Overview
Findings represent security issues identified in an organization — and they play a key role in assessing cybersecurity maturity. In the Cye Exposure Management Platform, findings can be linked to specific NIST subcategories to reflect their impact on maturity scoring. This article introduces how findings support the maturity program and how they interact with the NIST CSF framework.
How Findings Support Maturity
Findings provide real-world evidence of security gaps or weaknesses. When linked to a NIST subcategory, a finding's remediation progress — not just its final status — contributes to that subcategory's calculated maturity score:
As progress increases, whether calculated automatically from linked remediation assets or set manually, the finding's maturity contribution improves gradually
Only findings of type Vulnerability are considered; Pre-open or Not Relevant findings are excluded from scoring
For the full calculation model — including how progress is determined and how subcategory scores are averaged — see Understanding Maturity: How Progress Drives Your Score.
How Findings Are Linked
Findings can be associated with NIST subcategories in a few ways:
Automatically, based on issue type and detection logic
Manually, when creating a finding
Through the right-hand pane of a finding on the Findings page
Via the Standards tab, where NIST CSF 1.1 or 2.0 subcategories can be added or removed
The primary framework is shown first, but mappings can be updated for either framework if both are in use.
Setting the Maturity Level of a Fixed Finding
Once a finding is fixed, its maturity level is set automatically if it has linked remediation assets, or by you if it doesn't. Either way, it can be adjusted afterward from the Standards tab in the finding's right-hand pane, if you have the required permissions.
See Setting and Editing a Finding's Maturity Level for the full walkthrough of both paths.
Wrap-up / Next Steps
Findings are more than just issues to fix — they're signals that inform the maturity score. Keeping them up to date and accurately mapped ensures the maturity assessment reflects the organization's real-world risk and progress.