A method includes determining, by an analysis system, a system aspect of a system for a mitigation evaluation. The method further includes determining, by the analysis system, at least one evaluation perspective and at least one evaluation viewpoint for use in performing the mitigation evaluation on the system aspect. The method further includes obtaining, by the analysis system, mitigation evaluation data regarding the system aspect in accordance with the at least one evaluation perspective and the at least one evaluation viewpoint. The method further includes calculating, by the analysis system, a mitigation evaluation rating as a measure of mitigation maturity for the system aspect based on the mitigation evaluation data, the at least one evaluation perspective, the at least one evaluation viewpoint, and at least one evaluation rating metric.