ISO/IEC 27000 Maturity · Information Security Management Systems (ISMS)
Your information security management system, placed on the ISO 27000 family scale and turned into an action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
ISO/IEC 27000 Maturity · Information Security Management Systems (ISMS)
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One ISO/IEC 27000:2018 (ISO/IEC 27000 family) assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
This mechanism, a level, the level above, and the action linking the two, is what turns a finding into a trajectory.
Is the statement of applicability kept up to date and consistent with the controls actually in place?
- N1
No usable statement of applicability. Controls in place are not linked to a reference list.
- N2
A statement exists, drawn up during the initial certification file. It has not been reviewed since and several entries no longer match reality.
- N3
The statement is reviewed periodically, each retained or excluded control carries a justification and an identified owner.
- N4
Reviews are systematic, fed by the risk assessment and internal audits. Gaps identified lead to a tracked action.
- N5
The statement is updated at every change in scope or risk context, with a version history and reasons for revision.
Action to move from L2 to L3
Go through the statement of applicability control by control with the relevant owners, record a justification and an owner for each, and link its review to the half-yearly management review.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon ISO 27000.
What this framework covers
ISO/IEC 27000 is the entry standard of the family devoted to information security. It defines the terms and principles shared by ISO 27001 for requirements, ISO 27002 for controls, ISO 27005 for risk, and the related sector-specific texts. It describes what an ISMS is: a defined scope, a policy driven by top management, a risk assessment, a set of selected and justified controls, evidence of operation, reviews and continual improvement. It is not audited for its own sake, it provides the reading framework for the whole family.
In practice, an ISMS is hard to steer because it runs across the entire organisation. Does the declared scope still match actual activities, after reorganisations and new digital services? Does the statement of applicability reflect controls actually in place, or intentions inherited from the initial certification file? Do management reviews produce tracked decisions, or a meeting summary? These questions rarely surface in the same place, and no one holds the complete answer.
One frequent confusion deserves clearing up: the ISO 27000 family is not a stack of competing standards. ISO 27000 provides the vocabulary, ISO 27001 carries the certifiable requirements, ISO 27002 offers the catalogue of controls reorganised into four themes since the 2022 version, ISO 27005 covers risk assessment. A mature ISMS can state which standard serves what purpose within its arrangements. Many organisations use ISO 27000 vocabulary without having aligned these building blocks with one another.
The maturity assessment answers a different question from the compliance audit. An audit concludes with a gap, a minor or major non-conformity, or conformity. The assessment places each practice on a progressive scale and identifies the action that moves it to the next level. It delivers no certification: it measures the real state of the system and prepares for the audit, showing where the ISMS will hold and where it will not.
Within Datamensio, the framework is ready to use and stays adaptable. AI adjusts the themes, rephrases the questions and refines the levels using the CMMI method, or builds a variant from your own documents: security policy, statement of applicability, review minutes.
Reference standard: ISO/IEC 27000:2018 (ISO/IEC 27000 family)
The themes assessed
Context and scope of the ISMS
Definition of the scope of application, activities and sites covered, interfaces and dependencies, identification of interested parties and their requirements.
Leadership and policy
Top management commitment, formalised and communicated information security policy, assigned roles and responsibilities, allocated resources.
Risk assessment and treatment
Assessment method, evaluation and acceptance criteria, treatment plan, statement of applicability and justification of retained or excluded controls.
Organisational controls
Asset management, information classification, access management, supplier relationships, contractual requirements and security clauses.
People security
Pre-employment screening, awareness and training, confidentiality commitments, leaver and mobility procedures, remote working.
Physical and environmental security
Secure areas, physical access control, equipment protection, media handling and disposal.
Technological controls
Configuration hardening, logging and monitoring, vulnerability and patch management, cryptography, backups, secure development.
Incident management and continuity
Detection and classification, response procedures, notification to relevant parties, lessons learned, business continuity and associated testing.
Documentation and evidence
Control of documented information, version management, retention of records, traceability of security decisions.
Monitoring, review and improvement
Performance indicators, internal audits, management reviews, handling of non-conformities, corrective actions and follow-up over time.
A short version of the framework, with 27 questions, is available for the online self-assessment.
Frequently asked questions
Can ISO 27000 be certified?
No. ISO/IEC 27000 provides the vocabulary and principles of the family. Certification applies to ISO/IEC 27001, for which ISO 27000 provides the reading framework. The assessment measures your ISMS maturity and prepares for the audit, it delivers no certificate.
What is the difference between this assessment and a compliance audit?
The audit checks the presence of requirements and concludes with conformity or a gap. The assessment places each practice on a maturity scale and identifies the action that drives progress. The two complement each other: the assessment prepares, the audit validates.
How long does the assessment take?
The short version is completed in a single working session. The full version, run collaboratively with several contributors, spans one to two weeks, most of the time being spent gathering input from the relevant teams.
Do we need to already be certified to use this framework?
No. It suits organisations building their ISMS as well as those already certified who want an objective view of their real level between audits, or who are extending their scope.
Can the framework be adapted to our organisation?
Yes. You can amend questions, levels and themes, or start from a blank base. AI can also build a variant from your security policy and statement of applicability. You retain full control of the framework.
How can several entities be compared?
Each business unit completes the same assessment. Scores per theme can be compared across entities and against previous assessments. A cross-entity roadmap consolidates the assessments and groups common actions.
How does this assessment fit with NIS 2 or DORA?
These texts largely rest on the same security management principles. An assessed ISMS forms a reusable foundation. The cross-entity roadmap allows frameworks to be cross-referenced without duplicating actions.
Where is the data hosted?
In France, with OVH, backed up at Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European solutions.