Risk Management Maturity

Assessing risk begins with baselining, establishing a current state to get to the desired state. Progress is measured by meeting milestones and objectives, i.e. a maturing process. For example, the capability maturity model has the following framework:

Initial – informal
Documented Strategy & Principles – formalizing
Adaptive Security Architecture – well defined
Security Organization & Roadmap – optimized
Baseline Security Standards – quantitatively controlled
Give examples of risk at the level of these categories and how each level mitigates risks from the previous level?