Organisational Information Security Management Maturity Model

Abstract

Information Security Management (ISM) is a systematic initiative in managing the organisation's information security. ISM can also be defined as a strategic approach to addressing information security (IS) risks, breaches, and incidents that could threaten the confidentiality, integrity, and availability of information. Although organisations have complied with ISM requirements, security incidents are still afflicting numerous organisations. This issue shows that the current implementation of ISM is still ineffective. The ineffective ISM implementation illustrates the low maturity level. To achieve a higher level of maturity, organisations should always evaluate their ISM practices. Several maturity models have been developed by international organisations, consultants, and researchers to assist organisations in assessing their ISM practices. However, the current models do not evaluate ISM practices holistically. The measurement dimensions in current models are more focused on assessing certain factors only. This caused the maturity assessment to be not executed comprehensively. Therefore, this study aims to address this shortcoming by proposing a comprehensive maturity assessment model that takes into account ISM success factors to evaluate the effectiveness of the implementation. This study adopted a mixedmethod approach, which comprises qualitative and quantitative studies to strengthen the research finding. The qualitative study analyses the existing literature and conducts interviews with nine industry practitioners and six experts while the quantitative study involves a questionnaire survey. The data obtained from the qualitative study were analysed using content analysis while the quantitative data employed statistics analysis. The study identified fourteen success factors and fifty-seven maturity dimensions, which each contains five maturity levels. The proposed model was evaluated through experts' reviews to ensure its accuracy and suitability. The evaluation shows that the model can identify the ISM maturity level systematically and comprehensively. This model will ultimately help the organisations to improve the weaknesses in the implementations thus diminishing security incidents.

Cyber Security Maturity Assessment Framework for Technology Startups: A Systematic Literature Review

“…A few research articles highlighted the same CSMA framework. For instance, seven research articles [25,28,31,33,34,36,38] focused on the Cyber Security Capability Maturity Model (C2M2), whereas four research articles [27,29,34,38] utilized the Control Objectives for Information and Related Technologies (COBIT) Framework. Several research articles also repeated and described the same framework in their literature review.…”

“…Several research articles also repeated and described the same framework in their literature review. 7 Cyber Security Capability Maturity Model (C2M2) [25], [28], [31], [33], [34], [36], [38] 8 Information Security Management Maturity Model (ISM3) [25], [31], [34], [ RQ2: Are these CSMA frameworks targeted for implementation in technology startups?…”

“…Information Security Management Maturity Model (ISM3) [25], [31], [34], [38] 6 The Publisher's Programme Overview for Information Security Management Assistance (PRISMA) [25] 7…”

AIM Triad: A Prioritization Strategy for Public Institutions to Improve Information Security Maturity

“…Organisational Information Security Management Maturity Model [97] The paper discusses the importance of Information Security Management (ISM) in protecting the confidentiality, integrity, and availability of information in organizations. Despite compliance with ISM requirements, many organizations continue to suffer from security incidents, indicating low maturity levels in ISM implementation.…”