How maturity works for framework objectives

About

Each objective (requirement) in a framework has a Current Maturity and a Target Maturity. For frameworks with subcategories, such as NIST CSF 2.0 and CMMC, these are set on each subcategory. This article explains where maturity comes from, how assessment answers affect it, and how to report on it.

Current Maturity is set by your team. It isn't calculated from assessment answers. Answers can only move a subcategory from level 0 to level 1, or reset it to level 0.

How assessment answers affect maturity

When an answer is saved, ControlMap checks every assessment question linked to that subcategory (the questions listed in its Applies to mapping) and updates the subcategory:

All Yes: the status becomes Completed. If maturity is at level 0, it moves to level 1. Higher levels aren't changed.
A mix of answers (including Partially): the status becomes In Progress. As above, maturity only moves from level 0 to level 1.
All No: maturity is set to level 0.
All N/A: the subcategory becomes Not Applicable at level 0.
Some N/A: N/A answers are left out when ControlMap checks for "all Yes" or "all No".

A few more rules apply:

Unanswered questions still count. A subcategory with any unanswered question can't be "all Yes".
A question linked to several subcategories counts in full for each of them.
Levels 2 and above only change when someone sets them by hand.

Turn on maturity assessment

Maturity assessment is turned on for each framework. It's part of the Pro plan.

Select the framework in the sidebar and go to Overview.
Select the pencil at the top right to open Edit framework.
Turn on Enable maturity assessment and select Update framework.

The Edit framework drawer with the Enable maturity assessment switch

For CIS Controls, maturity assessment is marked Deprecated. Use the CIS CSAT assessment instead.

Set Current and Target Maturity

Go to Objectives and open the objective.
On the Assess tab, below the notes, select Maturity (next to Questions). The Process maturity list shows each level in order, with a Current or Target badge on the levels already set.
Select a level. The Set maturity score window shows its full description.
Select Set as current for your assessed level, or Set as target for the level you want to reach. When you set the current level, you can add your reasoning.

The Maturity tab on a NIST CSF 2.0 objective, listing Tier 0 to Tier 3 with Tier 1 marked Current

The Set maturity score window with Set as current and Set as target buttons

Select History to see earlier maturity assessments, newest first, with their dates and reasoning.

Each framework comes with its own maturity levels and descriptions, so the names and number of levels can differ between frameworks. For example, NIST CSF 2.0 uses Tier 0: Not Implemented, Tier 1: Partial, Tier 2: Risk Informed, and so on. Level 0 and level 1 in this article are the first two levels in that list. The Maturity tab only appears on objectives, not on sub-objectives.

How maturity rolls up in reports

Reports show maturity for each function and category (for NIST CSF 2.0, the 6 functions and 22 categories). Each value is a simple average of the Current Maturity of the subcategories under it. Subcategories that are out of scope and Not Applicable are left out.

Export maturity for each subcategory

To get one row per subcategory with its maturity:

Select the framework in the sidebar, for example NIST CSF 2.0, and go to Reports.
On the New Report tab, find Objectives Report under Frameworks.
Select the download icon in its row. You can also email it or schedule it with the other two icons.

The Reports page with the Objectives Report listed under Frameworks

The report lists each subcategory with its status, Current Maturity, Target Maturity and notes.

To review the same view in the app, go to Objectives › Display › Group by › Sub Domain.

Compare maturity year over year

The rules above haven't changed since before December 2024, and they work the same way in every framework that has subcategories. Framework content updates, such as the SCF 2026.2 mapping update, added new question links but didn't change any maturity values. Scores from earlier assessments can be compared with new ones.

Before you finalise a report:

Record each subcategory's Current Maturity, for example by downloading the Objectives Report.
Avoid editing answers after you've recorded maturity. Saving an answer runs the rules again for every linked subcategory. If all of a subcategory's questions are N/A, it becomes Not Applicable at level 0, even if it was set higher by hand. This reset isn't recorded in maturity history.
If a subcategory unexpectedly shows Not Applicable at level 0, set its maturity again by hand.

Take a snapshot of your answers before you start a reassessment, so you can compare against them later. Go to Objectives › By Questions › Snapshots. New answers replace earlier ones, and answers can't be recovered without a snapshot.