A practical mnemonic for cybersecurity maturity

Sometimes I use a simple mnemonic to evaluate an organisation&#x27;s cybersecurity maturity. It&#x27;s not perfect. It’s a useful tool to spark meaningful discussions about their security posture. 1 It boils down to asking one question. How does an organisation decide what technical controls to implement? In other words, what drives the decision to enable a mitigation? There are roughly three…