During a capability maturity assessment of security processes, management asks what target maturity level should be set for each process. What is the BEST guidance?

Maturity models describe how consistently, formally and measurably processes are performed, and higher levels require more investment to reach and sustain. The appropriate target for each process depends on how much the business relies on it and how much risk the organization is willing to accept, so targets should differ across processes. Critical processes that protect high-value assets may warrant higher maturity, while others may be adequately served at a lower level. Targeting the highest level everywhere is costly and often unnecessary; it diverts resources from processes where improvement matters most and may never deliver proportionate risk reduction. Using an industry average substitutes other organizations' circumstances for this organization's needs, and the average may be either too demanding or not demanding enough for particular processes. Raising every process by one level each year is arbitrary; it ignores which processes actually need improvement and would eventually push low-value processes to unnecessary levels. Exam caveat: regulatory or contractual obligations can set minimum expectations for certain processes, which then become part of the business need. Operational check: confirm each target level in the assessment is documented with the business or risk rationale and approved by management.