ISO 27001 and ISO 27032 Maturity · Cybersecurity
Your information security measured against ISO 27001 and 27032, translated into a costed action plan.
12 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 12 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
ISO 27001 and ISO 27032 Maturity · Cybersecurity
12 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One ISO/IEC 27001:2022 and ISO/IEC 27032:2012 assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 12 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
It is this mechanism (a level, a level above, and the action that connects the two) that turns a finding into a trajectory.
Does the statement of applicability reflect the controls actually implemented?
- N1
No formalised statement of applicability, or a document produced once and never reopened since.
- N2
The statement exists and covers the 93 controls, but it describes the intended state. Gaps with actual implementation are not identified.
- N3
Each control is linked to an existing practice and an owner. Exclusions are justified and the document is reviewed at least once a year.
- N4
The statement is updated with every significant change in scope, risk or organisation, with a version history and associated implementation evidence.
- N5
The statement is linked to the risk treatment plan and to security indicators. Gaps found during internal audit trigger a tracked revision.
Action to move from L2 to L3
Check each Annex A control against the observed practice, name an owner for each control and log gaps in the treatment plan. Add the review of the statement of applicability to the agenda of the annual management review.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon ISO 27001.
What this framework covers
ISO 27001 requires an information security management system: a defined scope, a risk analysis, a statement of applicability that justifies including or excluding each of the 93 controls in Annex A, measured objectives, internal audits and a management review. The 2022 version restructured this annex into four themes, organisational, people, physical and technological, and introduced new controls on threat intelligence, cloud services security and data protection during development. ISO 27032 is not certifiable: it describes cybersecurity practices that reach beyond the organisation’s own boundaries, coordination between stakeholders, security of exposed applications, information sharing on incidents.
These two texts are hard to steer because they lend themselves to box-ticking. An ISMS can exist on paper and change nothing in daily practice. The questions that actually matter are concrete: does the statement of applicability reflect the controls genuinely deployed, or the state hoped for at the time of initial certification? Do security indicators feed a decision, or fill a dashboard? Do Annex A controls apply to subsidiaries and suppliers, or only to the historical head office scope? Does the management review produce tracked decisions, or a minute?
The transition to ISO/IEC 27001:2022 exposed a common confusion: many organisations updated their statement of applicability without re-examining the practices underneath. Moving from 114 to 93 controls is a mapping exercise, not proof of progress. Another confusion worth clearing up: ISO 27032 is not an extended version of 27001. It addresses an angle that 27001 covers poorly, the security of interactions with parties you do not control, suppliers, customers, threat information sharing communities. The two complement each other, one through management, the other through cyberspace.
The maturity assessment answers a different question from a certification audit. The audit concludes with conformity or a nonconformity, on a given scope, at a given date. The assessment places each practice on a progressive scale and points to the precise action that moves it to the next level. A certified organisation can sit at a modest maturity level on third party management or awareness. A non certified organisation can be strong on operations. The score per theme makes these gaps visible before an auditor flags them.
In Datamensio, the ISO 27001 and 27032 framework is ready to use. You can also adapt it: the AI adjusts themes, questions and maturity levels to your sector and scope, or builds a variant from your own documents, security policy, statement of applicability, internal audit reports.
Reference standard: ISO/IEC 27001:2022 and ISO/IEC 27032:2012
The themes assessed
Context, scope and ISMS governance
Determination of internal and external issues, expectations of interested parties, documented and justified scope, security policy, roles and responsibilities, management commitment.
Risk assessment and treatment
Assessment method, acceptance criteria, treatment plan, statement of applicability and justification of exclusions, validation of residual risks.
Organisational controls
Topic specific policies, asset management, information classification, supplier relationship security, incident management, continuity, legal compliance.
People security
Pre employment screening, contractual clauses, awareness and training, disciplinary process, management of departures and mobility.
Physical and environmental security
Physical access perimeters and controls, protection against environmental threats, equipment security, workstations and media, secure disposal.
Technological controls
Access and identity management, protection against malicious code, logging and monitoring, technical vulnerability management, cryptography, network and cloud services security.
Development and application security
Security requirements in projects, separated environments, testing, change management, protection of data used in development and testing, security of internet facing applications.
Threat intelligence and information sharing
Intelligence sources used, operational exploitation of signals, participation in sector information sharing schemes, coordination with authorities and CERTs, a core theme of ISO 27032.
Ecosystem and third party security
Mapping of dependencies, contractual requirements, supplier evaluation and monitoring, digital supply chain security, management of third party remote access.
Incident management and continuity
Detection, qualification, escalation, handling and lessons learnt, continuity and recovery plans, tests and exercises, preparedness of external stakeholders.
Performance measurement and internal audit
Security indicators and objectives, internal audit programme, auditor competence, tracking of findings, management review and tracked decisions.
Continual improvement
Handling of nonconformities, corrective actions, updating the ISMS, comparison of results over time and across entities.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Does this assessment deliver ISO 27001 certification?
No. Certification is granted by an accredited body, following a two-stage audit. Datamensio measures the maturity of your practices, identifies gaps and produces the action plan that prepares you for that audit. ISO 27032, for its part, is not certifiable: it is a good practice guide.
What is the difference between this assessment and a compliance audit?
The audit checks that requirements are met and concludes with conformity or a nonconformity. The assessment places each practice on a five level maturity scale and points to the action that moves it to the next level. A certified organisation can show very uneven levels depending on the theme.
Why assess 27001 and 27032 together?
ISO 27001 organises security inside the organisation’s own boundaries. ISO 27032 addresses what happens outside: third parties, exposed applications, information sharing on incidents. Assessing them together avoids the classic blind spot of an ISMS that is strong internally and exposed on its ecosystem.
How long does the assessment take?
The short version takes 20 to 30 minutes to complete. The full version, run collaboratively with several contributors, usually spans one to two weeks. Most of the time goes into gathering input from operations, human resources and procurement teams.
Can the framework be adapted to our scope?
Yes. You can edit questions and levels, add your own themes or restrict the scope to a business unit. The AI can also generate a variant from your security policy and your statement of applicability. You keep full control of the framework.
How do you compare several entities?
Each entity runs its assessment on the same framework. The benchmark compares scores per theme across business units and against previous campaigns. A cross entity roadmap consolidates action plans from several assessments, which avoids funding the same control twice.
Do you need technical expertise to answer?
The questions cover management and implementation practices, not configurations. A security manager or an internal auditor can answer them. Questions relating to operations or development are routed to the right contributor in collaborative mode.
Where is the data hosted?
In France, with OVH, with backup at Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.