{
  "id": "workflow:security-control-maturity-assessment",
  "_kind": "Workflow",
  "_file": "workflows/workflows/workflows-cyber-risk.yaml",
  "_cluster": "workflows",
  "attributes": {
    "displayName": "Security Control Maturity Assessment",
    "workflowKind": "governance",
    "triggerType": "scheduled",
    "typicalCadence": "semi-annually",
    "complexity": "cross-team",
    "description": "Assesses security control maturity against industry frameworks --\nmapping implemented controls to NIST CSF, CIS Controls, and ISO\n27001 requirement sets, scoring each control domain on a maturity\nscale from initial through optimized, identifying control gaps where\nframework requirements lack corresponding implementations, evaluating\nautomation level and evidence-collection maturity for each control,\nbenchmarking maturity scores against industry peers and regulatory\nexpectations, and developing prioritized roadmaps to advance maturity\nin lagging domains. Produces control maturity heat map, gap analysis,\nand maturity advancement roadmap. Excludes control implementation and\nframework selection.\n"
  },
  "outgoingEdges": [
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "role:security-risk-analyst",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "role:security-reviewer",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "role:principal-engineer",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "skill-area:incident-response",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "skill-area:identity-security",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "domain:cybersecurity-grc",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "domain:security",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "responsibility:security-review",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "responsibility:run-security-scans",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "org-unit:security-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    },
    {
      "from": "workflow:security-control-maturity-assessment",
      "to": "org-unit:compliance-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    }
  ],
  "incomingEdges": [
    {
      "from": "stack-profile:siem-platform",
      "to": "workflow:security-control-maturity-assessment",
      "kind": "follows_workflow"
    }
  ]
}