The management of cyber risk is undergoing a fundamental transition, moving away from maturity-based approaches that measure progress against predefined capability milestones toward risk-based methodologies that focus directly on identifying, assessing, and mitigating the specific risks that threaten the organisation’s most critical assets and operations. This shift is not merely a refinement of existing practice; it represents a substantive change in how organisations think about cybersecurity investment, prioritisation, and accountability, and it has significant implications for how the ISO constructs, governs, and communicates the security programme.
The Limitations of the Maturity-Based Approach #
The maturity-based approach to cybersecurity, once regarded as an effective organising framework, has reached the limits of its usefulness for organisations seeking a dynamic and efficient approach to managing enterprise risk. Maturity models focus on building specific capabilities and reaching defined levels of programme development, such as establishing a Security Operations Centre, implementing multi-factor authentication, or achieving a particular framework certification. While these objectives have value for organisations establishing foundational security capabilities, they are ultimately insufficient as the primary basis for managing cyber risk in a complex and rapidly evolving threat environment.
The core limitation of maturity-based approaches is that they provide, at best, an indirect proxy for actual risk reduction. Progress through maturity levels does not reliably correlate with meaningful reductions in the organisation’s exposure to the threats most likely to cause material harm. The consequences of this misalignment are consistently observed in practice:
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
