Regarding NIST Cybersecurity Framework/ISO 27001, how did you internally evaluate the effective of your controls? Are there any known matrix's you like/dislike?

I'm going through controls and I've come up with a matrix to gauge the maturity of a control, now I'm looking for the effectiveness of the control.

I'm curious to know what the community uses..did you build a matrix or is there a known matrix out there that you like?

​

build community control controls cybersecurity framework iso iso 27001 matrix maturity nist nist cybersecurity framework