When conducting a Validated Assessment, the entity must score the Measured and Managed maturity levels.

In a Validated Assessment, organizations are required to scorePolicy, Procedure, and Implementationmaturity levels for all applicable requirements. TheMeasuredandManagedlevels are considered advanced maturity tiers and are not mandatory for every requirement. They are only scored where applicable, typically for controls involving monitoring, governance, or performance management. For example, requirements around continuous vulnerability scanning or incident response metrics may include Measured and Managed, while policy-only requirements do not. Therefore, while entities may choose to pursue Measured and Managed maturity for stronger assurance or competitive differentiation, they are not required for certification. Certification can still be achieved with strong performance in the foundational maturity levels (Policy, Procedure, Implementation).