{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,28]],"date-time":"2026-07-28T19:12:00Z","timestamp":1785265920424,"version":"3.55.0"},"reference-count":124,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2025,1,15]],"date-time":"2025-01-15T00:00:00Z","timestamp":1736899200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Systems"],"abstract":"<jats:p>This work represents a comprehensive and systematic literature review (SLR) that follows the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) guidelines for research assessing information and cyber security maturity. The period from 2012 to 2024 was considered and the final collection of 96 studies was taken into account. Our findings were summarised in two stages, a quantitative analysis and a qualitative synthesis. In the first part, various quantitative indicators were used to analyse the evolution of the information and cyber security maturity assessment domain over the last twelve years. The qualitative synthesis, which was limited to 36 research papers, categorises the studies into three key areas: the development of new maturity models, the implementation of established models and frameworks, and the advancement of methodologies to support maturity assessments. The findings reveal significant progress in sector-specific customisation, the growing importance of lightweight models for small and medium-sized enterprises (SMEs), and the integration of emerging technologies. This study provides important insights into the evolving landscape of information and cyber security maturity assessment and provides actionable recommendations for academia and industry to improve security resilience and support the adoption of tailored, effective maturity models.<\/jats:p>","DOI":"10.3390\/systems13010052","type":"journal-article","created":{"date-parts":[[2025,1,15]],"date-time":"2025-01-15T10:00:01Z","timestamp":1736935201000},"page":"52","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":29,"title":["Recent Trends in Information and Cyber Security Maturity Assessment: A Systematic Literature Review"],"prefix":"10.3390","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4415-6811","authenticated-orcid":false,"given":"Alenka","family":"Brezav\u0161\u010dek","sequence":"first","affiliation":[{"name":"Faculty of Organizational Sciences, University of Maribor, 4000 Kranj, Slovenia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7137-6502","authenticated-orcid":false,"given":"Alenka","family":"Baggia","sequence":"additional","affiliation":[{"name":"Faculty of Organizational Sciences, University of Maribor, 4000 Kranj, Slovenia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,1,15]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"670","DOI":"10.1111\/1468-5973.12470","article-title":"Business Continuity Management and Organizational Resilience: A Small and Medium Enterprises (SMEs) Perspective","volume":"31","author":"Elia","year":"2023","journal-title":"J. Conting. Crisis Manag."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"5375","DOI":"10.1080\/00207543.2011.563826","article-title":"Resilience: The Concept, a Literature Review and Future Directions","volume":"49","author":"Bhamra","year":"2011","journal-title":"Int. J. Prod. Res."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"439","DOI":"10.1111\/1468-5973.12360","article-title":"Cyber Resilience during the COVID-19 Pandemic Crisis: A Case Study","volume":"29","author":"Groenendaal","year":"2021","journal-title":"J. Conting. Crisis Manag."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"431","DOI":"10.1111\/1468-5973.12449","article-title":"Business Continuity for Times of Vulnerability: Empirical Evidence","volume":"31","year":"2023","journal-title":"J. Conting. Crisis Manag."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"5442","DOI":"10.1109\/ACCESS.2022.3229766","article-title":"Cyber Security Maturity Assessment Framework for Technology Startups: A Systematic Literature Review","volume":"11","author":"Marican","year":"2023","journal-title":"IEEE Access"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"102306","DOI":"10.1016\/j.cose.2021.102306","article-title":"Maturity Level Assessments of Information Security Controls: An Empirical Analysis of Practitioners Assessment Capabilities","volume":"108","author":"Schmitz","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"336","DOI":"10.1016\/j.ijsu.2010.02.007","article-title":"Preferred Reporting Items for Systematic Reviews and Meta-Analyses: The PRISMA Statement","volume":"8","author":"Moher","year":"2010","journal-title":"Int. J. Surg."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"n71","DOI":"10.1136\/bmj.n71","article-title":"The PRISMA 2020 Statement: An Updated Guideline for Reporting Systematic Reviews","volume":"372","author":"Page","year":"2021","journal-title":"BMJ"},{"key":"ref_9","first-page":"81","article-title":"Maturity Assessment Models: A Design Science Research Approach","volume":"3","author":"Mettler","year":"2011","journal-title":"Int. J. Soc. Syst. Sci."},{"key":"ref_10","unstructured":"D\u2019Atri, A., De Marco, M., Braccini, A.M., and Cabiddu, F. (2010). Towards a Classification of Maturity Models in Information Systems, Physica-Verlag HD."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"137","DOI":"10.26493\/1854-4231.15.137-155","article-title":"Business Maturity Models for Small and Medium-Sized Enterprises: A Systematic Literature Review","volume":"15","author":"Virkkala","year":"2020","journal-title":"Management"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"213","DOI":"10.1007\/s12599-009-0044-5","article-title":"Developing Maturity Models for IT Management","volume":"1","author":"Becker","year":"2009","journal-title":"Bus. Inf. Syst. Eng."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"66","DOI":"10.1145\/383371.383376","article-title":"Situated Assessment of Problems in Software Development","volume":"30","author":"Iversen","year":"1999","journal-title":"ACM SIGMIS Database Database Adv. Inf. Syst."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"328","DOI":"10.1108\/14637151211225225","article-title":"Maturity Models in Business Process Management","volume":"18","author":"Roeglinger","year":"2012","journal-title":"Bus. Process Manag. J."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"1317","DOI":"10.1016\/j.infsof.2012.07.007","article-title":"The Maturity of Maturity Model Research: A Systematic Mapping Study","volume":"54","author":"Wendler","year":"2012","journal-title":"Inf. Softw. Technol."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Felch, V., Asdecker, B., and Sucky, E. (2019, January 8\u201311). Maturity Models in the Age of Industry 4.0\u2014Do the Available Models Correspond to the Needs of Business Practice?. Proceedings of the 52nd Hawaii International Conference on System Sciencesm, Maui, HI, USA.","DOI":"10.24251\/HICSS.2019.620"},{"key":"ref_17","unstructured":"Leino, S.-P., Kuusisto, O., Paasi, J., and Tihinen, M. (2017). VTT Model of Digimaturity. Towards a New Era in Manufacturing, VTT Technical Research Centre of Finland Ltd."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Proen\u00e7a, D. (2016, January 15\u201318). Methods and Techniques for Maturity Assessment. Proceedings of the 2016 11th Iberian Conference on Information Systems and Technologies (CISTI), Gran Canaria, Spain.","DOI":"10.1109\/CISTI.2016.7521483"},{"key":"ref_19","unstructured":"Bunker, D., Campbell, B., and Underwood, J. (2005). Understanding the Main Phases of Developing a Maturity Assessment Model. Proceedings of the 16th Australasian Conference on Information Systems (ACIS), Australasian Chapter of the Association for Information Systems: CD Rom; Queensland University of Technology."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Tocto-Cano, E., Paz Collado, S., L\u00f3pez-Gonzales, J.L., and Turpo-Chaparro, J.E. (2020). A Systematic Review of the Application of Maturity Models in Universities. Information, 11.","DOI":"10.3390\/info11100466"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"e2161","DOI":"10.1002\/smr.2161","article-title":"Process Maturity Models: Classification by Application Sectors and Validities Studies","volume":"31","author":"Lee","year":"2019","journal-title":"J. Softw. Evol. Process"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Adekunle, S., Ejohwomu, O., Ikuabe, M., and Fatai, O. (2022). A Critical Review of Maturity Model Development in the Digitisation Era. Buildings, 12.","DOI":"10.3390\/buildings12060858"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Kuci\u0144ska-Landw\u00f3jtowicz, A. (2019, January 20\u201322). Organizational Maturity Models\u2014Review and Classification. Proceedings of the CBU International Conference Proceedings, Prague, Czech Republic.","DOI":"10.12955\/cbup.v7.1360"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"719","DOI":"10.1080\/17517575.2019.1575986","article-title":"Enterprise Maturity Models: A Systematic Literature Review","volume":"13","author":"Costa","year":"2019","journal-title":"Enterp. Inf. Syst."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1109\/52.219617","article-title":"Capability Maturity Model, Version 1.1","volume":"10","author":"Paulk","year":"1993","journal-title":"IEEE Softw."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"122","DOI":"10.1016\/j.infsof.2016.01.010","article-title":"Business Process Maturity Models: A Systematic Literature Review","volume":"75","author":"Tarhan","year":"2016","journal-title":"Inf. Softw. Technol."},{"key":"ref_27","first-page":"29","article-title":"Business Process Maturity Models Research: A Systematic Literature Review","volume":"7","author":"Kalinowski","year":"2020","journal-title":"Int. J. Manag. Sci. Bus. Adm."},{"key":"ref_28","first-page":"435363","article-title":"Systematic Literature Review of Process Management Maturity and Management Processes Maturity","volume":"2022","year":"2022","journal-title":"J. Softw. Syst. Dev."},{"key":"ref_29","first-page":"505","article-title":"Maturity Models in Information Systems Research: Literature Search and Analysis","volume":"29","author":"Poeppelbuss","year":"2011","journal-title":"Commun. Assoc. Inf. Syst."},{"key":"ref_30","unstructured":"Mettler, T., and Ballester, O. (2021, January 12\u201315). Maturity Models in Information Systems: A Review and Extension of Existing Guidelines. Proceedings of the Forty-Second International Conference on Information Systems, Austin, TX, USA."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Li, C.H., and Lau, H.K. (2019, January 13\u201315). A Critical Review of Maturity Models in Information Technology and Human Landscapes on Industry 4.0. Proceedings of the 2019 IEEE International Conference on Industrial Technology (ICIT), Melbourne, VIC, Australia.","DOI":"10.1109\/ICIT.2019.8755158"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"161","DOI":"10.1177\/0268396219886874","article-title":"A Review of Methods Used on IT Maturity Models Development: A Systematic Literature Review and a Critical Analysis","volume":"35","author":"Pereira","year":"2020","journal-title":"J. Inf. Technol."},{"key":"ref_33","unstructured":"Silva, F., Tammela, I., and Narcizo, R. (2021, January 10\u201312). A Systematic Literature Review on Industry 4.0 Maturity Models. Proceedings of the Conference: XXVIII Simp\u00f3sio de Engenharia de Produ\u00e7\u00e3o, Bauru, Brazil."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"200","DOI":"10.1016\/j.jmsy.2022.12.009","article-title":"Maturity Assessment for Industry 5.0: A Review of Existing Maturity Models","volume":"66","author":"Winkler","year":"2023","journal-title":"J. Manuf. Syst."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Barraza De La Paz, J.V., Rodr\u00edguez-Pic\u00f3n, L.A., Morales-Rocha, V., and Torres-Arg\u00fcelles, S.V. (2023). A Systematic Review of Risk Management Methodologies for Complex Organizations in Industry 4.0 and 5.0. Systems, 11.","DOI":"10.3390\/systems11050218"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Belghith, O., Skhiri, S., Zitoun, S., and Ferjaoui, S. (2021, January 13\u201315). A Survey of Maturity Models in Data Management. Proceedings of the 2021 IEEE 12th International Conference on Mechanical and Intelligent Manufacturing Technologies (ICMIMT), Cape Town, South Africa.","DOI":"10.1109\/ICMIMT52186.2021.9476197"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"1007","DOI":"10.1108\/AJIM-11-2021-0354","article-title":"The Maturity of Open Government Data Maturity: A Multivocal Literature Review","volume":"74","year":"2022","journal-title":"Aslib J. Inf. Manag."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Al-Sai, Z.A., Husin, M.H., Syed-Mohamad, S.M., Abdullah, R., Zitar, R.A., Abualigah, L., and Gandomi, A.H. (2023). Big Data Maturity Assessment Models: A Systematic Literature Review. Big Data Cogn. Comput., 7.","DOI":"10.3390\/bdcc7010002"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"751","DOI":"10.1016\/j.promfg.2017.07.176","article-title":"Measuring Business Sustainability Maturity-Levels and Best Practices","volume":"11","author":"Kumar","year":"2017","journal-title":"Procedia Manuf."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"127692","DOI":"10.1016\/j.jclepro.2021.127692","article-title":"A Sustainability Maturity Model for Micro, Small and Medium-Sized Enterprises (MSMEs) Based on a Data Analytics Evaluation Approach","volume":"311","author":"Aguirre","year":"2021","journal-title":"J. Clean. Prod."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Machado, M.C., and Carvalho, T.C. (2021). Maturity Models and Sustainable Indicators\u2014A New Relationship. Sustainability, 13.","DOI":"10.3390\/su132313247"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Vargas-Florez, J., Ruiz-Cantisani, M.I., Castro-Zuluaga, C., and Marquez-Gutierrez, M. (2020, January 27\u201331). Small and Medium Enterprise-SMEs\u2019 Resilience Model Based on Maturity Cycle. Proceedings of the Eighteen LACCEI International Multi-Conference for Engineering, Education Caribbean Conference For Engineering And Technology, Virtual.","DOI":"10.18687\/LACCEI2020.1.1.304"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"1","DOI":"10.56397\/AS.2022.12.01","article-title":"A Maturity Model to Assess and Foster the Resilience of Organizations","volume":"1","author":"Stocker","year":"2022","journal-title":"Art Soc."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Car\u00edas, J.F., Arrizabalaga, S., Labaka, L., and Hernantes, J. (2020). Cyber Resilience Progression Model. Appl. Sci., 10.","DOI":"10.3390\/app10217393"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"837","DOI":"10.1016\/j.sbspro.2014.03.094","article-title":"Project Management Maturity Models\u2014A Critical Review: A Case Study within Swedish Engineering and Construction Organizations","volume":"119","author":"Backlund","year":"2014","journal-title":"Procedia Soc. Behav. Sci."},{"key":"ref_46","first-page":"31","article-title":"Project Management Maturity Models: Literature Review and New Developments","volume":"8","author":"Fabbro","year":"2022","journal-title":"J. Mod. Proj. Manag."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Kljaji\u0107 Bor\u0161tnar, M., and Pucihar, A. (2021). Multi-Attribute Assessment of Digital Maturity of SMEs. Electronics, 10.","DOI":"10.3390\/electronics10080885"},{"key":"ref_48","first-page":"89","article-title":"Comprehensive Review of a Digital Maturity Model and Proposal for a Continuous Digital Transformation Process with Digital Maturity Model Integration","volume":"17","year":"2022","journal-title":"Sist. Gest\u00e3o"},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"1673","DOI":"10.11118\/actaun201967061673","article-title":"Digital Transformation Maturity: A Systematic Review of Literature","volume":"67","author":"Teichert","year":"2019","journal-title":"Acta Univ. Agric. Silvic. Mendel. Brun."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"e661","DOI":"10.7717\/peerj-cs.661","article-title":"Artificial Intelligence Maturity Model: A Systematic Literature Review","volume":"7","author":"Sadiq","year":"2021","journal-title":"PeerJ Comput. Sci."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"184","DOI":"10.26599\/IJCS.2022.9100025","article-title":"Blockchain Technology Application Maturity Assessment Model for Digital Government Public Service Projects","volume":"6","author":"Yang","year":"2022","journal-title":"Int. J. Crowd Sci."},{"key":"ref_52","unstructured":"Poeppelbuss, J., and Roeglinger, M. (2011, January 9\u201311). What Makes a Useful Maturity Model? A Framework of General Design Principles for Maturity Models and Its Demonstration in Business Process Management. Proceedings of the 19th European Conference on Information Systems, ECIS 2011, Helsinki, Finland."},{"key":"ref_53","first-page":"6","article-title":"Maturity Models Development in IS Research: A Literature Review","volume":"6","author":"Lasrado","year":"2015","journal-title":"IRIS Sel. Pap. Inf. Syst. Res. Semin. Scand."},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"Nikolaenko, V., and Sidorov, A. (2023). Assessment of Project Management Maturity Models Strengths and Weaknesses. J. Risk Financ. Manag., 16.","DOI":"10.3390\/jrfm16020121"},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Naskali, J., Kaukola, J., Matintupa, J., Ahtosalo, H., Jaakola, M., and Tuomisto, A. (2018). Mapping Business Transformation in Digital Landscape: A Prescriptive Maturity Model for Small Enterprises. Proceedings of the 7th International Conference, WIS 2018, Springer. Proceedings.","DOI":"10.1007\/978-3-319-97931-1_9"},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Reid, R., and Niekerk, J.V. (2014, January 13\u201314). From Information Security to Cyber Security Cultures. Proceedings of the 2014 Information Security for South Africa, Johannesburg, South Africa.","DOI":"10.1109\/ISSA.2014.6950492"},{"key":"ref_57","doi-asserted-by":"crossref","first-page":"483","DOI":"10.1016\/j.procs.2022.12.050","article-title":"Cybersecurity vs. Information Security","volume":"215","author":"Taherdoost","year":"2022","journal-title":"Procedia Comput. Sci."},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"2","DOI":"10.1108\/ICS-04-2017-0025","article-title":"Cybersecurity and Information Security\u2014What Goes Where?","volume":"26","year":"2018","journal-title":"Inf. Comput. Secur."},{"key":"ref_59","doi-asserted-by":"crossref","unstructured":"De Bruin, R., and Solms, S.H. (2015, January 11\u201312). von Modelling Cyber Security Governance Maturity. Proceedings of the 2015 IEEE International Symposium on Technology and Society (ISTAS), Dublin, Ireland.","DOI":"10.1109\/ISTAS.2015.7439415"},{"key":"ref_60","doi-asserted-by":"crossref","first-page":"22","DOI":"10.1109\/MITP.2016.27","article-title":"A Framework for Information Security Governance and Management","volume":"18","author":"Carcary","year":"2016","journal-title":"IT Prof."},{"key":"ref_61","doi-asserted-by":"crossref","unstructured":"Prislan, K., Miheli\u010d, A., and Bernik, I. (2020). A Real-World Information Security Performance Assessment Using a Multidimensional Socio-Technical Approach. PLoS ONE, 15.","DOI":"10.1371\/journal.pone.0238739"},{"key":"ref_62","doi-asserted-by":"crossref","unstructured":"Aborujilah, A., Al-Othmani, A.Z., Hussien, N.S., Mokhtar, S.A., Long, Z.A., and Nizam, M. (2022, January 29\u201331). Cybersecurity Risk Assessment Approach for Malaysian Organizations: Malaysian Universities as Case Study. Proceedings of the 2022 9th International Conference on Electrical and Electronics Engineering (ICEEE), Alanya, Turkey.","DOI":"10.1109\/ICEEE55327.2022.9772546"},{"key":"ref_63","doi-asserted-by":"crossref","unstructured":"Deshpande, V.M., and Desai, A. (2021, January 2\u20134). Smart Secure: A Novel Risk Based Maturity Model for Enterprise Risk Management during Global Pandemic. Proceedings of the 2021 6th International Conference for Convergence in Technology (I2CT), Maharashtra, India.","DOI":"10.1109\/I2CT51068.2021.9418094"},{"key":"ref_64","doi-asserted-by":"crossref","first-page":"102877","DOI":"10.1016\/j.cose.2022.102877","article-title":"CAESAR8: An Agile Enterprise Architecture Approach to Managing Information Security Risks","volume":"122","author":"Loft","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_65","doi-asserted-by":"crossref","first-page":"103050","DOI":"10.1016\/j.cose.2022.103050","article-title":"Managing the Inevitable\u2014A Maturity Model to Establish Incident Response Management Capabilities","volume":"125","author":"Bitzer","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_66","doi-asserted-by":"crossref","first-page":"102482","DOI":"10.1016\/j.cose.2021.102482","article-title":"CTI-SOC2M2\u2014The Quest for Mature, Intelligence-Driven Security Operations and Incident Response Capabilities: CTI-Driven SOC Capability Maturity Model","volume":"111","author":"Schlette","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_67","doi-asserted-by":"crossref","unstructured":"Jaquire, V., and von Solms, S. (June, January 30). Developing a Cyber Counterintelligence Maturity Model for Developing Countries. Proceedings of the 2017 IST-Africa Week Conference (IST-Africa), Windhoek, Namibia.","DOI":"10.23919\/ISTAFRICA.2017.8102288"},{"key":"ref_68","doi-asserted-by":"crossref","unstructured":"Jeong, J.J., Grobler, M., Chamikara, M.A.P., and Rudolph, C. (2019, January 12\u201314). Fuzzy Logic Application to Link National Culture and Cybersecurity Maturity. Proceedings of the 2019 IEEE 5th International Conference on Collaboration and Internet Computing (CIC), Los Angeles, CA, USA.","DOI":"10.1109\/CIC48465.2019.00046"},{"key":"ref_69","doi-asserted-by":"crossref","unstructured":"Muronga, K., Herselman, M., Botha, A., and Veiga, A.D. (2019, January 19\u201321). An Analysis of Assessment Approaches and Maturity Scales Used for Evaluation of Information Security and Cybersecurity User Awareness and Training Programs: A Scoping Review. Proceedings of the 2019 Conference on Next Generation Computing Applications (NextComp), R\u00e9duit, Mauritius.","DOI":"10.1109\/NEXTCOMP.2019.8883535"},{"key":"ref_70","doi-asserted-by":"crossref","unstructured":"Drivas, G., Chatzopoulou, A., Maglaras, L., Lambrinoudakis, C., Cook, A., and Janicke, H. (2020, January 13\u201317). A NIS Directive Compliant Cybersecurity Maturity Assessment Framework. Proceedings of the 2020 IEEE 44th Annual Computers, Software, and Applications Conference (COMPSAC), Madrid, Spain.","DOI":"10.1109\/COMPSAC48688.2020.00-20"},{"key":"ref_71","doi-asserted-by":"crossref","unstructured":"Oliveira, A.d.S., and Santos, H. (2022, January 28\u201331). Continuous Industrial Sector Cybersecurity Assessment Paradigm: Proposed Model of Cybersecurity Certification. Proceedings of the 2022 18th International Conference on the Design of Reliable Communication Networks (DRCN), Vilanova i la Geltr\u00fa, Spain.","DOI":"10.1109\/DRCN53993.2022.9758022"},{"key":"ref_72","doi-asserted-by":"crossref","unstructured":"Yulianto, S., Lim, C., and Soewito, B. (2016, January 9\u201311). Information Security Maturity Model: A Best Practice Driven Approach to PCI DSS Compliance. Proceedings of the 2016 IEEE Region 10 Symposium (TENSYMP), Bali, Indonesia.","DOI":"10.1109\/TENCONSpring.2016.7519379"},{"key":"ref_73","doi-asserted-by":"crossref","unstructured":"Sen, N., Atilla, D.C., and Karan, O. (2021, January 27\u201328). Decision Support System for Operational, Financial, Performance and Risk Indicators of Maturity Models over Cloud-Based Software. Proceedings of the 2021 International Conference on Engineering and Emerging Technologies (ICEET), Istanbul, Turkey.","DOI":"10.1109\/ICEET53442.2021.9659584"},{"key":"ref_74","doi-asserted-by":"crossref","first-page":"256","DOI":"10.1504\/IJGUC.2022.124398","article-title":"Assessing Information Security Performance of Enterprise Internal Financial Sharing in Cloud Computing Environment Using Analytic Hierarchy Process","volume":"13","author":"Zhou","year":"2022","journal-title":"Int. J. Grid Util. Comput."},{"key":"ref_75","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1016\/j.procs.2022.11.037","article-title":"Information Security Management Maturity Models","volume":"213","author":"Miloslavskaya","year":"2022","journal-title":"Procedia Comput. Sci."},{"key":"ref_76","doi-asserted-by":"crossref","unstructured":"Mas, A., Mesquida, A., O\u2019Connor, R.V., Rout, T., and Dorling, A. (2017). Comparative Study of Cybersecurity Capability Maturity Models BT\u2014Software Process Improvement and Capability Determination, Springer International Publishing.","DOI":"10.1007\/978-3-319-67383-7"},{"key":"ref_77","doi-asserted-by":"crossref","first-page":"762","DOI":"10.25046\/aj050490","article-title":"An Explanatory Review on Cybersecurity Capability Maturity Models","volume":"5","author":"Garba","year":"2020","journal-title":"Adv. Sci. Technol. Eng. Syst. J."},{"key":"ref_78","first-page":"79","article-title":"Cybersecurity Capability Maturity Models Review and Application Domain","volume":"9","author":"Garba","year":"2020","journal-title":"Int. J. Eng. Technol."},{"key":"ref_79","doi-asserted-by":"crossref","first-page":"627","DOI":"10.1108\/ICS-03-2019-0039","article-title":"Information and Cyber Security Maturity Models: A Systematic Literature Review","volume":"28","author":"Rabii","year":"2020","journal-title":"Inf. Comput. Secur."},{"key":"ref_80","unstructured":"(2022). ISO\/IEC Information Security, Cybersecurity and Privacy Protection\u2014Information Security Management Systems\u2014Requirements (Standard No. ISO\/IEC Standard No. 27001:2022)."},{"key":"ref_81","unstructured":"(2022). ISO\/IEC Information Security, Cybersecurity and Privacy Protection\u2014Information Security Controls (Standard No. ISO\/IEC Standard No. 27002:2022)."},{"key":"ref_82","unstructured":"(2022). ISO\/IEC Information Technology\u2014Security Techniques\u2014Systems Security Engineering\u2014Capability Maturity Model\u00ae (SSE-CMM\u00ae) (Standard No. ISO\/IEC Standard No. 21827:2008)."},{"key":"ref_83","unstructured":"Fink, A. (2019). Conducting Research Literature Reviews: From the Internet to Paper, SAGE Publications. [5th ed.]."},{"key":"ref_84","doi-asserted-by":"crossref","first-page":"2049","DOI":"10.1016\/j.infsof.2013.07.010","article-title":"A Systematic Review of Systematic Review Process Research in Software Engineering","volume":"55","author":"Kitchenham","year":"2013","journal-title":"Inf. Softw. Technol."},{"key":"ref_85","unstructured":"Kitchenham, B., and Charters, S. (2007). Guidelines for Performing Systematic Literature Reviews in Software Engineering, Technical Report EBSE 2007-001, Durham University."},{"key":"ref_86","doi-asserted-by":"crossref","first-page":"126355","DOI":"10.1109\/ACCESS.2019.2938260","article-title":"A Systematic Literature Review of Test Case Prioritization Using Genetic Algorithms","volume":"7","author":"Bajaj","year":"2019","journal-title":"IEEE Access"},{"key":"ref_87","doi-asserted-by":"crossref","first-page":"399","DOI":"10.1111\/1468-5973.12293","article-title":"High Reliability Organization (HRO) Systematic Literature Review: Discovery of Culture as a Foundational Hallmark","volume":"28","author":"Cantu","year":"2020","journal-title":"J. Conting. Crisis Manag."},{"key":"ref_88","doi-asserted-by":"crossref","first-page":"100551","DOI":"10.1016\/j.cosrev.2023.100551","article-title":"Research Communities in Cyber Security Vulnerability Assessments: A Comprehensive Literature Review","volume":"48","author":"Heiding","year":"2023","journal-title":"Comput. Sci. Rev."},{"key":"ref_89","doi-asserted-by":"crossref","first-page":"100431","DOI":"10.1016\/j.cosrev.2021.100431","article-title":"Research Communities in Cyber Security: A Comprehensive Literature Review","volume":"42","author":"Katsikeas","year":"2021","journal-title":"Comput. Sci. Rev."},{"key":"ref_90","doi-asserted-by":"crossref","first-page":"100496","DOI":"10.1016\/j.cosrev.2022.100496","article-title":"System Security Assurance: A Systematic Literature Review","volume":"45","author":"Shukla","year":"2022","journal-title":"Comput. Sci. Rev."},{"key":"ref_91","doi-asserted-by":"crossref","unstructured":"Onyemelukwe, I.C., Ferreira, J.A.V., and Ramos, A.L. (2023). Human Energy Management in Industry: A Systematic Review of Organizational Strategies to Reinforce Workforce Energy. Sustainability, 15.","DOI":"10.3390\/su151713202"},{"key":"ref_92","doi-asserted-by":"crossref","unstructured":"Siksnelyte-Butkiene, I., Streimikiene, D., Balezentis, T., and Skulskis, V. (2021). A Systematic Literature Review of Multi-Criteria Decision-Making Methods for Sustainable Selection of Insulation Materials in Buildings. Sustainability, 13.","DOI":"10.3390\/su13020737"},{"key":"ref_93","unstructured":"(2022). ISO\/IEC Information Security, Cybersecurity and Privacy Protection\u2014Guidance on Managing Information Security Risks (Standard No. ISO\/IEC Standard No. 27005:2022)."},{"key":"ref_94","unstructured":"(2012). Guide for Conducting Risk Assessments (Standard No. NIST Special Publication 800-30)."},{"key":"ref_95","unstructured":"Clarivate (2023). Clarivate. Clarivate Journal Citation Reports. First Time Journal Citation Reports Inclusion List 2023, Clarivate."},{"key":"ref_96","first-page":"1","article-title":"Information Security Maturity Model for Healthcare Organizations in the United States","volume":"71","author":"Barnes","year":"2022","journal-title":"IEEE Trans. Eng. Manag."},{"key":"ref_97","doi-asserted-by":"crossref","unstructured":"Aliyu, A., Maglaras, L., He, Y., Yevseyeva, I., Boiten, E., Cook, A., and Janicke, H. (2020). A Holistic Cybersecurity Maturity Assessment Framework for Higher Education Institutions in the United Kingdom. Appl. Sci., 10.","DOI":"10.3390\/app10103660"},{"key":"ref_98","first-page":"235","article-title":"Modelling Adaptive Information Security for SMEs in a Cluster","volume":"21","author":"Spruit","year":"2020","journal-title":"J. Intellect. Cap."},{"key":"ref_99","first-page":"106","article-title":"Organizational Characteristics Influencing SME Information Security Maturity","volume":"56","author":"Mijnhardt","year":"2016","journal-title":"J. Comput. Inf. Syst."},{"key":"ref_100","doi-asserted-by":"crossref","first-page":"496","DOI":"10.1002\/smr.1609","article-title":"Maturity Assessment and Process Improvement for Information Security Management in Small and Medium Enterprises","volume":"26","author":"Cholez","year":"2014","journal-title":"J. Softw. Evol. Process"},{"key":"ref_101","first-page":"4995","article-title":"Advanced Approach to Information Security Management System Utilizing Maturity Models in Critical Infrastructure","volume":"12","author":"You","year":"2018","journal-title":"KSII Trans. Internet Inf. Syst."},{"key":"ref_102","doi-asserted-by":"crossref","first-page":"47","DOI":"10.1016\/j.ijcip.2016.10.001","article-title":"A Vulnerability-Driven Cyber Security Maturity Model for Measuring National Critical Infrastructure Protection Preparedness","volume":"15","author":"Karabacak","year":"2016","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_103","doi-asserted-by":"crossref","first-page":"4015","DOI":"10.1109\/JSYST.2019.2918116","article-title":"\u201cSecurity Concern\u201d as a Metric for Enterprise Business Processes","volume":"13","author":"Mukherjee","year":"2019","journal-title":"IEEE Syst. J."},{"key":"ref_104","first-page":"1","article-title":"Conceptual Design of a Cybersecurity Resilience Maturity Measurement (CRMM) Framework","volume":"23","author":"Mbanaso","year":"2019","journal-title":"Afr. J. Inf. Commun."},{"key":"ref_105","doi-asserted-by":"crossref","first-page":"1129","DOI":"10.1177\/0954409719881849","article-title":"Cybersecurity for Railways\u2014A Maturity Model","volume":"234","author":"Kour","year":"2020","journal-title":"Proc. Inst. Mech. Eng. Part F J. Rail Rapid Transit"},{"key":"ref_106","doi-asserted-by":"crossref","first-page":"410","DOI":"10.1016\/j.future.2019.12.018","article-title":"Cybersecurity Vulnerability Mitigation Framework through Empirical Paradigm: Enhanced Prioritized Gap Analysis","volume":"105","author":"Gourisetti","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_107","doi-asserted-by":"crossref","first-page":"531","DOI":"10.1016\/j.bushor.2020.03.010","article-title":"Calculated Risk? A Cybersecurity Evaluation Tool for SMEs","volume":"63","author":"Benz","year":"2020","journal-title":"Bus. Horiz."},{"key":"ref_108","doi-asserted-by":"crossref","first-page":"1897","DOI":"10.1109\/JSYST.2019.2913141","article-title":"Cybersecurity Vulnerability Mitigation Framework Through Empirical Paradigm (CyFEr): Prioritized Gap Analysis","volume":"14","author":"Gourisetti","year":"2020","journal-title":"IEEE Syst. J."},{"key":"ref_109","doi-asserted-by":"crossref","first-page":"101656","DOI":"10.1016\/j.cose.2019.101656","article-title":"LiSRA: Lightweight Security Risk Assessment for Decision Support in Information Security","volume":"90","author":"Schmitz","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_110","doi-asserted-by":"crossref","first-page":"4895","DOI":"10.1007\/s11276-018-01920-5","article-title":"Towards a Capability Maturity Model for Digital Forensic Readiness","volume":"26","author":"Englbrecht","year":"2020","journal-title":"Wirel. Netw."},{"key":"ref_111","first-page":"104","article-title":"Towards Development of a Cyber Security Capability Maturity Model","volume":"34","author":"Dube","year":"2020","journal-title":"Int. J. Bus. Inf. Syst."},{"key":"ref_112","doi-asserted-by":"crossref","first-page":"193","DOI":"10.1016\/j.eij.2020.08.001","article-title":"Adopting Security Maturity Model to the Organizations\u2019 Capability Model","volume":"22","author":"Helal","year":"2021","journal-title":"Egypt. Inform. J."},{"key":"ref_113","doi-asserted-by":"crossref","first-page":"e703","DOI":"10.7717\/peerj-cs.703","article-title":"Cybersecurity Maturity Assessment Framework for Higher Education Institutions in Saudi Arabia","volume":"7","author":"Almomani","year":"2021","journal-title":"PeerJ Comput. Sci."},{"key":"ref_114","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1109\/EMR.2020.3046533","article-title":"Incorporating Systems Thinking into a Cyber Resilience Maturity Model","volume":"49","author":"Shaked","year":"2021","journal-title":"IEEE Eng. Manag. Rev."},{"key":"ref_115","doi-asserted-by":"crossref","first-page":"179","DOI":"10.1108\/ICS-07-2023-0116","article-title":"Determining Cybersecurity Culture Maturity and Deriving Verifiable Improvement Measures","volume":"32","author":"Dornheim","year":"2024","journal-title":"Inf. Comput. Secur."},{"key":"ref_116","first-page":"1099","article-title":"Dynamic Capabilities in Cybersecurity Intelligence: A Meta-Synthesis to Enhance Protection Against Cyber Threats","volume":"53","author":"Pigola","year":"2023","journal-title":"Commun. Assoc. Inf. Syst."},{"key":"ref_117","doi-asserted-by":"crossref","unstructured":"Grigali\u016bnas, \u0160., Schmidt, M., Br\u016bzgien\u0117, R., Smyrli, P., and Bidikov, V. (2023). Leveraging Taxonomical Engineering for Security Baseline Compliance in International Regulatory Frameworks. Future Internet, 15.","DOI":"10.3390\/fi15100330"},{"key":"ref_118","doi-asserted-by":"crossref","first-page":"529","DOI":"10.1108\/ICS-06-2022-0108","article-title":"The Impacts of the Cyber-Trust Program on the Cybersecurity Maturity of Government Entities in the Kingdom of Bahrain","volume":"31","author":"Shaheen","year":"2023","journal-title":"Inf. Comput. Secur."},{"key":"ref_119","doi-asserted-by":"crossref","first-page":"103412","DOI":"10.1016\/j.cose.2023.103412","article-title":"Zero Trust Cybersecurity: Critical Success Factors and A Maturity Assessment Framework","volume":"133","author":"Yeoh","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_120","doi-asserted-by":"crossref","first-page":"103844","DOI":"10.1016\/j.cose.2024.103844","article-title":"A Logging Maturity and Decision Model for the Selection of Intrusion Detection Cyber Security Solutions","volume":"141","author":"Kern","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_121","doi-asserted-by":"crossref","first-page":"103776","DOI":"10.1016\/j.csi.2023.103776","article-title":"Create Your Own MUSE: A Method for Updating Security Level Evaluation Instruments","volume":"87","author":"Seeba","year":"2024","journal-title":"Comput. Stand. Interfaces"},{"key":"ref_122","doi-asserted-by":"crossref","first-page":"112082","DOI":"10.1016\/j.jss.2024.112082","article-title":"Managing Security Evidence in Safety-Critical Organizations","volume":"214","author":"Mohamad","year":"2024","journal-title":"J. Syst. Softw."},{"key":"ref_123","doi-asserted-by":"crossref","first-page":"1743","DOI":"10.1109\/TCST.2024.3378990","article-title":"Resiliency-Driven Cyber\u2013Physical Risk Assessment and Investment Planning for Power Substations","volume":"32","author":"Khanna","year":"2024","journal-title":"IEEE Trans. Control Syst. Technol."},{"key":"ref_124","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1007\/s11187-023-00803-0","article-title":"Should Firms Invest More in Cybersecurity?","volume":"63","author":"Dinkova","year":"2024","journal-title":"Small Bus. Econ."}],"container-title":["Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2079-8954\/13\/1\/52\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,8]],"date-time":"2025-10-08T10:29:19Z","timestamp":1759919359000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2079-8954\/13\/1\/52"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,1,15]]},"references-count":124,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,1]]}},"alternative-id":["systems13010052"],"URL":"https:\/\/doi.org\/10.3390\/systems13010052","relation":{},"ISSN":["2079-8954"],"issn-type":[{"value":"2079-8954","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,1,15]]}}}