Ad hoc
Controls exist informally; documentation is incomplete; no consistent review.
§ II · Maturity ladder
- Edition
- v.1.2
The maturity ladder.
Every HI-AAF control is graded on a five-level maturity ladder. An agent's overall maturity at certification is the lowest level achieved across all required controls in scope. This is deliberately conservative: a chain of trust is no stronger than its weakest link.
Documented
Controls are written down; ownership is assigned; review cadence is defined.
Operated
Controls are followed in practice; evidence is collected; deviations are tracked.
Measured
Control effectiveness is measured against documented thresholds; trends are reported.
Continuously Improved
Controls evolve based on incident learning; maturity gains are evidenced over time.
Ad hoc
Controls exist informally; documentation is incomplete; no consistent review.
Documented
Controls are written down; ownership is assigned; review cadence is defined.
Operated
Controls are followed in practice; evidence is collected; deviations are tracked.
Measured
Control effectiveness is measured against documented thresholds; trends are reported.
Continuously Improved
Controls evolve based on incident learning; maturity gains are evidenced over time.