ot-security-program-maturity-assessmentlisted

## When to Use - Measuring OT security program maturity before and after a capability investment. - Comparing maturity across sites on one scale. - Building an improvement roadmap with named gaps. - Answering a customer or regulator maturity question with a standard model. ## Prerequisites - Evidence pack: policies, procedures, training records, incident records, architecture documents, vendor registers. - Interviews with the program owner, operations, engineering, and IT leads. - Prior maturity assessment if one exists, for trend comparison. - Credentials: none. This skill produces assessment documents. - Authorization: program owner accepts the scores and the roadmap. - Upstream skills: outputs from any prior assessment skills serve as evidence. ### Safety This skill is passive. It produces assessment and governance documents only. ## Workflow 1. Score per domain at domain level. Requirement: the C2M2 model is scored by domain, and this skill does not invent practice-level identifiers. Anchor: C2M2 domains. Decision: the ten domains are Asset, Change, and Configuration Management; Identity and Access Management; Threat and Vulnerability Management; Risk Management; Situational Awareness; Event and Incident Response; Third-Party Risk Management; Workforce Management; Cybersecurity Architecture; and Cybersecurity Program Management. Trade-off accepted: domain-level scoring is coarser than practice-level scoring and takes a fraction of the time. Where a detailed C2M2 pr