Skip to content

Next Steps

After you determine your current maturity, first re-review the sustainment criteria for the previous level. Confirm there are no gaps in process, coverage, or metrics. If issues remain, resolve them before advancing. Once you are confident you can hold your current level, focus on the next logical level. The model is sequential, and progress is earned step by step.

  • Verify last level's sustainment evidence is current and complete.

  • Close any gaps in process, coverage, or metrics.

  • Reconfirm ownership and cadence.

  • Advance only when sustainment is demonstrated, then plan actions for the next level.

How to Progress⇱

  1. Use the ARMOR actions at your target level as the foundation for planning. Translate them into projects or initiatives in your security roadmap. Assign clear ownership, set timelines, and connect each action to business objectives, not just technical goals.

  2. Progression is only durable if sustainment is in place. Validate that asset inventories are accurate, remediation timelines are enforced, strategies are reviewed, and metrics are collected and applied. Advancement should occur only when practices are consistently demonstrated.

  3. Maturity requires more than testing; it requires an ecosystem. Strengthen the supporting operational practices at each level.

  4. Treat higher levels as aspirational. Not every organization will reach the Resilient stage, but all can benefit from its principles. Even partial adoption of continuous validation or adversary simulation practices brings measurable gains. Stabilizing at earlier levels is not failure, it still represents meaningful, sustainable progress.

  5. Maturity is not static. Technology stacks, business priorities, and adversary tactics constantly shift. Reassess your ARMOR level annually or after major organizational changes. Use results to update your roadmap, celebrate progress, and identify new opportunities to advance.