessment instrument, and the prompts are not claimed to map one-to-one to NIST CSF subcategories. No formal ISO/IEC 27001 or other framework mapping is claimed. Organizations that need a framework-specific review should select and verify the relevant authoritative sources, document the mapping, and assess applicability in their own context.

The editable XLSX workbook supports assessment and evidence recording, findings and gap tracking, action ownership, target dates, status review and a dashboard view. Supporting DOCX guidance explains how to begin, interpret the method, avoid common scoring mistakes and prepare management discussion. A separate sample workbook uses fictional illustrative data to demonstrate how entries can flow into a dashboard; it is not a benchmark or a real organization’s result.

The toolkit is intended to support internal planning and decision-making, not replace professional judgement. It does not perform penetration testing, vulnerability scanning, technical validation or incident response. It is not a managed security service, legal advice, certification, an audit opinion or a determination of regulatory compliance. Results depend on the quality and completeness of information supplied, the scope selected and how the method is applied. Applicable requirements should be checked against authoritative sources and qualified advice where needed.

For teams that want to move from informal discussion to a documented review, the toolkit offers a practical way to capture the current picture, make gaps visible and organize the next improvement steps.