Page 392 - CyberSecurityEssentialsEnglish

TABLE 8-15: LEVELS OF INSTITUTIONAL MATURITY

Level What it looks like The next step

Individual experiments with no Discover the real uses and write a
Ad hoc
register or owner. one-page policy.

A policy and a register exist, but Add acceptance tests and named
Defined
application varies. owners.

Classification, testing, and approval Measure value and risk and close
Managed
are routine. the loop on findings.

Indicators and monitoring are in Add independent assurance for
Measured
place and reviewed. high-impact cases.

Audit, learning, and renewal are Extend to portfolio management
Improving
continuous. and skills strategy.

✓ For organizations with limited resources

Start with the minimum workable governance.
• A policy of one or two pages with a clear risk classification.
• One register for medium and high uses, with an owner for each case.
• A short monthly review bringing together value, risk, and changes.

A Center of Excellence and the Federated Model
When uses multiply, an organization needs a body that helps teams learn and reuse. It may
be an AI center of excellence or a small enablement team. Its role is not to own every project,
but to provide reference patterns, templates, test sets, training, and advice, to track the

portfolio of uses, and to connect technical expertise with the domain and the risk.

A fully centralized model suits small organizations or early stages, but it may slow scaling. A
fully decentralized model speeds teams up but duplicates tools and makes risk hard to see.

A federated model therefore helps: shared standards, platforms, and a central register, with
ownership and delivery inside the units. Higher-risk cases escalate to deeper review, while
low-risk cases operate within standing limits.

A center of excellence should be measured by the value of the enablement it provides, not

by the number of meetings or documents. Useful indicators include the time for a team to
reach a controlled pilot, the rate of component reuse, improvement in test results, a fall in
duplicated tools, the speed of incident handling, and the growth of an expert network inside

the units. If the center becomes a compulsory gate for every small question, it may create
shadow use rather than reduce it.

391