The best way I have found to measure the level of maturity of an organization’s CIRC is by considering its maturity against the three well established and tightly interrelated categories of: people, processes, and technology. Great technology in the wrong hands isn’t a path to success for detection or response.