// File 001 — Overview

What is MScoR?

MScoR (Information Security and Cybersecurity Maturity Model) is a proprietary methodology developed for SMEs and mid-sized companies, integrating best practices from international frameworks while remaining pragmatic and actionable.

Unlike approaches designed for large corporations, MScoR was designed from the outset for small to medium-sized organisations of 50 to 1,000 people. It takes into account the specific constraints of SMEs and mid-sized companies: limited budgets, small IT teams, no dedicated CISO, inherited technical debt.

The methodology draws in particular on the ISO 27001/27002/42001 standards, the recommendations of ANSSI, the NIST CSF framework and the best practices of the ISC2 body of knowledge. This synthesis provides complete coverage without the complexity of each framework taken individually.

The result is an overall and per-domain maturity score, directly usable to prioritise security investments and demonstrate progress over time.

                                ▶ Designed for SMEs
                                Adapted to organisations with 50 to 1,000 employees
                            

                                ▶ Multi-framework
                                ISO 27001/27002, CISSP, ANSSI, NIST CSF, ISO 42001
                            

                                ▶ Maturity score
                                A quantified assessment, comparable over time
                            

                                ▶ Actionable
                                Every finding leads to a concrete, budgeted action
                            

// File 002 — Levels

The 5 Maturity Levels

Each domain is rated on a scale of 5 maturity levels. This progressive model makes it possible to position the organisation precisely, set realistic objectives and measure progress over time.

Level 1 — Initial

Urgent action

Level 2 — Informal

Important action

Level 3 — Documented

Moderate action

Level 4 — Managed

Opportunity

Level 5 — Optimised

Continuous optimisation

// File 003 — Domains

The 9 Assessment Domains

MScoR covers 9 complementary domains to ensure a comprehensive assessment of your security posture. Each domain is assessed independently, making it possible to pinpoint strengths and areas for improvement.

D1 — Governance & Risk

D2 — Asset Management

D3 — Architecture & Engineering

D4 — Network Security

D5 — Identity Management

D6 — Testing & Assessment

D7 — Operations

D8 — Software Development

D9 — Artificial Intelligence

// File 004 — Approach

Three-Source Approach

Each MScoR audit relies on three complementary sources of validation to ensure a reliable and objective assessment. This triangulation eliminates blind spots and strengthens the credibility of the results.

Interviews

Objective: understand actual practices, constraints and how security is perceived within the organisation.

Technical Observations

Objective: compare what is declared with the actual configurations.

Documentation Review

Objective: analyse the existing documentation and assess its level of formalisation and maturity.

// File 005 — Frameworks

Frameworks & Standards

MScoR integrates and synthesises the requirements of the main international cybersecurity frameworks, offering complete coverage without the complexity of each standard taken in isolation.

ISO 27001:2022

International standard for Information Security Management Systems (ISMS). The 93 controls of Annex A structure the assessment of security controls.

ISC2

International non-profit association recognised for its cybersecurity expertise. It provides the profession with vendor-neutral guidelines and best practices, backed by a code of ethics.

ANSSI

The guides and recommendations of ANSSI, the French National Cybersecurity Agency, including the IT hygiene guide and sector-specific recommendations.

NIST CSF 2.0

The NIST Cybersecurity Framework 2.0 and its 6 functions (Govern, Identify, Protect, Detect, Respond, Recover) structure the overall approach to cyber risk management.

ISO 42001

Standard for AI management systems, integrated into domain D9 to assess the governance, ethics and security of AI uses.

EBIOS RM

Risk analysis method recommended by ANSSI, used to identify and classify threat scenarios in the French context.

Assess your security maturity with MScoR

Let's talk in a scoping call, with no commitment: together we will see how MScoR can structure and strengthen your security posture.

Request an assessment

MScoR Methodology