A presenter explains the difference between holistic maturity assessments, which measure program health and progress, and compliance assessments, which use binary yes/no questions. The video covers frameworks like HIPAA and NIST, and when to use graduated scales versus simple pass/fail evaluations.
Regardless of it's HIPAA, any other risk domain, NIST, I think about risk assessments in a couple different ways. One, there's a holistic risk assessment or a maturity assessment that looks at a program and progress and health. And then below that, you know, and those typically inform a strategy or overall progress that you've made, sometimes compliance, but if it's a compliance assessment, you're gonna actually ask more binary questions of like, do you have it or not? Or do you have partial credit or not? Or as maturity, you might be a— using a graduated scale to show progress on a maturity curve.
