Blog
How to run a CTEM maturity self-assessment in an afternoon
A CTEM self-assessment goes wrong in one predictable way: the person filling it in scores the program they intend to have. The fix is not a cleverer questionnaire. It is a short session, the right people in the room, and a rule that every high answer needs something you can point to.
This post walks through running that session in about half a day, using the site’s own tools. It assumes you know the basics from What is CTEM?; if not, read that first.
Before you start: two minutes with the quick check
The quick check asks five questions, one per stage, and tells you which stage looks weakest. Do it alone, first, without discussion. It is a smoke test, not a score: with one statement per stage it can only point at where to look. Write down your weakest stage and compare it with the full result later.
Who to invite
Four people is enough:
- Whoever runs vulnerability scanning or exposure tooling.
- Someone from infrastructure or application engineering who receives the tickets. They know whether the tickets have owners and dates.
- Someone who can speak for the business side of scope, such as a service owner or risk lead.
- The person who reports to leadership.
If only the security lead is in the room, you measure the security lead’s opinion. Mobilisation cannot be scored without someone from the teams that do the fixing.
The session, step by step
1. Read the scale aloud (5 minutes). The full assessment has twenty statements, four per stage, answered on a five-point scale: Not true, Rarely true, Sometimes true, Mostly true, Fully true. Agree the meaning first: “Fully true” means you could show the evidence today, not that it is planned.
2. Answer stage by stage, in stage order (about two hours). Take the statements as a group and let people disagree. When two people give different answers, use the lower one and note the reason. If nobody wrote down what is in scope, a “Mostly true” on discovery describes a scope that does not exist.
3. Demand evidence for anything above “Sometimes true”. For each high answer, ask what you would hand an auditor. A signed scope statement, a reconciliation report, a validation log, a time-to-close chart. “We do it informally” means a lower score. The maturity model post lists the evidence expected at each level for each stage.
4. Submit and read the result (30 minutes). The assessment gives a score for each stage and an overall figure. Do not stop at the overall number. Look at the shape.
5. Turn the result into three actions (about an hour). The assessment recommends up to three statements to act on first, starting with your lowest answers and lowest-scoring stage. Take those as the starting point for the next cycle rather than trying to fix everything.
How the score is calculated
Each answer is worth 0 to 4 points. A stage score is the points earned as a share of the maximum for that stage, so four statements make a maximum of 16. The overall score is the average of the five stage scores. The assessment names your weakest stage; if two tie, it says so and suggests one first move for each.
Because the overall figure is an average, a very strong stage can hide a very weak one. That is why the shape matters more than the total.
What the levels mean
The overall score maps to one of five bands. Each comes with a short piece of guidance in the assessment.
| Score | Level | What it says |
|---|---|---|
| 0 to 20 | Initial | Exposure work is reactive and scanner-driven. Start by scoping one bounded area and running a single deliberate cycle. |
| 21 to 40 | Developing | The pieces exist but do not connect. Focus on prioritisation by attack path and on naming fix owners. |
| 41 to 60 | Defined | A repeatable cycle is in place. Add validation so priorities are proven rather than assumed. |
| 61 to 80 | Managed | Exposures are prioritised, validated and tracked. Push on business-language reporting and widening scope. |
| 81 to 100 | Optimising | The program is continuous and measured. Concentrate on cycle time, coverage gaps and automation. |
The bands are coarse on purpose. Two programs on 58 and 62 are not meaningfully different; what differs is which stages pull each average up or down.
Reading the five stages
Scoping. Low scores mean the program has no agreed boundary, so every later stage is measuring something undefined. The fix starts with a one-page scope statement approved by a business owner.
Discovery. Low scores mean unknown assets stay unknown, or that discovery only covers CVEs. The first move is reconciling at least two sources and tracking the assets that only one of them sees.
Prioritisation. Low scores mean the remediation list is still ranked by severity score. Adding two fields to each finding, reachable from an attacker position and critical asset in path, is the first step.
Validation. This stage often scores lowest, because it usually needs tooling or a new habit rather than a document. Validating just the top five exposures each cycle is enough to begin.
Mobilisation. Low scores mean findings leave security and disappear. If you cannot say who owns a fix and by when, the earlier stages are not producing outcomes. See CTEM metrics for what to report once ownership works.
High discovery with low validation means a program that finds a lot and proves little, which is the gap between CTEM and vulnerability management.
After the session
- Record the result. The assessment can store it against your email address so the next one can be compared, and you can print or save it as a PDF. Note the date and the evidence behind each high answer.
- Pick a scope for one cycle. If you landed at Initial or Developing, How to start a CTEM program in 90 days is the practical path.
- Re-run in a quarter or two. Expect movement of roughly one level per two or three cycles, not one per quarter.
- If tooling is the gap, the vendor directory shows which platforms cover which stages, and the tools guide explains how to read it.
The quick check takes two minutes and the full assessment covers all twenty statements. Run both, compare, and argue about the difference.