An organization uses system administrators to measure firewall configuration security.

The Measured maturity level evaluates whether organizations actively monitor the effectiveness of controls. HITRUST defines seven criteria for Measured, including metrics, data collection, analysis, reporting, and corrective action tracking. If these seven criteria are fully met, scoring can begin at Tier 4 strength, reflecting a mature measurement process. In the example, system administrators are responsible for measuring firewall configuration security, and if they meet all seven criteria (such as reviewing firewall rules, analyzing logs, reporting deviations, and initiating remediation), the Measured compliance level can start at Tier 4. The assessor may then adjust scoring based on coverage and frequency, but the baseline is Tier 4 once all criteria are satisfied. This ensures consistent evaluation of advanced maturity levels across controls.