AIM Triad: A Prioritization Strategy for Public Institutions to Improve Information Security Maturity
Source abstract
Abstract
In today’s world, private and government organizations are legally obligated to prioritize their information security. They need to provide proof that they are continually improving their cybersecurity compliance. One approach that can help organizations achieve this goal is implementing information security maturity models. These models provide a structured framework for measuring performance and implementing best practices. However, choosing a suitable model can be challenging, requiring cultural, process, and work practice changes. Implementing multiple models can be overwhelming, if possible. This article proposes a prioritization strategy for public institutions that want to improve their information security maturity. We thoroughly analyzed various sources through systematic mapping to identify critical similarities in information security maturity models. Our research led us to create the AIM (Awareness, Infrastructure, and Management) Triad. This triad is a practical guide for organizations to achieve maturity in information security practices.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · E-Government and Public Services · Information Technology Governance and Strategy
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Departamento Ciencias de la Computación e Informática (DCI), Universidad de La Frontera, Temuco 481-1230, Chile
Centro de Estudios en Ingeniería de Software (CEISUFRO), Universidad de La Frontera, Temuco 481-1230, Chile
Advanced Development and Empirical Research on Software (ALISoft), Universidad de Alicante, 03080 Alicante, Spain
CyberSecurity Workgroup, Centro de Modelación y Computación Científica (CEMCC), Universidad de La Frontera, Temuco 481-1230, Chile
Departamento de Lenguajes y Sistemas Informáticos, Universidad de Alicante, 03080 Alicante, Spain
Funding
Universidad de La Frontera
References (100+)
Show source-provided references
1. Information security governance challenges and critical success factors: Systematic review10.1016/j.cose.2020.102030 ↗
2. Yang, L., Elisa, N., and Eliot, N. (2019). Smart Cities Cybersecurity and Privacy, Elsevier.
3. Diéguez, M., Cares, C., Cachero, C., and Hochstetter, J. (2023). MASISCo—Methodological Approach for the Selection of Information Security Controls. Appl. Sci., 13.10.3390/app13021094 ↗
4. E-government maturity models: Extension of the Layne and Lee model10.1016/j.giq.2005.11.008 ↗
5. Canetta, L., Barni, A., and Montini, E. (2018, January 17–20). Development of a digitalization maturity model for the manufacturing sector. Proceedings of the 2018 IEEE International Conference on Engineering, Technology and Innovation (ICE/ITMC), Stuttgart, Germany.10.1109/ICE.2018.8436292 ↗
6. Lemke, F., Taveter, K., Erlenheim, R., Pappel, I., Draheim, D., and Janssen, M. (2019, January 13–14). Stage models for moving from e-government to smart government. Proceedings of the International Conference on Electronic Governance and Open Society: Challenges in Eurasia, St. Petersburg, Russia.10.1007/978-3-030-39296-3_12 ↗
7. Maturity models and safety culture: A critical review10.1016/j.ssci.2018.02.017 ↗
8. Assessing Transparency in eGovernment Electronic Processes10.1109/ACCESS.2021.3137799 ↗
9. Conception, development and implementation of an e-Government maturity model in public agencies10.1016/j.giq.2010.04.007 ↗
10. Towards a multidimensional model for evaluating electronic government: Proposing a more comprehensive and integrative perspective10.1016/j.giq.2012.03.001 ↗
11. Development and implementation of a maturity model of digital transformation10.1007/s11528-019-00457-4 ↗
12. Proença, D., and Borbinha, J. (2018, January 10–13). Maturity models for data and information management. Proceedings of the International Conference on Theory and Practice of Digital Libraries, Porto, Portugal.10.1007/978-3-030-00066-0_7 ↗
13. A general model of performance and quality for one-stop e-government service offerings10.1016/j.giq.2006.07.016 ↗
14. Bilak, S., and Brennan, K. (2022). Cybersecurity Capability Maturity Model (C2M2)-Cybersecurity Maturity Model Certification (CMMC) Supplemental Guidance (Draft), Carnegie-Mellon University. Technical Report.
15. U.S. Department of Energy (2020). Cybersecurity Capability Maturity Model (C2M2), U.S. Department of Energy.
16. National Institute of Standards and Technology (2023, July 10). NIST Cybersecurity Framework, Available online: https://www.nist.gov/cyberframework/framework.
17. Carnegie Mellon University Software Engineering Institute (2001). Security & Privacy Capability Maturity Model (SP-CMM), Carnegie Mellon University Software Engineering Institute. Version 2.0.
18. ISACA (2023). CMMI Cybermaturity Platform, ISACA.
19. A transparency maturity model for government software tenders10.1109/ACCESS.2021.3067217 ↗
20. Information and cyber security maturity models: A systematic literature review10.1108/ICS-03-2019-0039 ↗
21. Pazmiño Vallejo, L.M. (2015). Calidad de la Gestión en la Seguridad de la Información Basada en la Norma ISO/IEC 27001, en Instituciones Públicas, en la Ciudad de Quito DM. [Master’s Thesis, PUCE].
22. An integrated management system: From various aspects of the literature to a maturity model based on the process approach10.1504/IJPQM.2018.089157 ↗
23. To assess smart manufacturing readiness by maturity model: A case study on Taiwan enterprises10.1080/0951192X.2019.1699255 ↗
24. Rea-Guamán, A.M., Sanchez-Garcia, I., San Feliu, T., and Calvo-Manzano, J. (2017, January 14–17). Maturity models in cybersecurity: A systematic review. Proceedings of the 2017 12th Iberian Conference on Information Systems and Technologies (CISTI), Lisbon, Portugal.10.23919/CISTI.2017.7975865 ↗
25. An explanatory review on cybersecurity capability maturity models10.25046/aj050490 ↗
26. Lopes, D., Carvalho, J.V., and Gonçalves, C.T. (2020, January 29–31). Maturity Models as Instruments for the Optimization of Electronic Business in the Tourism Industry. Proceedings of the International Conference on Tourism, Technology and Systems, Cartagena, Colombia.10.1007/978-981-33-4256-9_25 ↗
27. The transformation of governance: Globalization, devolution, and the role of government10.1111/0033-3352.00112 ↗
28. Security, privacy and risks within smart cities: Literature review and development of a smart city interaction framework10.1007/s10796-020-10044-1 ↗
29. Maturity models in information systems research: Literature search and analysis
30. Gollhardt, T., Halsbenning, S., Hermann, A., Karsakova, A., and Becker, J. (2020, January 22–24). Development of a digital transformation maturity model for IT companies. Proceedings of the 2020 IEEE 22nd Conference on Business Informatics (CBI), Antwerp, Belgium.10.1109/CBI49978.2020.00018 ↗
31. Muronga, K., Herselman, M., Botha, A., and Da Veiga, A. (2019, January 19–21). An analysis of assessment approaches and maturity scales used for evaluation of information security and cybersecurity user awareness and training programs: A scoping review. Proceedings of the 2019 Conference on Next Generation Computing Applications (NextComp), Balaclava, Mauritius.10.1109/NEXTCOMP.2019.8883535 ↗
32. Cyber security capacity governance
33. Foster, C. (2023, July 10). Why NIST CSF Maturity Is Important for All Organizations. Available online: https://blog.charlesit.com/why-nist-csf-maturity-is-important-for-all-organizations.
34. Developing maturity models for IT management10.1007/s12599-009-0044-5 ↗
35. Are government internet portals evolving towards more interaction, participation, and collaboration? Revisiting the rhetoric of e-government among municipalities10.1016/j.giq.2011.09.004 ↗
36. García-González, A., and Ramírez-Montoya, M.S. (2019). Systematic mapping of scientific production on open innovation (2015–2018): Opportunities for sustainable training environments. Sustainability, 11.10.3390/su11061781 ↗
37. Kitchenham, B., and Charters, S. (2007). Guidelines for Performing Systematic Literature Reviews in Software Engineering, University of Durham.
38. Petersen, K., Feldt, R., Mujtaba, S., and Mattsson, M. (2008, January 26–27). Systematic mapping studies in software engineering. Proceedings of the 12th International Conference on Evaluation and Assessment in Software Engineering (EASE), Bari, Italy.10.14236/ewic/EASE2008.8 ↗
39. RESEARCH METHODS and REPORTING-Preferred reporting items for systematic reviews and meta-analyses: The PRISMA statement-David Moher and colleagues introduce PRISMA, an update of the QUOROM guidelines for reporting systematic reviews and meta-analyses
40. Guidelines for conducting systematic mapping studies in software engineering: An update10.1016/j.infsof.2015.03.007 ↗
41. A methodology for systematic mapping in environmental sciences10.1186/s13750-016-0059-6 ↗
42. Kakkar, A., Rawat, S., Gupta, P., and Khatri, S.K. (2018). Intelligent Computing and Information and Communication, Springer.
43. Abazi, B., and Kő, A. (2019, January 16–17). Semi-automated Information Security Risk Assessment Framework for Analyzing Enterprises Security Maturity Level. Proceedings of the Research and Practical Issues of Enterprise Information Systems: 13th IFIP WG 8.9 International Conference (CONFENIS 2019), Prague, Czech Republic.10.1007/978-3-030-37632-1_13 ↗
44. Cybersecurity maturity model for the Brazilian Federal Government Agencies10.21874/rsp.v71i3.3210 ↗
45. The Community Cybersecurity Maturity Model (CCSMM) (2021). Establishing Cyber Security Programs Through the Community Cyber Security Maturity Model (CCSMM), IGI Global.
46. Mapping the variations for implementing information security controls to their operational research solutions10.1007/s10257-020-00470-8 ↗
47. Parametric Objective Function (Part 2)—Generalization
48. Wierzbicki, A.P. (1980). Lecture Notes in Economics and Mathematical Systems, Springer.
49. Single machine scheduling to minimize total weighted tardiness10.1016/j.ejor.2004.04.013 ↗
50. The single-machine total tardiness scheduling problem: Review and extensions10.1016/j.ejor.2009.04.007 ↗
51. Parallel machine scheduling with additional resources: Notation, classification, models and solution methods10.1016/j.ejor.2013.02.042 ↗
52. Daraghmeh, R., and Brown, R. (2021, January 14–15). A Big Data maturity model for electronic health records in hospitals. Proceedings of the 2021 International Conference on Information Technology (ICIT), Amman, Jordan.10.1109/ICIT52682.2021.9491781 ↗
53. A Conceptual Consumer Data Protection Maturity Model for Government Adoption: South African Context10.1007/978-3-030-90318-3_64 ↗
54. Aliyu, A., Maglaras, L., He, Y., Yevseyeva, I., Boiten, E., Cook, A., and Janicke, H. (2020). A holistic cybersecurity maturity assessment framework for higher education institutions in the United Kingdom. Appl. Sci., 10.10.3390/app10103660 ↗
55. Wahlgren, G., and Kowalski, S. (2019, January 26–28). A maturity model for IT-related security incident management. Proceedings of the Business Information Systems: 22nd International Conference (BIS 2019), Seville, Spain.10.1007/978-3-030-20485-3_16 ↗
56. Ghaffari, F., and Arabsorkhi, A. (2018, January 17–19). A new adaptive cyber-security capability maturity model. Proceedings of the 2018 9th International Symposium on Telecommunications (IST), Tehran, Iran.10.1109/ISTEL.2018.8661018 ↗
57. Schmid, M., and Pape, S. (2019, January 25–27). A structured comparison of the corporate information security maturity level. Proceedings of the ICT Systems Security and Privacy Protection: 34th IFIP TC 11 International Conference (SEC 2019), Lisbon, Portugal.10.1007/978-3-030-22312-0_16 ↗
58. A technological analysis of Colombia’s cybersecurity capacity: A systemic perspective from an organizational point of view/Analisis de la capacidad de ciberseguridad para la dimension tecnologica en Colombia: Una mirada sistemica desde la organizacion/Analise da capacidade de seguranca cibernetica para a dimensao tecnologica na Colombia: Uma visao sistemica da organizacao
59. Yigit Ozkan, B., and Spruit, M. (2020, January 8–10). Addressing SME characteristics for designing information security maturity models. Proceedings of the Human Aspects of Information Security and Assurance: 14th IFIP WG 11.12 International Symposium (HAISA 2020), Mytilene, Greece.
60. Adopting security maturity model to the organizations’ capability model10.1016/j.eij.2020.08.001 ↗
61. Advanced approach to information security management system utilizing maturity models in critical infrastructure
62. An extended digital forensic readiness and maturity model10.1016/j.fsidi.2022.301348 ↗
63. Application of an analytic hierarchy process to select the level of a cyber resilient capability maturity model in digital supply chain systems
64. Assessing information security performance of enterprise internal financial sharing in cloud computing environment using analytic hierarchy process10.1504/IJGUC.2022.124398 ↗
65. Assessing the maturity of national cybersecurity and resilience10.11610/Connections.19.4.01 ↗
66. Assessment of National Cybersecurity Capacity for Countries in a Transitional Phase: The Spring Land Case Study
67. Pham, C.M. (2021). Research Anthology on Privatizing and Securing Data, IGI Global.
68. Rea-Guaman, A.M., San Feliu, T., Calvo-Manzano, J.A., and Sanchez-Garcia, I.D. (2017, January 4–5). Comparative study of cybersecurity capability maturity models. Proceedings of the Software Process Improvement and Capability Determination: 17th International Conference (SPICE 2017), Palma de Mallorca, Spain.10.1007/978-3-319-67383-7_8 ↗
69. CTI-SOC2M2–The quest for mature, intelligence-driven security operations and incident response capabilities10.1016/j.cose.2021.102482 ↗
70. Akinsanya, O.O., Papadaki, M., and Sun, L. (2019, January 29–30). Current cybersecurity maturity models: How effective in healthcare cloud?. Proceedings of the CERC, Darmstadt, Germany.
71. Cyber Hygiene Maturity Assessment Framework for Smart Grid Scenarios10.3389/fcomp.2021.614337 ↗
72. Singh, A., Chawla, P., Krishnamurthi, R., and Kumar, A. (2022). Autonomous and Connected Heavy Vehicle Technology, Elsevier.
73. Kaushik, K., Bathla, G., Naeem, U., and Kumar, A. (2022). Autonomous and Connected Heavy Vehicle Technology, Elsevier.
74. Cybersecurity for railways—A maturity model10.1177/0954409719881849 ↗
75. Sorin, A., and Staroswiecki, E. (2018). Cybersecurity for Smart Grid Systems: Fundamentals and Challenges, Wiley-IEEE Press.10.1016/B978-0-12-805321-8.00008-2 ↗
76. Katta, V., Simensen, J.E., Reegård, K., Houmb, S.H., and Engum, E.A. (September, January 31). Cybersecurity maturity assessment of a critical infrastructure organisation–approach and observations. Proceedings of the 11th International Conference on Availability, Reliability and Security (ARES), Salzburg, Austria.
77. Alayo, J.G., Mendoza, P.N., Armas-Aguirre, J., and Molina, J.M. (October, January 29). Cybersecurity maturity model for providing services in the financial sector in Peru. Proceedings of the 2021 Congreso Internacional de Innovación y Tendencias en Ingeniería (CONIITI), Bogota, Colombia.10.1109/CONIITI53815.2021.9619733 ↗
78. Cybersecurity workforce in railway: Its maturity and awareness10.1108/JQME-07-2020-0059 ↗
79. Jaquire, V., and von Solms, S. (June, January 31). Developing a cyber counterintelligence maturity model for developing countries. Proceedings of the 2017 IST-Africa Week Conference (IST-Africa), Windhoek, Namibia.10.23919/ISTAFRICA.2017.8102288 ↗
80. Development of cyber resilient capability maturity model for cloud computing services10.18421/TEM93-11 ↗
81. Straub, J. (May, January 15). Evaluating the Use of Technology Readiness Levels (TRLs) for Cybersecurity Systems. Proceedings of the 2021 IEEE International Systems Conference (SysCon), Vancouver, BC, Canada.10.1109/SysCon48628.2021.9447130 ↗
82. Modelo de evaluación del dominio control de acceso de la norma ISO 27002 aplicado al proceso de gestión de bases de datos
83. Incorporating systems thinking into a cyber resilience maturity model10.1109/EMR.2020.3046533 ↗
84. Proença, D., and Borbinha, J. (2018, January 18–20). Information security management systems-a maturity model based on ISO/IEC 27001. Proceedings of the Business Information Systems: 21st International Conference (BIS 2018), Berlin, Germany.10.1007/978-3-319-93931-5_8 ↗
85. Barnes, B., and Daim, T. (2022). Information Security Maturity Model for Healthcare Organizations in the United States. IEEE Trans. Eng. Manag.10.1109/TEM.2021.3139836 ↗
86. Model Multiprofil de Maturitate a Securității Informației (M3SI)
87. Lubis, M., Putri, I.I., and Izzati, B.M. (2022, January 3–4). Information Systems Maturity Level Assessment using the HISMM Framework: Case Study of State Hospital in Jakarta. Proceedings of the 2022 International Conference on Science and Technology (ICOSTECH), Batam, Indonesia.10.1109/ICOSTECH54296.2022.9829143 ↗
88. Hu, S., and Huang, M. (2021, January 19–21). Internet Financial Security Based on Big Data. Proceedings of the International Conference on Applications and Techniques in Cyber Intelligence (ATCI), Fuyang, China.10.1007/978-3-030-53980-1_72 ↗
89. Spruit, M., and Slot, G. (2017). Security Risks: Assessment, Management and Current Challenges, Springer.
90. Maturity Concept and Model Review
91. Maturity level assessments of information security controls: An empirical analysis of practitioners assessment capabilities10.1016/j.cose.2021.102306 ↗
92. Maturity model of information security for software developers10.1109/TLA.2017.8071246 ↗
93. Shimels, T., and Lessa, L. (2021, January 22–24). Maturity of information systems security in selected private Banks in Ethiopia. Proceedings of the 2021 International Conference on Information and Communication Technology for Development for Africa (ICT4DA), Bahir Dar, Ethiopia.10.1109/ICT4DA53266.2021.9672221 ↗
94. Method for Designing Countermeasures for Crypto-Ransomware Based on the NIST CSF
95. Modelling adaptive information security for SMEs in a cluster
96. Novel Maturity Model for Cybersecurity Evaluation in Industry 4.0
97. Organisational Information Security Management Maturity Model
98. García, A., Calle, L., Raymundo, C., Domínguez, F., and Moguerza, J.M. (2018, January 3–5). Personal data protection maturity model for the micro financial sector in Peru. Proceedings of the 2018 4th International Conference on Computer and Technology Applications (ICCTA), Istanbul, Turkey.10.1109/CATA.2018.8398649 ↗
99. Rojas, R., Muedas, A., and Mauricio, D. (2019, January 19–21). Security maturity model of web applications for cyber attacks. Proceedings of the 3rd International Conference on Cryptography, Security and Privacy, Kuala Lumpur, Malaysia.10.1145/3309074.3309096 ↗
100. Deshpande, V.M., and Desai, A. (2021, January 2–4). Smart Secure: A Novel Risk based Maturity Model for Enterprise Risk Management during Global Pandemic. Proceedings of the 2021 6th International Conference for Convergence in Technology (I2CT), Maharashtra, India.10.1109/I2CT51068.2021.9418094 ↗