Towards a Federative Information Security Focus Area Maturity Model

Ensuring that sensitive information is protected is a serious concern all over the globe. Organizations often face many obstacles that can be mitigated by performing good security management practices. A prominent example of a sector in which sensitive information needs to be protected is the financial industry. The extent to which information is secured differs, and this could be explained by a number of influences, such as knowledge, culture, strategic decisions but also the availability and quality of self-assessment frameworks. A number of focus areas are involved in securing information, such as information security and cyber security. For a number of domains, such as information security, but also software product management, it has been proven that a focus area maturity model could be beneficial in assessing the current state of maturity, identifying gaps and identifying steps which must be followed to achieve a greater level of maturity. However, such a maturity model for cyber security is currently lacking. This research explores what capabilities are involved in cyber security. Secondly, it is studied to what extent these capabilities differ from existing information security capabilities. Lastly, it is covered how, and by what means, cyber security capabilities could be augmented in the existing information security maturity model. This leads to the proposition of a cyber-security focus area maturity model. This maturity model is tested in a large financial institution, which shows that the model could be operationalized. In addition, it shows which cyber security related deficiencies are noticeable within the partnering financial institution. Finally, a preliminary version of a federative, over-arching security model is developed