CtrlOne Endpoint Maturity Index
By CtrlOne Team ·
The CtrlOne Endpoint Maturity Index is a maturity model you apply to your own fleet, not a league table with scores or standings. The word index here means a set of stages, not a measured position among peers. Produced as part of the CtrlOne Institute editorial program, it gives IT admins and security leads a shared vocabulary for talking about how mature their endpoint configuration governance really is. There are no percentages or measured results in this model. Its usefulness comes entirely from honestly locating where your machines sit today and deciding what the next stage looks like for you.
Why a maturity model, not a league table
League tables invite comparison against numbers that may not reflect your context. A maturity model instead describes stages, so you can place yourself without pretending there is a single right score.
This model contains no measured data. Each stage is a qualitative description you can read and recognise, which is what makes it practical for planning.
The stages of endpoint maturity
Maturity tends to progress from ad hoc, to defined, to enforced, to continuously assured. Most fleets are a mix, mature in some areas and improvised in others.
Naming the stages helps teams agree on where they are and avoid overstating their posture.
- Ad hoc: configuration set by hand, rarely documented.
- Defined: a written baseline exists but is not enforced.
- Enforced: the baseline is applied to devices consistently.
- Assured: drift is corrected and changes are provable.
Locating your own fleet
Be honest about the gap between intention and reality. A documented baseline that machines ignore places you at defined, not enforced, however good the document is.
Assess different control areas separately. You might be assured on removable media but only defined on application control, which tells you exactly where to invest next.
Moving up a stage with CtrlOne
Progress comes from turning intentions into enforced, versioned state. CtrlOne expresses controls as named toggles, pushes them to Windows devices, and re-asserts the intended configuration when a device drifts.
Because every change is versioned and reversible, you can advance a stage without risking a change you cannot undo. That makes the climb from defined to enforced to assured a series of safe, deliberate steps.
- Convert documented baselines into enforced toggles.
- Enable drift correction to reach continuous assurance.
- Version changes so every step is reversible.
- Use evidence packs to prove the assured stage.
Avoiding false maturity
A common trap is mistaking activity for maturity. Deploying many controls once is not the same as keeping them enforced through the life of a device.
The assured stage is defined by durability, not effort. If a device can silently drift away from your baseline, you are not yet assured, whatever the deployment count suggests.
Where the model stops
This index measures configuration governance maturity, not detection capability. CtrlOne is not an AV, EDR, or SIEM and does not detect threats.
A mature configuration posture makes your detection tools more effective by shrinking attack surface. The two mature on separate tracks and support each other.
Frequently asked questions
Is the Maturity Index a league table against other companies?
No. It is a self-assessment model with descriptive stages. There are no scores, percentages, or comparisons against other organizations.
What are the maturity stages?
Ad hoc, defined, enforced, and assured. They describe how configuration governance progresses from manual work to continuously enforced and provable state.
How does CtrlOne help move up the model?
It turns documented baselines into enforced, versioned toggles, corrects drift for continuous assurance, and produces evidence packs to demonstrate the assured stage.
Does higher maturity mean I need less AV or EDR?
No. Maturity here is about configuration governance. It complements detection tools by reducing attack surface, but it does not replace AV, EDR, or SIEM.
Find your stage and take the next step
See how CtrlOne moves your fleet from documented to enforced to continuously assured configuration governance.