🔐 Hot take: If your ISO 27001 Statement of Applicability still uses binary "Implemented / Not Implemented" for control status, you're losing valuable insight.

We've adopted the N-P-L-F scale from ISO/IEC 15504 (now 33020):

N – Not achieved (0–15%)
P – Partially achieved (>15–50%)
L – Largely achieved (>50–85%)
F – Fully achieved (>85–100%)

It turns the SOA from a checkbox exercise into a real maturity roadmap and auditors appreciate the transparency.

How do you handle implementation status in your SOA? Binary, CMMI-style levels or something else entirely? 😅

#ISO27001 #InfoSec #ISMS #GRC #Compliance #SecurityMaturity

Immature product security isn’t just inefficient, it’s dangerous, & organizations can’t afford to treat it as an afterthought anymore.

Learn more in our latest blog 👉 https://finitestate.io/blog/immature-product-security-risks

#ProductSecurity #CyberSecurity #IoTSecurity #DevSecOps #SecurityMaturity

Few Fortune 100 Firms List Security Pros in Their Executive Ranks

https://krebsonsecurity.com/2023/07/few-fortune-100-firms-list-security-pros-in-their-executive-ranks/

#securitymaturity #ALittleSunshine #DatosInsights #TariSchreider #Accenture #IANS