An organization has adopted a new authentication method to ensure secure access to sensitive areas and facilities of the company. It requires every employee to use a two-factor authentication (password and QR code). This control has been documented, standardized, and communicated to all employees, however its use has been left to individual initiative, and it is likely that failures can be detected. Which level of maturity does this control refer to?