Data Security Maturity Model: Levels, Assessment, Roadmap

Most organisations can name their data security tools but cannot say where their sensitive data lives, who and what can reach it, or how quickly they would notice it leaving. Data now spreads across SaaS, cloud object storage, data warehouses, backups and AI pipelines, and much of it is read by service accounts and integrations rather than people. This five-level model, on the same Ad hoc to Optimised scale as the NHI Mgmt Group NHI Governance Maturity Model, scores data security across nine dimensions, from discovery and classification through access governance and protection to monitoring and recovery. It lines the levels up with NIST CSF 2.0, NIST SP 800-53, the CISA Zero Trust Maturity Model Data pillar, the NCSC Cyber Assessment Framework and ICO security guidance. It is for CISOs, data protection officers and data platform owners who need a defensible baseline and a data security roadmap.

Key takeaways

Score nine dimensions separately: governance, discovery and inventory, classification, access governance, encryption and keys, data loss prevention, monitoring, resilience, and retention and deletion. An average hides the weakest link.
Discovery comes first. Every later control depends on knowing where sensitive data sits, including shadow copies in exports, test environments, backups and AI retrieval stores.
Level 3 (Defined) is the right first target: a maintained inventory of sensitive data stores with owners, a classification scheme applied to them, access reviewed for people and machines, and encryption with managed keys by default.
Non-human access is where data leaves. Service accounts, API keys, shareable links and OAuth grants usually hold broader, longer-lived data access than any employee, and they are reviewed least.
Maturity must show in numbers: coverage of the inventory, classified stores, access reviewed, data encrypted with managed keys, restores tested and time to detect unusual bulk reads.

The five levels

The data security maturity levels below apply to each dimension. Because it covers personal data handling as well as confidentiality, the model also works as a data protection maturity model for security and privacy teams together.

Level	Name	Description
1	Ad hoc	No inventory of sensitive data. Classification exists on paper, access is granted per request and rarely removed, encryption depends on platform defaults and nobody watches data access. Breaches are found by third parties.
2	Developing	A data security policy and classification scheme are approved. Major databases and file shares are listed by hand, some DLP rules run in monitor mode, and backups exist but restores are rarely tested.
3	Defined	Sensitive data stores across on-premises, cloud and SaaS are inventoried with owners, labels are applied to them, access by people and machines is reviewed on a schedule, encryption at rest and in transit is standard, data access is logged centrally and retention rules are enforced.
4	Managed	Discovery and classification are automated and continuous, access decisions consider identity, device and data category and are time-limited for sensitive data, keys are customer managed with least privilege, DLP blocks on labels, and detections for bulk access and exfiltration run in the SOC.
5	Optimised	Data posture is assessed continuously, access is granted just in time and just enough, exfiltration is blocked dynamically, deletion is automated across copies, and incidents and posture findings tune policy automatically.

The levels follow the progression of the CISA Zero Trust Maturity Model v2.0 Data pillar, which moves from Traditional ("manually identifies and inventories some agency data") through Initial and Advanced to Optimal, where data loss prevention can "dynamically block suspected data exfiltration" and access control becomes dynamic, just in time and just enough across the enterprise.

The nine dimensions

Levels 2 and 4 sit between the descriptions shown; the roadmap below lists what moves you from each level to the next.

Dimension	Level 1 Ad hoc	Level 3 Defined	Level 5 Optimised
Governance and ownership	No data security owner; policy, if any, unread	Data security policy approved, data owners named for each sensitive store, risk appetite for data set and reported	Policies defined once and enforced across platforms automatically; posture reported against appetite
Discovery and inventory	Sensitive data locations unknown beyond core systems	Inventory of sensitive data stores across on-premises, IaaS, PaaS and SaaS with owner, data category and location; shadow copies found by periodic scans	Continuous discovery including exports, test copies, backups, logs and AI retrieval stores; new stores registered automatically
Classification and labelling	Scheme exists on paper only	Three to four tiers applied to every inventoried store and to documents in the main collaboration platforms; labels drive handling rules	Automated labelling across all data types, with accuracy sampled and user overrides reviewed
Access governance (human and non-human)	Broad groups, shared accounts and never-expiring links; leavers keep access	Least-privilege roles for sensitive stores; quarterly reviews covering users, service accounts, API keys and integrations; public and anonymous links prohibited for sensitive tiers	Just-in-time, just-enough access decided per request using identity, device and data category; unused permissions removed automatically
Encryption and key management	Platform defaults; keys and secrets in code or config	Encryption at rest and TLS in transit for all sensitive data; keys in a managed key service or HSM, rotated, with separation between key and data administrators	Cryptographic agility, least-privilege key use, encryption or isolation of data in use where appropriate; key access monitored
Data loss prevention	None, or email rules only	DLP on email, endpoint, web and main SaaS for the highest tiers, enforced after a monitor-only period; generative AI tools covered	Context-aware prevention that blocks suspected exfiltration dynamically with low false positives
Monitoring and detection	No data access logs, or logs nobody reads	Access to sensitive stores logged centrally; alerts for bulk reads, new external sharing and access from unusual identities	Behaviour baselines per identity and dataset; predictive analytics; automated containment for high-confidence detections
Resilience and backup	Backups on the same credentials and network as production	Backups isolated and immutable for critical data, restores tested against recovery objectives	Recovery automated and rehearsed; historical data available as needed without widening exposure
Retention and deletion	Data kept indefinitely	Retention schedule enforced on primary stores; secure sanitisation of media and equipment	Deletion automated across copies, backups and derived datasets, with evidence produced for each request

For how the underlying controls work, see the Data Security Guide, the Data Classification Guide and the Data Retention and Secure Deletion Guide.

How this model relates to other frameworks

No single data security maturity framework is mandated, so this model borrows from several. NIST CSF 2.0 (February 2024) states the Data Security category as data "managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information", with subcategories for data at rest (PR.DS-01), in transit (PR.DS-02), in use (PR.DS-10) and backups (PR.DS-11). The CISA Zero Trust Maturity Model v2.0 (April 2023) scores the Data pillar across five functions (Data Inventory Management, Data Categorization, Data Availability, Data Access and Data Encryption) plus cross-cutting Visibility and Analytics, Automation and Orchestration, and Governance. In the UK, NCSC CAF principle B3 Data Security has five contributing outcomes, and the ICO points out that UK GDPR Article 32 requires "a process for regularly testing, assessing and evaluating" security measures. NCSC's Protecting bulk personal data guidance offers 15 measures, each with a traffic-light rating, that work well as a quick check on a single large data store.

Dimension	NIST CSF 2.0	NIST SP 800-53 Rev. 5	CISA ZTMM Data function	NCSC CAF
Governance and ownership	GV.PO, GV.RR	PM-1, RA-2 Security categorization	Governance	A1, B1
Discovery and inventory	ID.AM-07	CM-8, PM-5(1) Inventory of PII	Data Inventory Management	B3.a Understanding Data
Classification and labelling	ID.AM-07	RA-2	Data Categorization	B3.a
Access governance	PR.AA-05	AC-3, AC-6	Data Access	B2.c, B2.d
Encryption and keys	PR.DS-01, PR.DS-02, PR.DS-10	SC-8, SC-12, SC-13, SC-28	Data Encryption	B3.b, B3.c, B3.d
Data loss prevention	PR.DS-01, PR.DS-02	AC-4 Information flow enforcement	Data Inventory Management (DLP)	B3.b, B3.c
Monitoring and detection	PR.PS-04, DE.CM-03, DE.CM-09	AU-2, AU-12	Visibility and Analytics	C1
Resilience and backup	PR.DS-11	CP-9 System backup	Data Availability	B5.c Backups
Retention and deletion	PR.DS-01	SI-12, MP-6 Media sanitization	Automation and Orchestration	B3.e Media / Equipment Sanitisation

DSPM maturity sits mainly in the discovery, classification, access and monitoring rows: a data security posture management tool can move those dimensions from Level 2 to Level 4, but it does not encrypt, back up or delete anything. See the DSPM Buyer's Guide.

Where identity fits

The access governance dimension is usually scored on human access alone, which is why many organisations rate it too high. Data warehouses, object stores and SaaS platforms are read in bulk by ETL jobs, BI connectors, backup services and AI retrieval pipelines, each running on a service account, key or token. Three incidents on this site show the pattern: the Microsoft SAS token exposure, where one over-permissive link exposed 38TB of internal data; the Snowflake breach, where stolen credentials without MFA unlocked customer data warehouses; and the GoTo breach, where encrypted backups were taken together with their encryption key. Include every non-human identity with read access to sensitive data in the inventory and reviews. See the Database Credential and Access Security Guide.

Self-assessment questions

Use these questions as a data security self assessment or as the basis of a facilitated data security capability assessment. Score each dimension from 1 to 5 using evidence, not intent. Your overall level is the lowest score among the dimensions that protect your most sensitive data, not the average. Record the evidence behind each score, the date and the assessor, and baseline the metrics below at the same time so the next data security maturity assessment shows movement.

Governance: does every store holding your highest classification have a named owner who has approved who can access it?
Discovery: how many sensitive data stores did your last scan find that were not already in the inventory, and how long had they existed?
Classification: what percentage of inventoried stores carry a classification, and how was accuracy checked?
Access: can you list every service account, API key, shareable link and OAuth grant that can read your most sensitive dataset, and when each was last reviewed?
Encryption and keys: who can use the keys protecting your crown-jewel data, and are they different people from those who administer the data?
DLP: which exfiltration routes (email, web upload, removable media, cloud sync, generative AI prompts) are covered in blocking mode for the top tier?
Monitoring: would you detect a service account reading ten times its normal volume overnight, and who would be alerted?
Resilience: when was a critical dataset last restored from backup, and did it meet its recovery objective?
Retention: if a person asked for erasure today, could you find and delete their data in backups, analytics copies and test environments?

Moving up a level

From Ad hoc to Developing

Approve a data security policy and a simple classification scheme of three or four tiers.
List the systems known to hold regulated or confidential data and name an owner for each.
Remove public and anonymous sharing links from those systems and enforce MFA for access to them.
Turn on audit logging for the main databases, storage accounts and collaboration platforms.

From Developing to Defined

Run discovery across cloud, SaaS and on-premises stores and reconcile the results with the inventory; treat every unknown store as a finding.
Apply classification to every inventoried store, then to documents in the main collaboration platforms.
Review access to sensitive stores quarterly, including service accounts, keys and integrations, and remove unused permissions. See the Access Reviews Guide.
Make encryption at rest and TLS in transit the default, and move keys into a managed key service with separate key administrators. See the Cryptographic Key Management Guide.
Deploy DLP for the top tier in monitor-only mode for four to six weeks, tune false positives, then enforce by channel, keeping the monitor policy as the rollback if business processes break. See the Data Loss Prevention (DLP) Guide.
Isolate backups of critical data from production credentials and test a restore each quarter.

From Defined to Managed

Automate discovery and classification so new stores and copies are registered and labelled without manual effort.
Make access to the top tier time-limited and conditional on identity, device and data category.
Build SOC detections for bulk reads, mass downloads, new external sharing and access by identities outside a dataset's normal set. See the Data Exfiltration Guide.
Extend DLP and access controls to generative AI tools and AI retrieval pipelines. See the Generative AI Data Loss Prevention Guide.

From Managed to Optimised

Grant access to sensitive data just in time and remove it automatically when the task ends.
Automate deletion across primary stores, copies and backups, with evidence produced per request.
Feed incident and posture findings back into policy, and automate containment for high-confidence exfiltration detections.

Metrics that show maturity

Inventory coverage: sensitive data stores found by discovery that are in the inventory with an owner (target 100% for the top tier).
Classification coverage: inventoried stores with a classification applied.
Access review completion: sensitive-store entitlements, human and non-human, reviewed on schedule, and the percentage removed.
Managed-key encryption: top-tier data encrypted at rest with keys in a managed service and separated administration.
Restore success: critical dataset restores that met their recovery objective in the last quarter.
Time to detect bulk access: minutes from an unusual bulk read to an analyst decision, measured in exercises.

Common failure patterns

Tools before inventory: buying DLP or DSPM before agreeing classification and owners, so alerts have nobody to go to.
Open stores nobody owns: databases and storage left reachable from the internet. The DeepSeek database exposure left chat logs and API secrets in an open database.
Keys stored with the data: encryption that fails because the attacker takes the key too, as in the GoTo breach above.
Machine access never reviewed: access reviews that skip service accounts, keys and shareable links, which often carry the broadest standing access.
Averaging the score: reporting an overall Level 3 while backups or monitoring for the most sensitive data sit at Level 1.

Practitioner checklist

Set Level 3 as the 12-month target for all sensitive data, with Level 4 for regulated and crown-jewel datasets.
Build the sensitive data inventory with owners before buying new data security tooling.
Include non-human identities in every access review of sensitive stores.
Separate key administration from data administration for the top tier.
Run DLP in monitor mode before enforcing, with a documented rollback.
Test restores of critical data quarterly from isolated, immutable backups. See the Backup Security and Immutable Backup Guide.
Reassess every six months and after any major platform, cloud or AI adoption.

Data Security Maturity Model