Skip to content This library is free, offered as dana. If it helps your work, donate here →
penguin tree ai
← back to libraryDonate here

This is one of 3,622 free prompts in the penguin tree ai library. Sign up once and the whole library opens, with new prompts by email.

open the library →

Cyber resilience maturity scorer

Scores an organization's cyber resilience across six domains (identity, data, network, applications, operations, governance) on a 1–5 maturity scale aligned to NIST CSF tiers, with per-domain evidence, a weighted…

download .md

Purpose

Produce a defensible, domain-by-domain cyber resilience maturity assessment scored on a 1–5 scale mapped to NIST CSF implementation tiers — surfacing the specific gaps, the weighted composite score, and the highest-leverage uplift actions a CISO can take to the board with confidence.

When to Use

Invoke this skill when the user asks to:

  • Benchmark or score organizational cyber resilience or security maturity
  • Establish a maturity baseline before a security budget or investment cycle
  • Prepare a board-level or executive security posture report
  • Assess readiness against NIST CSF, or translate audit findings into a maturity score
  • Identify which security domains are dragging down overall resilience
  • Justify or prioritize security spending with a defensible scoring rationale

Inputs Required

Before starting, collect:

  • Organization profile: Industry, employee count, and regulatory regime (e.g., HIPAA, PCI-DSS, SOX, GDPR)
  • Domain evidence: Current state notes for each domain — controls in place, tooling, known gaps (any format; partial is fine)
  • Recent incidents or audit findings: Breaches, near-misses, or external audit results in the last 12–24 months
  • Existing frameworks in use: NIST CSF, ISO 27001, CIS Controls, or none formally adopted
  • Crown-jewel assets: The systems or data whose compromise would be most damaging
  • Domain weighting preference: Equal weighting, or risk-weighted toward specific domains
  • Peer comparison target: Industry peer group or threat profile to benchmark against

If domain evidence is sparse for any area, score conservatively, mark the domain as "evidence-limited," and flag it for assessment. If no weighting is specified, default to risk-weighting toward Identity and Data.

Instructions

Step 1: Establish the Maturity Scale

Anchor every score to this 1–5 scale, mapped to NIST CSF implementation tiers:

  • Level 1 — Partial / Ad Hoc (CSF Tier 1): Reactive, undocumented, dependent on individuals. No repeatable process.
  • Level 2 — Risk-Informed (CSF Tier 2): Practices approved but not org-wide policy; inconsistent implementation; limited threat awareness.
  • Level 3 — Repeatable / Defined (CSF Tier 3): Formal policies, consistent execution, documented procedures, regular review.
  • Level 4 — Adaptive / Managed (CSF Tier 4): Quantitatively measured, metrics-driven, integrated with enterprise risk management.
  • Level 5 — Optimizing (beyond CSF Tier 4): Continuous improvement, automated response, threat-informed adaptation, resilience tested under realistic attack conditions.

Scores may use half-points (e.g., 2.5) where a domain straddles two levels.

Step 2: Score Each of the Six Domains

For each domain, assess against its core resilience capabilities, assign a 1–5 score, and cite the specific evidence behind it.

Domain 1 — Identity & Access Management Assess: MFA coverage, privileged access management, identity lifecycle (joiner/mover/leaver), least-privilege enforcement, service account governance, conditional access.

  • A score of 3+ requires MFA on all privileged and external-facing access plus a defined access review cycle.

Domain 2 — Data Protection Assess: data classification, encryption at rest and in transit, DLP, backup integrity and immutability, recovery testing, data retention governance.

  • A score of 3+ requires tested, immutable backups and a documented, exercised recovery process.

Domain 3 — Network Security Assess: segmentation, zero-trust progress, egress filtering, perimeter and east-west monitoring, remote access controls, network detection and response.

  • A score of 3+ requires meaningful segmentation isolating crown-jewel assets, not just a flat perimeter.

Domain 4 — Application Security Assess: secure SDLC, dependency and vulnerability management, code scanning (SAST/DAST), API security, change management, third-party/component risk.

  • A score of 3+ requires vulnerability management with defined SLAs by severity and remediation tracking.

Domain 5 — Security Operations Assess: detection coverage (logging/SIEM), incident response plan maturity, mean time to detect/respond, threat intelligence integration, tabletop exercise frequency, SOC capability.

  • A score of 3+ requires a documented, tested incident response plan and centralized log collection across critical systems.

Domain 6 — Governance & Resilience Assess: risk management integration, third-party/supply-chain risk, business continuity and disaster recovery, security awareness, board reporting, regulatory alignment.

  • A score of 3+ requires a maintained risk register tied to business impact and regular board-level reporting.

For each domain, output:

  1. Score (1–5) with the matching maturity level name
  2. Evidence basis: 2–3 sentences citing the specific controls or gaps that justify the score
  3. Gap to next level: The single most important thing missing to reach the next tier
  4. Confidence flag: High / Moderate / Evidence-limited

Step 3: Calculate the Composite Score

Compute a weighted composite (1–5, one decimal place):

  • Apply the user's weighting, or default risk-weighting (Identity and Data at higher weight, others equal).
  • State the weighting used explicitly so the score is reproducible.
  • Translate the composite into an overall NIST CSF tier characterization and a one-line posture summary (e.g., "Risk-Informed, trending toward Repeatable — strong in Identity, materially exposed in Security Operations").

Step 4: Benchmark Against Peers

Position the organization relative to its industry and threat profile:

  • State the typical maturity range for peers in the stated industry and size band.
  • Identify where this organization leads, matches, or lags the peer baseline.
  • Flag any domain scoring below 3 that is high-frequency in the relevant threat landscape (e.g., ransomware-exposed organizations with Data or Identity below 3).

Step 5: Build the 90-Day Uplift Roadmap

Rank the highest-leverage actions by impact-to-effort, focused on moving the lowest-scoring, highest-risk domains:

  • Days 0–30: Quick wins that close the most dangerous gaps (typically Identity and Detection controls).
  • Days 31–60: Structural improvements requiring coordination or procurement.
  • Days 61–90: Process maturation and validation (e.g., recovery testing, tabletop exercise, control verification).

For each action: the domain it advances, the maturity-level gain it targets, the expected effort (Low/Medium/High), and the resilience outcome it produces.

Output Format

  • Structure: Executive summary → per-domain scorecard (six domains) → composite score with weighting → peer benchmark → 90-day roadmap
  • Length: 1,100–1,500 words
  • Format: Structured document with a domain scorecard presented as a table (Domain | Score | Level | Confidence | Gap to Next Level), prose for analysis, numbered list for the roadmap
  • Sections: Executive Summary → Maturity Scorecard (table) → Domain Detail → Composite Score & Posture → Peer Benchmark → 90-Day Uplift Roadmap
  • Tone: CISO-to-board — measured, evidence-led, no alarmism, no jargon for its own sake; every claim traceable to evidence

Quality Checklist

Before delivering output, verify:

  • [ ] All six domains are scored, each with an explicit 1–5 score and matching maturity level name
  • [ ] Every domain score cites specific evidence — no scores asserted without justification
  • [ ] Each NIST CSF tier mapping is consistent with the 5-level scale defined in Step 1
  • [ ] The composite score states its weighting method and is reproducible from the domain scores
  • [ ] Evidence-limited domains are flagged, not silently scored as if fully assessed
  • [ ] The 90-day roadmap prioritizes the lowest-scoring, highest-risk domains first — not an arbitrary order

Notes

  • The most common failure mode is scoring inflation: a domain with good tooling but no tested process is a Level 2, not a Level 4. Process maturity and validation — not tool ownership — drives scores of 3 and above.
  • Identity and Data are the domains most directly tied to ransomware and breach impact; under-scoring elsewhere is recoverable, but gaps here are the ones boards must hear about first.
  • Reassess every 6–12 months or after any major incident, audit, or infrastructure change to keep the baseline meaningful.
  • When evidence conflicts (e.g., a strong policy but a recent breach in that domain), weight the incident — demonstrated failure outranks documented intent.

How to use this skill

This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.

Installing in Claude Code:

  • ~/.claude/skills/<folder-name>/SKILL.md — auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)
  • <your-project>/.claude/skills/<folder-name>/SKILL.md — auto-loads only when working in that project (recommended for project-specific skills)

Restart Claude Code or open a new session to register.

Using in Claude.ai, ChatGPT, Gemini, or other AI tools:

  1. Drag this file into a new chat, or copy and paste its contents
  2. Send your task or request as your next message — the AI will apply the skill where it fits

For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills