| Category | Name | Current | Target | Gap | Evidence | Status |
|---|---|---|---|---|---|---|
| GV.OC | Organisational context | 3.7 | 4.0 | 0.3 | 88 items | On track |
| GV.RM | Risk management strategy | 3.4 | 4.0 | 0.6 | 99 items | On track |
| GV.RR | Roles, responsibilities and authorities | 3.8 | 4.0 | 0.2 | 50 items | On track |
| GV.PO | Policy | 3.9 | 4.0 | 0.1 | 23 items | On track |
| GV.OV | Oversight | 3.2 | 4.0 | 0.8 | 175 items | On track |
| GV.SC | Supply chain risk management | 2.5 | 4.0 | 1.5 | 76 items | Gap |
| ID.AM | Asset management | 3.8 | 4.0 | 0.2 | 104 items | On track |
| ID.RA | Risk assessment | 3.7 | 4.0 | 0.3 | 159 items | On track |
| ID.IM | Improvement | 3.2 | 4.0 | 0.8 | 112 items | On track |
| PR.AA | Identity, authentication and access | 4.3 | 4.5 | 0.2 | 161 items | On track |
| PR.AT | Awareness and training | 3.5 | 4.5 | 1.0 | 82 items | Gap |
| PR.DS | Data security | 4.1 | 4.5 | 0.4 | 30 items | On track |
| PR.PS | Platform security | 3.6 | 4.5 | 0.9 | 170 items | On track |
| PR.IR | Infrastructure resilience | 3.4 | 4.5 | 1.1 | 48 items | Gap |
| DE.CM | Continuous monitoring | 3.8 | 4.5 | 0.7 | 44 items | On track |
| DE.AE | Adverse event analysis | 3.2 | 4.5 | 1.3 | 162 items | Gap |
| RS.MA | Incident management | 3.6 | 4.0 | 0.4 | 162 items | On track |
| RS.AN | Incident analysis | 3.3 | 4.0 | 0.7 | 71 items | On track |
| RS.CO | Reporting and communication | 3.4 | 4.0 | 0.6 | 162 items | On track |
| RS.MI | Incident mitigation | 3.1 | 4.0 | 0.9 | 170 items | On track |
| RC.RP | Recovery plan execution | 2.8 | 4.0 | 1.2 | 138 items | Gap |
| RC.CO | Recovery communication | 2.6 | 4.0 | 1.4 | 82 items | Gap |