Maturity models

A maturity model measures how consistently something is done, not how well it protects you.

Level four means the process is managed and measured. It does not mean the controls are appropriate or the risks are covered. It is a useful way to describe organisational capability and a poor proxy for security outcome, and the two get reported interchangeably.