Security Improvement - Organization
KPI & Dashboarding
Cocoon unifies physical security, cyber awareness, and security culture into a single dashboard, with the Cocoon Physical Security Maturity Mark at its core.
- A single dashboard for physical security, cyber awareness, and security culture
- Maturity level at a glance: Bronze, Silver, Gold, Platinum, or Diamond
- Objective steering and trend analysis, instead of incidental audits
KPI & Dashboarding at Cocoon
KPI & Dashboarding brings physical security, cyber awareness, and security culture together into one clear, comprehensive overview. The heart of this service is the Cocoon Physical Security Maturity Mark (CPSM): a medal system—Bronze, Silver, Gold, Platinum, and Diamond—that displays an organization’s physical security maturity level at a glance.
The mark is based on an audit across seven ISO 27001 Annex A.7 controls, from perimeter security and access control to clear desk/clear screen. Each control is assigned a risk weight based on impact, and the weighted score on a scale of 1.0 to 5.0 determines the awarded level:
After being awarded, the dashboard monitors whether the level is maintained. Key KPIs, visitor registration (target value over 95%), tailgating success ratio (less than 10%), the trend in security incidents, training participation (over 90%), and timely closed corrective actions (over 95%) are measured monthly or quarterly. The mark is valid for 12 months and may be communicated externally under certain conditions, similar to ISO certification. In case of significant deterioration, an interim reassessment will follow, which may lead to suspension or downgrade.
Cocoon is also working on an externally accredited version of the mark, in discussions with an independent certifying body. Until that accreditation is finalized, the CPSM is Cocoon’s own, substantiated measurement system, not a third-party recognized certificate.
Who is this service for?
This service is intended for management, security managers, compliance officers, and risk managers who want to make decisions based on hard data rather than gut feeling, and for organizations that want to demonstrate their maturity level externally to clients, regulators, or in tenders.
KPI & Dashboarding is often implemented after a series of separate audits and tests whose results have not yet been consolidated into a single view, for tenders where a demonstrable maturity level is a requirement, or as a follow-up to Protocols & Procedures and Compliance Support, to make their effects continuously measurable.
Why choose Cocoon
Cocoon combines physical security, cyber awareness, and security culture into a single dashboard, instead of three separate reports that no one compares side-by-side. The CPSM medal system clarifies the maturity level at a glance, supported by a weighted score on seven ISO 27001 Annex A.7 controls instead of a gut feeling.
What you don't measure, you can't manage. What you can't prove, doesn't count in a tender.
KPI & Dashboarding combines well with Protocols & Procedures and Compliance Support: first, workable agreements and demonstrable compliance, then continuously measured in a single dashboard.
- A single dashboard for physical security, cyber awareness, and security culture
- Objective, weighted score instead of a gut feeling
- Externally communicable mark, with a clear validity period of 12 months
Case Study: From Hidden Risks to a Demonstrably Higher Level
A financial service provider gained insight into hidden risks through an integrated dashboard and improved its maturity level within a year. For a municipal organization, the same approach led to a final score of 3.35 on the seven A.7 controls, earning the Gold mark, “Risk-aware and controlled,” with entry controls (tailgating, visitor registration) identified as the sharpest area for improvement for the next measurement.
Frequently asked questions
What is the Cocoon Physical Security Maturity (CPSM) Quality Mark?
The CPSM is a medal system that represents an organization’s physical security maturity level across five tiers: Bronze, Silver, Gold, Platinum, and Diamond. The level is determined by a weighted score based on seven ISO 27001 Annex A.7 controls, ranging from perimeter security to clear desk/clear screen policies.
Is the CPSM quality mark a recognized certificate?
Not yet. Cocoon is working on an externally accredited version, in consultation with an independent certification body. Until that accreditation is finalized, the CPSM is Cocoon’s own substantiated measurement system and not a certificate recognized by a third party.
How long is the CPSM certification valid?
The certification is valid for 12 months. During this period, the dashboard monitors whether the security level is maintained via core KPIs such as visitor registration, tailgating success rates, and training participation. Significant deterioration will trigger an interim reassessment, which may lead to suspension or a downgrade.
Who is KPI & Dashboarding intended for?
This service is intended for management, security managers, compliance officers, and risk managers who wish to steer by data rather than gut feeling. Organizations that want to demonstrate their maturity level to clients, regulators, or in tenders also utilize this service.
How Do KPI & Dashboarding Relate to NIS2 and ABRO?
Both NIS2 and the General Security Requirements for the Central Government (ABRO) mandate that security measures are genuinely tested, not merely documented. KPI & Dashboarding ensures this compliance is continuously measurable and demonstrable, moving beyond incidental audits.