How far your CNAPP programme has come, measured.
Buying a CNAPP is the start. NxSCORE measures the programme around it across ten dimensions and five levels, from your own data where it can, and shows what the next level needs.
You will recognise this if
- Your board asks how far the cloud security programme has come, and the answer is a licence renewal date.
- The CNAPP has modules and policies nobody switched on, and nobody is sure which.
- A vendor score rates the product, not whether your team runs it well.
- Last year’s maturity assessment was a workshop and a slide, and nothing has measured it since.
Five levels, earned in order.
A level counts only when every criterion at it, and at every level below, is met. Nothing is averaged away.
- L1 Ad hocWork happens, but nothing shows it is complete or repeatable.
- L2 VisibleEvery account is seen, every control assessed, every day.
- L3 GovernedOwners, fix-by dates and baselines are set and kept.
- L4 IntegratedGuardrails, the SOC and the pipeline close the loop.
- L5 AdaptiveProblems stop coming back, and the numbers show it.
Ten dimensions, across the capability areas of a CNAPP.
Each dimension has criteria at every level. One from each, as the product states it.
| Dimension | Criterion | Level | How it is known |
|---|---|---|---|
| Visibility and coverage Accounts and CNAPP coverage | At least 95% of accounts are monitored by the CNAPP | L3 Governed | Measured |
| Posture management CSPM | No high-severity finding is past its fix-by date | L3 Governed | Measured |
| Identity and entitlements CIEM | A guardrail stops new IAM users and long-lived keys | L4 Integrated | Measured |
| Workload protection CWPP | IMDSv2 and EBS encryption controls pass in every account | L3 Governed | Measured |
| Data security DSPM | S3 Block Public Access is on and public buckets are guarded | L3 Governed | Measured |
| Code and infrastructure as code IaC | Infrastructure is deployed from reviewed templates | L3 Governed | Self-assessed |
| Detection and response CDR | An organisation CloudTrail logs every region with file validation | L2 Visible | Measured |
| Remediation and recurrence prevention Fix and prevent | Fewer than 5% of fixed resources fail again | L5 Adaptive | Measured |
| Governance, compliance and evidence Compliance | At least 80% of this quarter’s evidence is accepted | L3 Governed | Measured |
| Operating model People and process | Guardrails go through change control with a sandbox test first | L4 Integrated | Self-assessed |
- Measured from NxSCORE’s records24
Read from your connected accounts, your CNAPP and the work done in NxSCORE: coverage, controls, fix-by dates, guardrails, recurrence and evidence.
- Answered by your team16
What no API can show, such as who owns cloud security or whether incident response is exercised. Marked self-assessed wherever it appears.
Measured, not guessed. Now, the next level.
From a workshop once a year to a measure every day.
The measured criteria are rechecked after every daily assessment. The level moves when the work does.
- 01
One overall level, with the weakest dimension named.
The overall level is the median of the ten, rounded down. Beside it, the weakest dimension is named: in this example, data security at L1 Ad hoc. One gap is never hidden by strong scores elsewhere.
Maturity, example estateOverall L3 Governed- Visibility and coverageL3 Governed
- Posture managementL3 Governed
- Identity and entitlementsL2 Visible
- Workload protectionL3 Governed
- Data securityL1 Ad hoc
- Code and infrastructure as codeL2 Visible
- Detection and responseL3 Governed
- Remediation and recurrence preventionL4 Integrated
- Governance, compliance and evidenceL3 Governed
- Operating modelL2 Visible
- 02
The criteria still missing are the plan.
For each dimension, the criteria not yet met at the next level are listed. They are concrete: connect the whole AWS Organization rather than single accounts, put a guardrail on new IAM users, agree a prevention plan for most recurring issues.
Most of them are work NxSCORE already does with your team, so the level moves as the findings close and the guardrails go in.
To reach the next levelExample estate- Data security, to L2Not answered
Data stores holding customer data are identified and tagged
- Identity and entitlements, to L3Not met
No root access keys, root MFA on, user keys rotated
- Operating model, to L3Not answered
Teams that own cloud resources know they own their findings
- 03
Your answers, marked as yours.
Criteria no API can show, such as a named owner for cloud security or a yearly incident exercise, are answered by your team in the product. They count towards the level and are marked self-assessed wherever they appear, so nobody mistakes them for a measurement.
Answered by your teamSelf-assessedA named person owns cloud security Yes New AWS accounts are added to the CNAPP and NxSCORE automatically Yes Cloud incident response is exercised at least yearly Not yet - 04
Progress, quarter by quarter.
The latest levels for each quarter are kept, for the last eight quarters, so the board sees where the programme stood and where it is now, dimension by dimension.
Maturity by quarterExampleQuarter Overall Weakest Q1 2026 L1 Ad hoc Data security, L1 Q2 2026 L2 Visible Data security, L1 Q3 2026 L2 Visible Data security, L1 Q4 2026 L3 Governed Data security, L1
Questions teams ask about this.
Is this an analyst firm’s CNAPP maturity model?
No. It is NxSCORE’s own model. It covers the capability areas commonly used in industry definitions of a CNAPP, and it is not affiliated with or derived from any analyst firm. If you use an analyst’s maturity guide, you can map the ten dimensions to it yourself.
How is the overall level worked out?
Each dimension is at the highest level whose criteria, and those of every level below it, are all met. The overall level is the median across the ten dimensions, rounded down, and the weakest dimension is named beside it so a single gap is never hidden by an average.
Which criteria are measured and which do we answer?
Of the 40 criteria, 24 are measured from your connected accounts, your CNAPP and the work done in NxSCORE. The other 16, such as who owns cloud security or whether incident response is exercised, are answered by your team and marked self-assessed.
Does it replace our CNAPP’s own score?
No. A CNAPP score rates how your cloud is configured. The maturity model rates the programme around it: coverage, how fast findings are fixed, whether they come back, guardrails, evidence and who does what.
See where your programme stands today.
Connect your CNAPP and one cloud account. After the first assessment, your analyst takes you through your level in each dimension, the weakest one, and the criteria that would move it.