Score 35 controls across seven security domains. Outputs a maturity tier from Initial to Optimising, a per-domain heatmap, and prioritised remediation recommendations.