Is your security improving? We measure it every 3 months.
A score out of 100, against the NIST CSF and the CIS Controls, with every gap detailed. With the SOC, each measurement checks the fixes from the previous one.
Maturity score
out of 100, illustrative example
Level 2 · Managed
Accumulating tools is not enough
Antivirus, firewall, backups… Companies invest. But an essential question remains unanswered.
- of ransomware victims in France are small and mid-sized businesses
- 48%
- days on average to identify and contain a breach
- 247
- of ransomware victims in France are local authorities
- 11%
Sources: ANSSI (French national cybersecurity agency), Cyber Threat Overview 2025, in French · IBM, Cost of a Data Breach Report 2026
No visibility
You don't know where you really stand or how your posture evolves over time.
No priorities
Without clear indicators, it's impossible to know what to improve first to reduce exposure.
False protection
Tools give a sense of security. Without maturity measurement, you're flying blind.
Measure, act, attest
Three steps, built on the NIST CSF and the CIS Controls.
01
Measure
We audit your technical and documentation environment, and deliver a score out of 100 with a report detailing every gap.
Audit of your environment: the six NIST CSF 2.0 functions
- 1Govern34
- 2Identify52
- 3Protect41
- 4Detect45
- 5Respond30
- 6Recover42
Sample values, out of 100.
02
Fix
Two ways to fix, your choice: we apply the fix for you, once an expert has validated it, or we hand it to you ready to apply. With the SOC, this continuous remediation is included in all three tiers, on the Microsoft 365 perimeter; gaps that fall to your software vendors, your developers or your organization stay on your side, guided by the plan.
Step 2, executed by a team, not a report.
24/7 Monitoring
Our SOC monitors your environment around the clock, day and night, 365 days a year.
Proactive Remediation
We fix the vulnerabilities we find and keep strengthening your security posture.
Incident Response
Once a threat is detected, an analyst qualifies the alert and initiates the response according to your tier's SLA: analysis and neutralization. Restoration is on quote.
03
Attest
We formalize your level in a clear indicator that a client or partner can read with no technical background. It is not a certification: it is your first step toward ISO 27001.
illustrative exampleCyber Maturity Rating
Your organization
2Managed
Your security is managed
Current protections
38
Detection capability
45
Resilience & recovery
42
Assessed by DMC DEFENSE
Audit of your environment: the six NIST CSF 2.0 functions
- 1Govern34
- 2Identify52
- 3Protect41
- 4Detect45
- 5Respond30
- 6Recover42
Sample values, out of 100.
The 4 CMR levels
Your company is positioned on an objective maturity scale, built from this score.
0–20
Level 0: No foundations
Level 1 20–40
Foundation
You are no longer vulnerable to basic attacks
Basic protection. The basics are in place but critical gaps exist.
- MFA enabled
- Antivirus / EDR deployed
- Functional backups
- Regular updates
- User awareness
Level 2 40–60
Managed
Illustrative example: 42 / 100
Your security is managed
Structured policies and active monitoring. Your posture is continuously managed.
- Active SOC
- Log monitoring
- Access management
- Incident response procedures
- Endpoint monitoring
Level 3 60–80
Advanced
You are in a serious defensive posture
Advanced detection and response capabilities. Formalized and regularly tested processes.
- Threat Hunting
- Advanced detection
- Regular audits
- Phishing tests
- Business continuity plan
Level 4 80–100
Resilient
Mature and resilient organization
Full resilience capability. Security governance and continuous compliance.
- Crisis exercises
- Red Team / Pentest
- Security governance
- ISO / NIST alignment
Security is a process
Each validated action moves your score and brings you closer to international certifications.
Clear roadmap
A prioritized action plan tailored to your current level and business objectives.
Quarterly review
Regular check-ins to measure your progress and adjust priorities.
In 5 minutes, get your first estimate
Answer 10 key questions to get an indicative score and discover your cyber maturity level.
0 of 10 answered
- 01Do you use multi-factor authentication (MFA)?
- 02Are your systems monitored 24/7?
- 03Do you regularly test your backups?
- 04Do you have a documented incident response plan?
- 05Do your employees receive regular cybersecurity training?
- 06Do you hold a certification or follow a security framework such as NIS2, SOC 2 Type 2 or ISO 27001?
- 07Do you perform penetration tests (pentests) at least once a year?
- 08Do you have an up-to-date inventory of all your IT assets?
- 09Are your access rights managed according to the principle of least privilege?
- 10Do you have a patch management policy in place?
The gaps to fix first, ranked for you.
The free audit gives you a first measurement, with no commitment.
After you send it
Reply within 24 business hours
An expert reads your request and gets back to you to qualify your need.
Free audit
On Microsoft 365: a one-hour audit of your tenant's posture (Secure Score, identities, Defender) and your priority flaws. Otherwise: we scope your need (pentest, security policy) and set the price. No commitment.
Dedicated contact
The same DMC expert follows you end-to-end, with no call-center in between.