Cyber Threat Information Sharing

No process documentation or not formally approved by management.

Standard process does not exist. Actions are ad hoc and undocumented.

Formally approved process documentation exists but has not been reviewed in the previous 2 years.

Ad-hoc process exists and is performed informally. Results are inconsistent.

Formally approved process documentation exists; exceptions are documented and approved and make up less than 5% of activities.

Formal process exists and is implemented. Evidence available for most activities. Less than 10% process exceptions.

Formally approved process documentation exists; exceptions are documented and approved. Documented & approved less than 3% of activities.

Formal process fully implemented. Evidence available for all activities. Detailed metrics captured and reported. Less than 5% process exceptions.

Formally approved process documentation exists; exceptions are documented and approved. Documented & approved less than 0.5% of activities.

Formal process fully implemented and continually improving. Minimal exceptions (<1%). Process improvements tracked and evidenced.