Maturity model
The levels describe how reliably controls are governed, implemented, evidenced and improved - from Foundational to Leading. They are advisory descriptors, not stars, certificates or approvals.
Maturity levels are advisory descriptors, not stars, certificates, compliance ratings or regulatory approvals. They describe management reliability and evidence - nothing more.
Absent or reactive
Inconsistent
Repeatable
Monitored
Anticipatory
Level descriptors
Each level sets out the pattern of governance, implementation, evidence and improvement you would expect to see.
Controls are absent, reactive, informal or materially incomplete. Evidence is largely anecdotal and improvement is unplanned.
Controls exist in parts but implementation and evidence are inconsistent across areas, shifts or contractors.
Controls are documented, assigned and generally implemented with repeatable evidence across the operation.
Controls are consistently implemented, monitored and improved using performance evidence and verification.
Controls are integrated, anticipatory and continuously improved, supported by strong, challengeable evidence.
Protection against false comfort
Arithmetic is diagnostic. Two independent mechanisms can change the reported level.
Confidence and coverage can cap or withhold a conclusion where the assessment basis is weak - for example, when applicable evidence is missing or sampling is limited.
Critical-control gates can override a high average entirely. A material critical-control failure caps the level at Foundational or Developing, or causes it to be withheld. Gate assignment and release require competent moderation and evidence.
Independent advisory work only. Conclusions are limited to the agreed scope, evidence and sampling, and may require specialist and jurisdiction-specific review. This is not an official rating, certification, legal-compliance opinion or guarantee of future performance.