You got it Randy! We should also add that there is a full set of diagnostic characteristics below each attribute, each of which can exist at one of the four maturity levels. This enables you to perform a detailed assessment of maturity, not just at the overall level, but exploring the underlying strengths and weaknesses. This model is called the RMM (Risk Maturity Model), and has been in existence since 1996. RMM is used quite widely by organisations in various industries and countries to benchmark their maturity and develop a targeted improvement plan.
