Insufficient: CyberVadis was either unable to verify the information security definition and implementation of the company or could only do so to a minimal degree.

Basic: Cybervadis could verify that the company has some understanding of their Information Security needs and is defining their security approach.

Moderate:  Cybervadis could verify that the company understands their Information Security needs and is improving their security approach.

Developed: Cybervadis could verify that the company takes account of their Information security needs and has developed their security approach.

Mature: Cybervadis could verify that Information Security is part of the company culture and that they have a mature security approach.