The survey also revealed that these organizations outperform in a number of other activities arising from the recognition of cyberrisk as a business risk. At level 4, security is embedded in products, services, and processes (“security by design”) customers, partners, third parties, and regulators are fully incorporated into the management of enterprise resilience.Īs they embrace a risk-based cybersecurity approach, leading organizations can become proactive. Reducing enterprise risk is the aim of the more advanced, risked-based approach (level 3): companies manage and measure security and privacy controls in an enterprise-risk framework, set risk-appetite thresholds, and include all stakeholders in the cybersecurity operating mode.īeyond this is level 4, the realm of proactive cybersecurity, in which holistic resilience and digital trust are attained through the transformation of processes and adoption of next-generation technologies. The result is a maturity-based approach to cyberrisk (level 2). Companies initially plug gaps by building and strengthening security and resilience fundamentals (level 1), moving on to establish an operating model and organization to professionalize a cybersecurity function.

The dangers are swiftly growing in number and severity.Ĭompanies can measure their progress toward cybersecurity maturity by evaluating capabilities, technology, and risk-management processes.

Results revealed that while some in the banking and healthcare industries have achieved fair progress, most organizations in all industries have much yet to do to protect their information assets against threats and attacks. In 2021, McKinsey assessed the cybersecurity-maturity level of more than 100 companies and institutions in a number of industry sectors.

Pearl's Progress by James Kaplan