CTI Program Maturity Assessment

A scored self-diagnostic for a threat intelligence capability, built to resist the thing every self-assessment suffers from: the score you want rather than the score you have.

Nine domains, forty-five statements, scored on a 0–4 maturity scale with a per-domain Level 3 anchor so "3" means the same thing in every domain rather than whatever the room feels like that afternoon.

Two ceiling rules that override the arithmetic. This is the part that makes the result defensible. If the program is person-dependent — it works because one analyst knows things nobody wrote down — you are capped at Level 1 regardless of what the other domains say. If the room disagrees about the answers, you are capped at Level 2, because a capability nobody can describe consistently is not a capability. Ceiling A also caps the whole score at Domain 1 plus one: a program with no written requirements is not immature, it is a sophisticated noise generator.

Target profiles by organisation size, including the domains where the right answer is to deliberately stay at Level 1 and spend the effort elsewhere. Most buyers should target 1.8–2.3 and stop. The assessment says so plainly, which is the opposite of what a maturity model is usually built to do.

A twelve-row table of the ways self-assessments get inflated — the specific rationalisations, named, so you can catch yourself using them.

A gap map that links every domain to its remedy: score badly on Domain 5 and the assessment names the workbook section that fixes it and the runbooks that operate it. That cross-reference is the reason the line works as a set rather than a pile.

Closes with a ninety-day plan and a one-page executive summary template — the artifact you actually hand to someone who controls budget.

Ships as a print-ready PDF and an editable Word master.