Methodology · Inside Steps
CAMP™, the capability assessment model behind Pytheus
CAMP rates a security program one capability at a time, current against target, and weights the result by how much each capability matters. The people who run each part answer for it, so maturity is measured rather than guessed.
How an assessment works
Owners answer the parts they run
Each capability is assessed by the person responsible for it, and every answer records who gave it.
Each capability is rated current against target
A 0 to 5 rating for where the capability is today, and another for where it needs to be.
Criticality weights the result
A gap in a critical capability counts for more than the same gap in a minor one, so the weighted result shows where to act first.
The maturity scale
Six levels, in the words a board reads. Every capability is rated against the level you are at and the level you are aiming for.
What an assessment gives you
The assessment does not stop at a number. It ends in what to do next, and an honest account of how much of the picture Pytheus actually knows.
- Answer questions
- Only where gaps remain.
- Bring your team
- Invite the people who know.
- What Pytheus knows
- Recorded inputs, provisional, needs input, conflicting and unknown, each shown as a share of the assessment.
- Fastest path
- The levels still to close, with the capabilities to raise first.
- Priorities
- What to do next.
- By domain
- Progress in each of the twelve domains.
This overview summarizes assessment inputs and recorded maturity. Independent framework-control verification is shown on Evidence.
The twelve domains
Ninety-four capabilities, grouped into twelve domains. Identity, network, compliance and security operations carry thirteen each. Physical carries one.
Run CAMP on your own program.
Book a walkthrough and we will show where your program would land across the twelve domains.
Figures shown in visuals are illustrative, not account data.