ResiliencyPulse lets you set a target maturity for every category and shows you the gap. The question we get most often is what the target should be. The short answer is 3 for most categories, 4 for a few, and 5 for almost none.
Why 3
A 3 is a defined process: documented, standardized, communicated. It is the level at which a practice survives staff turnover. For most categories in most organizations, that is the outcome leadership is actually paying for. Setting 3 as the default target keeps the roadmap honest and keeps the gap list short enough to act on.
When 4 is right
Set a 4 where regulation, contract, or real exposure demands measurement: recovery time capability for critical systems in a regulated institution, crisis communications for an organization whose reputation is the business, third-party continuity where a single supplier failure stops operations. A 4 means the practice is measured and corrected, and the cost of getting there is a metric, an owner, and a cadence. Only pay that cost where it buys something.
Why 5 is usually wrong
A 5 is continuous improvement integrated into how the organization runs. It is a reasonable description of how a mature organization treats, say, safety. It is rarely a reasonable target for a continuity category, because the investment to move from 4 to 5 is large and the risk reduction is small. A roadmap full of 5s is a roadmap nobody funds.
Targets by organization stage
A new or relaunched program should target 3 across the board and nothing higher. A program in its third or fourth year should hold 3 as the floor and pick two or three categories for 4. A program that has sustained 3.5 to 4.5 should be asking which categories could safely drop effort, not which should go to 5.
Set them, then reassess
Targets are only useful against a reassessment. ResiliencyPulse reminds you at ten months and flags the assessment as due at twelve. The gap report between two assessments, against the same targets, is the single most persuasive page you can put in front of a board. Set targets you can defend, and let the second assessment make the case.