How it works

A cycle the organization sets itself.

Five stages, scored throughout on TruMaturity^™. The roadmap is built once and revisited on a cadence, so the order of work reflects where the organization actually is rather than what came up last.

Stage 01

Educate

Understanding comes before decisions. Boards approve what they can explain, and staff follow rails they were taught.

Board and executive briefing

Value, limits, and threat landscape in the language of the organization, not the vendor. Director education on oversight responsibilities.

Role-based workforce training

Security awareness, approved AI use, privacy handling, and control owner onboarding, taught to the roles that carry them.

Culture change support

Champion networks, phishing simulation, and the communications that make new practice stick.

Stage 02

Assess

Every domain opens with a Current State Assessment. It is the front-door engagement, and the evidence behind everything that follows.

Documentation review and interviews

Advance materials, then stakeholder interviews across IT, leadership, Legal, HR, Risk, and the business units in scope.

Inventory

Systems, AI use cases including shadow AI, personal data, core data assets, controls, and third-party exposure.

Framework gap analysis

Against the framework that governs the domain: NIST CSF, NIST AI RMF, COSO ERM, the DOJ ECCP, the NIST Privacy Framework, or DAMA-DMBOK.

TruMaturity assessment

Ten questions per domain scored 1 to 5 against evidence, producing the domain scores and the overall score.

Stage 03

Plan

The maturity roadmap is produced inside the assessment, not sold as a separate engagement.

Sequenced gaps

Which offerings execute next in this domain, ordered by exposure, effort, and what unblocks the next item.

Owners

A named person per workstream inside the organization, with decision rights written down.

Budget and order of work

What gets funded this cycle and what waits with a reason, framed as movement between maturity levels.

Stage 04

Execute

The roadmap gets worked. Devensa builds alongside the internal team so the capability stays after the engagement.

Governance framework and charter

Decision rights, committee and council design, escalation paths, and board reporting obligations.

Policy framework

Acceptable use, access, data handling, vendor standards, and the attestation process behind them.

Technical assessment and testing

Architecture review, controls testing, penetration testing, tabletops, impact assessments, and data quality measurement.

Program build and remediation

Registers, catalogs, inventories, response playbooks, and risk-prioritized remediation roadmaps.

Stage 05

Govern

The structure has to survive turnover, budget cycles, and the quarter nobody has time for.

Attestation-ready evidence

One evidence set, reusable across auditors, insurers, regulators, and the board.

Quarterly governance review

Maturity re-scored, the roadmap refreshed, and open remediation tracked against owners.

Reporting

The same measures, the same format, every board meeting.

Scored throughout

TruMaturity^™ runs across all five stages.

A maturity score per domain plus one overall score, used to guide budget conversations and prioritize what gets addressed first. The same measure is used at assessment, at each review, and in board reporting, so movement is legible rather than asserted.

How scoring works →

Baseline score

All six domains scored at assessment, before any work is selected.

Stage 02

Roadmap targets

A target level per domain for the cycle, agreed with leadership.

Stage 03

Progress re-score

Movement measured against the baseline on the agreed cadence.

Stage 04

Board reporting

One overall score and six domain scores, reported the same way each time.

Stage 05

Where to start

One domain or all six. The measure is the same.

Devensa meets organizations where they are. Work is selected against the maturity roadmap, in whatever order fits capacity, budget, and the pressure the organization is actually under.

The domain under pressure

An audit finding, an incident, a new regulator, or an AI rollout that got ahead of policy. Start where the heat is and let the roadmap catch the rest.

The full baseline

Score all six domains first, then sequence. Best where leadership wants the whole picture before committing budget.

A standing seat

Fractional executive leadership where the roadmap calls for someone accountable in the room, week to week.

Every engagement starts with a Current State Assessment.

Get started See the services menu