Maturity here refers to a practiced, seamless, and efficient system. How many times have you been on an airplane and failed to pay attention to the flight attendant’s standard review of emergency procedures? If often, you are likely in good company.

This creates certain safety risks. In such a case, a documented and consistently practiced policy exists – the equivalent of maturity level 3 if we were assessing the maturity of a privacy program. Moving up to level 4 requires a closer study of measurable factors, including how quickly – and therefore efficiently – existing protocols are executed in emergency situations (real or simulated). In this example, how quickly can passengers figure out how to inflate their safety vests and where the nearest emergency exit is located?

Level 5 then requires studying those metrics on an ongoing basis for both successful and problematic results, and making improvements to your system accordingly. If, for example, the safety vests are complicated or prone to malfunction due to user error, this aspect of the safety protocol should be addressed with a simpler and more reliable safety vest design or a more effective training procedure for passengers.