Survey NIST Results – Cresco

Assessment Results

1

Initial

Policy or standard does not exist or is not formally approved by management.

2

Repeatable

Policy or standard exists, but has not been reviewed in more than 2 years.

3

Defined

Policy and standard exists with formal management approval. Policy exceptions are documented, approved and occur less than 5% of the time.

4

Managed

Policy and standard exists with formal management approval. Policy exceptions are documented, approved and occur less than 3% of the time.

5

Optimizing

Policy and standard exists with formal management approval. Policy exceptions are documented, approved and occur less than 0.5% of the time.