Maturity scale
Six levels, one published rubric
Every ResiliencyPulse assessment scores on the same 0 to 5 scale, in 0.25 steps, with the same level descriptions. That is what makes scores comparable across teams, years, and organizations.
| Score | Level | What it means |
|---|---|---|
| 0 | Non-existent | No recognizable practice in place. |
| 1 | Initial / ad hoc | Done reactively, by individuals, without a defined approach. |
| 2 | Repeatable but intuitive | Practices repeat but depend on people rather than a defined program. |
| 3 | Defined process | Documented, standardized, and communicated across the organization. |
| 4 | Managed and measurable | Monitored and measured, with action taken when performance slips. |
| 5 | Optimized | Continuously improved and integrated into how the organization runs. |
Where programs usually start
Most programs we assess are not broken. They are scattered. In Bryghtpath’s Resiliency Diagnosis® work, most organizations start between 1.5 and 2.5: informal, reactive, dependent on a few people. Programs that commit to a structure typically reach 2.5 to 3.5 within about two years, and sustain 3.5 to 4.5 once measurement and integration become routine.
A 5 is rare and should be. It means the practice is continuously improved and woven into how the organization runs, not that every box is ticked.
Where the levels come from
The six levels are the maturity model from COBIT, ISACA’s framework for the governance of information and technology: 0, non-existent; 1, initial or ad hoc; 2, repeatable but intuitive; 3, defined process; 4, managed and measurable; 5, optimized. It is an industry standard that auditors and risk teams already know, so a score means the same thing to them as it does to the program. ResiliencyPulse adds quarter steps and plain-language descriptions on every question.
Scoring consistency
A scale only works if two people scoring the same evidence land in the same place. Every question in ResiliencyPulse carries plain-language descriptions for each level, and facilitated assessments are reviewed before release. That consistency is also what makes the benchmark pool trustworthy.