One morning, a long-standing client asks Sophie B., a partner at a Swiss accounting firm, a very simple question: "In practical terms, how do you protect my accounting data?" Sophie knows everything is "more or less in order" — but she has nothing to show for it. That day, cyber maturity stops being a matter for IT people: it becomes a sales argument.
Cyber maturity: a language your clients understand
Let's start with the word. Cyber maturity is the degree to which your security is structured: not how many tools you own, but your ability to know what you protect, how, and to prove it. An SME can have a good antivirus and low maturity; another can have modest means but solid maturity, because it knows exactly where it stands.
For a firm like Sophie B.'s, this is no small matter. What she really sells is trust: her clients hand over their accounts, payroll and tax data. The day a client wonders whether that information is well guarded, "I think so" no longer cuts it. A structured answer, by contrast, reassures — and sets you apart.
We often picture security as a switch: you are either protected or you are not. Reality looks more like a ladder. It can be described in five rungs:
- Reactive: you put out fires as they happen, with no method. "We'll deal with it if it comes up."
- Structured: a few procedures exist, but mostly in people's heads, rarely written down.
- Documented: practices are written and applied the same way by everyone.
- Measured: you track a few simple indicators and know where your weak spots are.
- Proactive: you anticipate, test and improve before problems arise.
Most Swiss SMEs sit between the first two rungs — and that is perfectly normal. The point is not to aim straight for the top, but to know which rung you are on and to climb the next one. It is precisely this movement, visible and tellable, that becomes a competitive advantage.
Camille, our cyber advisor, puts it this way: "In plain terms, a client doesn't ask you to be perfect. They ask you to know what you're talking about. An SME that honestly acknowledges its two weak points and shows its plan to fix them inspires more trust than one that swears everything is fine." Maturity is not the absence of flaws: it is awareness of your flaws and the method to address them.
This reversal changes where cybersecurity sits in your sales pitch. As long as it stays an invisible cost, it ranks below the coffee machine in your priorities. The day it becomes a clear answer to a client hesitating between you and a competitor, its nature changes: it earns money instead of costing it. In sectors where confidentiality is the heart of the business — accounting, consulting, healthcare — this ability to reassure turns into contracts won and clients who stay.
This tiered reading is nothing esoteric: it echoes the way recognised frameworks organise security. NIST CSF 2.0 — an international framework that breaks cybersecurity into broad functions (govern, identify, protect, detect, respond, recover) — serves precisely as a map to locate yourself. And the ISO/IEC 27001:2022 standard, the language of large buyers and supplier audits, describes the good practices a demanding client expects to find. This is not about earning a certificate, but about speaking the same language as those who assess you.
Key takeaways
Cyber maturity is shown, not declared. Saying "we take security seriously" carries no weight with a worried client. Being able to show where you stand, what you already do and what you plan to improve changes everything. Proof replaces the promise.
In Switzerland, the framework already exists and works in your favour. The nFADP — the revised Federal Act on Data Protection, in force since September 2023 — expects an SME holding sensitive data to take "appropriate" security measures. Structuring your maturity is therefore not one more constraint: it meets a legal expectation while building a sales argument. If you work with clients in the European Union, the GDPR (the equivalent European regulation) calls for the same reflexes.
Security is not just an IT matter. A large share of maturity comes down to organisational decisions: who does what, what the rules are for approving a payment, who has access to what. These are leadership topics, not just technical-provider ones. That is also what makes them accessible to an SME with no in-house IT: many rungs are climbed with rigour, not a chequebook.
Maturity is a path, not a checkbox. No one expects a fourteen-person firm to reach a bank's level overnight. What your clients — and the Federal Office for Cybersecurity (NCSC), Switzerland's reference on the matter — value is steady, documented progress. A small improvement every quarter beats a grand project that is never finished.
Habits to put in place this week
You need neither a budget nor an IT project to get moving. Three habits are enough to go from "I think it's in order" to "here is where we stand."
1. Map what your clients entrust to you
Take a sheet of paper and list the most sensitive data you hold: accounts, payroll, tax data, bank details. For each, note where it is stored and who has access. This inventory, however rough, is the starting point of any maturity: you only protect well what you have named. It is also the first question a client or an auditor will ask.
2. Write down what you already do
You almost certainly follow more good practices than you think: backups, passwords, caution over invoices. The trouble is that they live in habits, not on paper. Spend an hour noting, in a few lines, how these things are done in your firm. Moving from tacit to written is already a rung of maturity — and gives you something to show.
3. Locate yourself honestly on the ladder
Go back to the five rungs above and place yourself, without flattery or panic. For two or three key topics — data access, backups, payment verification — ask yourself: reactive, structured, documented? The honesty of this self-diagnosis is worth more than a flattering grade. It tells you where to focus your next effort, and gives you a credible story to share with a client.
Where do you really stand?
These three habits get you moving, but they remain hand-made. To turn that intuition into a clear picture, question by question, you need a method. That is exactly what the Cyber Passport self-assessment offers: it walks you through your cyber maturity across the domains that matter, drawing on recognised frameworks such as the nFADP, ISO 27001:2022 and NIST CSF 2.0, then produces a structured report — one you can share with a client or an auditor.
Let's be clear: Cyber Passport certifies nothing and does not claim to make you "compliant." It honestly shows you where your organisation is solid and where it still rests on interpersonal trust. It is this clarity, and the ability to present it, that make cyber maturity a genuine competitive advantage. The day a client asks Sophie B. her question, she will finally have something to answer — and to show.
