Recent Trends in Information and Cyber Security Maturity Assessment: A Systematic Literature Review

Abstract

This work represents a comprehensive and systematic literature review (SLR) that follows the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) guidelines for research assessing information and cyber security maturity. The period from 2012 to 2024 was considered and the final collection of 96 studies was taken into account. Our findings were summarised in two stages, a quantitative analysis and a qualitative synthesis. In the first part, various quantitative indicators were used to analyse the evolution of the information and cyber security maturity assessment domain over the last twelve years. The qualitative synthesis, which was limited to 36 research papers, categorises the studies into three key areas: the development of new maturity models, the implementation of established models and frameworks, and the advancement of methodologies to support maturity assessments. The findings reveal significant progress in sector-specific customisation, the growing importance of lightweight models for small and medium-sized enterprises (SMEs), and the integration of emerging technologies. This study provides important insights into the evolving landscape of information and cyber security maturity assessment and provides actionable recommendations for academia and industry to improve security resilience and support the adoption of tailored, effective maturity models.

1. Introduction

In the current complex and uncertain environment, organisations are increasingly subjected to threats from malicious actors, which can be critical for their business operations and performance. In these settings, organisations are likely to experience a high-cost impact if they are unprepared when a crisis strikes [1].

One of the most effective practices used by organisations to manage emergencies to continue or resume business operations and thus help strengthen organisational resilience is business continuity management (BCM). The evidence from the literature shows that the level of maturity of a company in terms of BCM is directly related to its level of resilience [1,2]. This was particularly evident during the recent COVID-19 pandemic, which was critical for many organisations [3]. Consequently, the pandemic experiences increased interest in studying business continuity [4].

However, combined with the digitalisation of modern societies, most businesses rely on cyberspace to manage their business processes, transfer information, and deliver services. Therefore, information/cyber security incidents pose significant risks to business continuity. Such unwanted events can disrupt an organisation’s operations, compromise sensitive information, and result in financial and reputational damage. Therefore, information and cyber security issues are no longer only an information technology (IT) problem. Information/cyber security risk has now become a business risk, which should be handled with due care at the highest level in the organisation [5]. As a result, information and cyber security management has become one of the most important principles and levers for ensuring business continuity.

As in many other important areas of the organisation, the concept of maturity assessment is also gaining acceptance in information and cyber security management. Namely, maturity assessments in information/cyber security management help organisations to gain a comprehensive understanding of their security capabilities, prioritise improvements, and drive continuous enhancement of their security posture. By identifying gaps, mitigating risks, and allocating resources effectively, organisations can strengthen their defences and protect critical assets from evolving cyber threats. Information/cyber security maturity models therefore play a central role in the conception of information/cyber security management systems. They provide organisations with a structured framework to evaluate their current security capabilities and identify areas for improvement with the aim of ensuring the organisation’s business continuity. Implementing a security maturity model helps organisations identify their vulnerabilities and develop a risk-based approach to protect against potential information/cyber security threats. Some industries, for instance, the German automotive industry, have even established security maturity levels as the de facto standard for measuring information/cyber security [6].

The goal of this paper is to provide a comprehensive and systematic review of the literature in the field of information and cyber security maturity assessment. Such an analysis serves two purposes. First, it allows the academic community to examine potential gaps in the literature, properly position new studies, and identify areas of security maturity assessment that require further research. Second, industry, the public sector, and other professional teams can also benefit from such a study by making informed decisions about whether it is advisable to develop their own model or adopt known best practices.

The remainder of the paper is organised as follows: first, the relevant literature is reviewed and the background for our research is defined. Furthermore, the methodology for conducting the systematic literature review (SLR) in accordance with the Preferred Reporting Items for Systematic Reviews and Meta-Analysis (PRISMA) guidelines [7,8] is presented. The actual research is then performed in three main steps: planning the review, conducting the review, and reporting the review. The results are summarised in two stages, quantitative analyses and qualitative synthesis. In the Section 6, six research questions are analysed, providing conclusions from the SLR results and identifying some opportunities and directions for further research in information/cyber security maturity assessment. The final section provides some concluding thoughts on the main contributions of the paper and highlights the limitations of our research.

1.1. The Concept of Maturity and Maturity Models

According to [9,10], “maturity” implies evolutionary progress in the demonstration of a specific ability or in the accomplishment of a target from an initial to a desired or normally occurring end stage. The concept of maturity has proven to be useful in the study of the development of organisations and their processes and has been applied through various maturity models. As summarised in [11], maturity models divide evolutionary progress into a sequence of levels or stages that form a logical path from an initial state to a final level of maturity [10,12]. These levels and stages are used to derive and prioritise improvement measures and control the progress of change [13].

Maturity models therefore provide information about a company’s current status and how to improve it [14]. They offer a simple but effective tool to measure organisations’ capabilities and contribute to transformation and the development of competencies in an organisation by initiating a change process [10,15]. The maturity models can also be used as benchmarking tools to compare organisations with each other to set development goals, or as self-review frames and managerial tools for self-improvement action [14,16,17].

Maturity models are therefore a widely used tool in evaluating certain aspects of organisations, since they represent an increasingly organised and systematic way to do business [18]. Moreover, they can also be used in developing an organisation’s future vision and path. In accordance with this, [19] has identified three different purposes for developing a maturity model: descriptive, comparative, and prescriptive [11]. Maturity models serve a descriptive purpose when they are used for ‘as-is’ assessments to evaluate the current capabilities of the organisation, usually according to specific criteria. A comparative purpose enables internal or external benchmarking and comparison of similar business units and organisations, while a prescriptive purpose is to indicate how to determine desirable maturity levels and provide guidance for improvement actions.

During the last two decades, maturity models have received increasing attention across a wide range of applications, including both professional and academic interests (see, e.g., [20]). They have been extended to different domains such as the industrial sector, energy, finance, government, healthcare, education, and general use [21]. As presented by [22], the maturity model has been deployed in diverse areas, from software engineering to project management, quality assurance, process improvements, and others. However, such diverse application areas result in many publications. Although it is difficult to draw parallels in such diversity, in our opinion, the maturity models can be roughly grouped as follows:

• Organisational maturity models (OMM): These models look at the overall maturity of an organisation, including its culture, leadership, and strategic planning. The review and classification of OMM is provided by [23], while extensive SLR of enterprise maturity models is prepared by [24];
• Process-related maturity models (PMM): These models focus on the level of maturity of an organisation’s processes and are typically used in areas such as project management, software development, and quality assurance. One of the first widely used and popular process-oriented maturity models was the Capability Maturity Model (CMM), introduced by the Software Engineering Institute [25] and originally proposed to objectively assess the software development process. Many existing maturity models have their roots directly in the CMM and have adopted its five-level approach (level 1—initial, level 2—managed, level 3—defined, level 4—quantitatively managed, and level 5—optimised), which describes an evolutionary path of increasingly organised and systematic maturity stages. As expressed by [14], PMM has become a prosperous approach to support business process management (BPM). A comprehensive overview of BPM maturity models is provided by [26,27,28], while an SLR of BMP maturity models for small and medium-sized enterprises (SMEs) was prepared by [11]. PMMs are frequently applied to the field of information systems (IS) and information system management (ISM). A systematic review of experience and findings in this area of maturity assessment can be found in the following studies: [18,29,30];
• Technology-related maturity models: This category includes maturity models and frameworks that are used to assess and improve the maturity of an organisation’s technological capabilities. An important group in this category are models focussed on the maturity of IT. A comprehensive review of IT-related maturity models is provided by [31,32]. There are also contributions focussing on specific technology segments or specialised products (e.g., Industry 4.0 [33] or Industry 5.0 [34]). As [35] stated, organisations are facing increasing cyber security risks in the context of Industry 4.0 and 5.0, making it essential to adopt tailored risk management methodologies such as the NIST Cybersecurity Framework (NIST CSF), ISO/IEC 27001, and MAGERIT;
• Data maturity models: These models assess an organisation’s level of maturity in managing and using data. A survey of maturity models in data management was prepared by [36]. A multivocal literature review of the maturity of open government data maturity is provided by [37], while [38] prepared an SLR on big data maturity assessment models;
• Sustainability maturity models: These models assess an organisation’s level of maturity in sustainability practices, such as environmental management and social responsibility. Among others, examples of such studies are [39,40,41];
• Resilience maturity models: This category includes maturity models and frameworks that help organisations assess and improve their ability to anticipate, prepare for, respond to, and recover from disruptions or crises. These models typically provide a set of best practices and benchmarks that organisations can use to evaluate their current resilience capabilities and identify areas for improvement. Examples of such approaches can be found in [42,43,44]. Moreover, this article examines relevant cyber security capability maturity models to identify the standards and controls available to providers of critical infrastructure, to improve their level of security preparedness. Information/cyber security maturity models that are the focus of our research (to be discussed in more detail in the next section) could be assigned to this category.

However, it is important to realise that the classification we have given is not entirely complete. The complexity of organisations and the turbulent environment in which they operate often give rise in practice to the need for so-called hybrid maturity models that should combine various aspects of different maturity models to provide a more comprehensive assessment of organisations’ maturity. In such a way, organisations can gain a more complete understanding of their strengths and weaknesses and develop a more targeted roadmap for improvement. For example, a hybrid maturity model might combine aspects of an organisational maturity model with a process maturity model to assess an organisation’s overall maturity in a particular area, such as project management [45,46].

In addition, technological developments and other societal trends are both dictating the development of new models of maturity and opening new areas of application. In recent years, one has often been able to find studies dealing with maturity assessment in various topical areas, such as digitalisation [22,47,48,49], artificial intelligence [50], and blockchain technology [51], etc.

While maturity models can be useful in assessing an organisation’s level of maturity and identifying areas for improvement, they also have several limitations and deficiencies. Some of these include:

• “One-size-fits-all” approach: Maturity models are often designed to be generic and applicable across multiple industries and contexts. However, this means that they may not account for the unique characteristics of each organisation, such as their culture, size, or goals. In addition, maturity models have often been characterised as ’step-by-step recipes’ that simplify business reality [52];
• Static and inflexible [45]: Maturity models tend to be static and prescriptive in nature, providing a linear path for organisations to follow. However, this may not be suitable for complex and rapidly changing environments, where a more flexible and adaptive approach may be necessary;
• Lack of empirical evidence [9,52,53]: Many maturity models are based on expert opinions and best practices, rather than empirical evidence. As a result, their effectiveness in improving organisational performance may not be well supported by data. As cited in [11,53] observed that empirically validated maturity models are quite rare;
• Limited scope and lack of a systematic approach [54]: Maturity models typically focus on a specific area or function within an organisation, such as IT or project management. This may lead to a narrow perspective on organisational maturity and overlook other important factors that affect organisational performance;
• Narrow “compliance-oriented” approach: Maturity models often prioritise compliance and conformity over innovation and creativity. This may discourage organisations from pursuing novel approaches and taking risks, which can be important for staying competitive in today’s fast-paced business environment. Maturity models should not focus on a series of levels toward a predetermined ‘final state’ but on the factors that influence evolution and change [11,55].

It is important to be aware of these limitations and deficiencies when implementing maturity models and frameworks in practice. It should be ensured that they are applied in a way that is appropriate for the specific context and goals of the organisation under consideration.

1.2. Information/Cyber Security Maturity Models

In today’s digital era, the concepts of information security and cyber security have become matters of global interest and importance. The two concepts are so closely related that they are often wrongly considered synonyms, and incorrectly used interchangeably. Although there is considerable overlap between the two concepts, they are not analogous and have some important differences that need to be clarified to avoid confusion. The main differences between the concepts of information security and cyber security can be summarised as follows [56,57,58]: information security refers to the protection of information from unauthorised access, use, disclosure, disruption, modification, or destruction. It involves the implementation of policies, procedures, and technologies to ensure confidentiality, integrity, and availability of information. Information security focusses on protecting all forms of information, including digital and physical records, intellectual property, trade secrets, and personal identifiable information.

Cyber security, on the other hand, is about securing things that are vulnerable through ICT, including, but not limited to, information. Cyber security involves protecting networks, computers, servers, and other digital devices (IoT, industrial IoT, and industrial control systems, etc.) from unauthorised access, use, disclosure, disruption, modification, or destruction. It includes the implementation of technologies such as firewalls, intrusion detection systems, antivirus software, and encryption, as well as the development of policies and procedures to manage cyber risks.

In summary, information security is a broader concept that encompasses the protection of all forms of information, while cyber security is a narrower concept that focusses specifically on protecting digital information and systems from cyber threats. Therefore, cyber security that aims to protect digital assets is recognised as a part of information security, which targets information whether it is in digital or in physical space [58]. As cyberspace is growing rapidly, both information security and cyber security need to be continuously evaluated and innovated, to be updated with the most recent modifications [57]. To have a comprehensive security programme to ensure business continuity, organisations need to address both concepts. Therefore, when conducting our SLR, both concepts—information and cyber security maturity assessment—will be taken into consideration.

In general, information and cyber security maturity models (ICS MM) can be described as frameworks used to assess an organisation’s level of information/cyber security readiness and guide its journey towards a more mature and therefore resilient information/cyber security posture. In accordance with the need to ensure business continuity, the ICS MM can be implemented in the following main areas:

• Governance: This includes establishing a governance structure for information and cyber security that defines roles and responsibilities, sets policies and standards, and provides oversight and accountability. Examples of such studies are, for example, [59,60,61];
• Risk Management: Organisations need to identify, assess, and manage information and information/cyber security risks. This includes conducting risk assessments, implementing risk management processes and procedures, and continuously monitoring and updating the risk management programme. Representatives of such studies are [62,63,64];
• Security Operations: This includes implementing security technologies and tools for security monitoring and establishing security incident response procedures [65,66], threat intelligence analysis [67], and establishing security training and awareness programmes [68,69];
• Compliance: Organisations need to comply with regulatory requirements, industry standards, and best practices. This includes identifying applicable regulations and standards, assessing compliance, and implementing controls to ensure compliance. Such studies are [70,71,72].
• Third-party risk management: Organisations need to manage information and cyber security risks associated with third-party vendors and suppliers. This includes assessing third-party risks, implementing controls to mitigate those risks, and monitoring third-party security posture over time. As an example, we can expose studies dealing with maturity associated with cloud service risks [73,74].

During the last two decades, the topic of information and/or cyber security maturity assessment has received considerable attention and has attracted many authors, from practitioners to those from academic societies. As the number of contributions increases, so does the need for an SLR. The aim of this research is to identify, evaluate, and synthesise all relevant research studies to provide a reliable and comprehensive summary of the current state of knowledge that can serve as a basis for future research, policy, and practice. After a detailed review of the existing literature, we realised that at least for the time being, there are not many such SLR contributions. Exceptions include the following few studies:

The only overview study in the domain of information security maturity assessment we have been able to find is the contribution of [75], who provided an overview of the following maturity models for assessing the organisation’s information security management maturity (ISM MM): The Bank of Russia’s ISM MM, ISMS Maturity Capability Model, NIST’s IS MM, Open Group’s ISM MM, Gartner’s Security and Risk Management ML assessment, IS Risk Management Process MM, Security Incident Management Models, and IS Monitoring MM. The authors intended to use the results of the study to develop their own maturity model called the Maturity Model for Network Security Intelligence Centers (NSICs MM). The concept of cyber security maturity is not covered in this study.

A slightly larger number of reviews studied address the concept of cyber security maturity assessment. Ref. [76] examined an SLR of published studies from 2012 to 2017. As a result, the authors described and compared the most used cyber security CMM. They have observed that all analysed variants of cyber security CMM have similar elements, because they use processes and levels of maturity. They also manage the risk, although at different levels of depth. Moreover, the authors found that each model has a different field of application due to its particularity. Very similar are later studies [77,78] which considered the time span from 2011 to 2019.

Marican et al. [5] produced an SLR on cyber security maturity assessment frameworks for technology startups in various industries. This study specifically examined the scope of the frameworks from an end-to-end perspective and the quantification of cyber investment returns. A detailed analysis of published research articles from reputable journals and conference proceedings from January 2011 to June 2022 was conducted. The results showed that there is a lack of appropriate cyber security maturity assessment frameworks for technology startups, which puts startups in a vulnerable position.

We found only two SLR studies that address both concepts, information and cyber security maturity. First is the research of [69], who prepared a scoping review of assessment approaches and maturity scales used for the evaluation of information security and cyber security user awareness and training programmes. The authors found that there is a gap in the current literature regarding the assessment of these programmes, as only five papers and two maturity models were found. As user awareness and training programmes play an important role in fighting against cyber attacks, researchers were encouraged to undertake further study in this area.

The most comprehensive study is provided by [79], carrying out an SLR on information and cyber security maturity models, published between 2007 and 2018. The authors highlighted the prevalent influence of the ISO/IEC 27001/27002 standard [80,81] but raised the necessity for an in-depth investigation of ISO 21827 [82]. Moreover, the authors found that, compared to the number of proposed models, implementation experiments are lacking. This could be due to the arduous task of validation, and it could also be the reason why specific models are dominant.

In this paper, we aim to continue the work started by [79]. Because the field of information and cyber security maturity assessment is recognised as a rapidly evolving area, we anticipate that the number of published papers has increased significantly over the past five years, necessitating a renewed SLR. As we are primarily interested in trends in scientific developments, we would like to expand the SLR to include important databases that were not included in previous studies (e.g., Web of Science). The main objective of this study is to provide a comprehensive overview of efforts to assess the maturity of information and cyber security in different sectors. However, we recognise that cyber security is a broad and complex field, and it is not possible to examine all sub-sectors in the desired depth in a single study. By identifying cross-sector trends and challenges, we aim to provide a basis for future research that could focus on more targeted analyses of specific sub-sectors.

2. Research Methodology

For the purpose of our research, we used an SLR approach, which provides a systematic, explicit, and reproducible method for identifying, selecting, evaluating, and critically appraising the existing body of completed and recorded research [83].

Following guidelines for creating a comprehensive SLR [84,85] and the experiences of other authors [86,87,88,89,90], we defined an SLR process for the purpose of this study. As suggested in some previous studies (see, e.g., [91,92]), we conducted our SLR in accordance with the PRISMA guidelines to ensure scientific rigour and minimise bias in the findings. To facilitate the identification, screening, visualisation, and bibliographic analysis of the study, the Mendeley Reference Management Software and Microsoft Excel were utilised.

It can be seen from Figure 1 that the process consists of three main steps: planning the review, conducting the review, and reporting the review.

The main tasks related to planning the review are determining the purpose of the review and the scope of the study, developing a review protocol, and defining the research questions.

The tasks associated with conducting the review are the identification of relevant sources, the identification of eligible studies (i.e., candidate studies), the selection process (i.e., the application of inclusion and exclusion criteria to determine the final collection of relevant studies), the validation of the selection process by independent reviewers, data extraction, and data synthesis.

Review reporting is the final step in the creation of an SLR and involves the systematic and smooth reporting and writing up of the results, so that the entire process is scientifically reproducible. The results of the review can be presented in the form of a quantitative analysis and qualitative synthesis of SLR findings.

3. Planning the Review

The purpose of our SLR is to discover recent trends in information and cyber security maturity assessment in organisations. To conduct the comprehensive systematic and fair evaluation of literature, a review protocol has been established, and is summarised in

Table 1. Summary of the review protocol.

Time Span	2012–2024
Source selection	The following databases will be included: IEEE Xplore (https://ieeexplore.ieee.org/ (accessed on 5 August 2024)). ACM Digital Library (https://dl.acm.org/ (accessed on 5 August 2024)). Web of Science (https://www.webofscience.com/ (accessed on 5 August 2024)). Science Direct (https://www.sciencedirect.com/ (accessed on 5 August 2024)).
Search strategy	The candidate studies will be identified by screening the document title, abstract, and/or document keywords. Search keywords used for database screening are presented in Table 2.
Selection process	The final collection of relevant studies will be obtained through the application of inclusion and exclusion criteria, which are defined in Table 3. The selection process will be validated by two independent reviewers.

.

Search keywords used for database screening are given in

Table 2. Search keywords.

Topic	Description	Keywords
Maturity	Keywords that address maturity- related concepts	maturity model maturity framework maturity assessment maturity evaluation maturity level
Information security	Keywords that address information security-related concepts	information security INFOSEC information system security IT security IS security
Cyber security	Keywords that address cyber security-related concepts	cyber security cybersecurity

. Inclusion and exclusion criteria are presented in

Table 3. Inclusion and exclusion criteria.

Included	Excluded
Year of publication between 2012 and 2024	Year of publication outside the range 2012–2024
Found in the selected databases	Duplicated studies
Publication type “research article” or “conference paper”	Publications of other types
Published in English	Publication language other than English
Focus on the domain «information security maturity» or «cyber security maturity»	Outside the domains «information security maturity» and «cyber security maturity»
Studies with the following scopes (at least one): Present/describe ICS MMs Analyse/compare ICS MMs Case studies about ICS MM implementation Present/describe supporting methodologies for ICS MMs	Studies outside these scopes
Full text available for qualitative analysis	Full text not available

.

The results of our SLR will be summarised in two stages, the first one being quantitative analysis and the second one qualitative synthesis.

Quantitative analysis should reveal various quantitative trends over the years according to the selected criteria. In this stage, the complete collection of relevant publications (i.e., conference papers as well as research articles) will be considered, and the following research question will be discussed:

• RQ1: What are the general trends of ICS MM studies during the last twelve years (i.e., yearly distribution of publications (conference papers and research articles), distribution of publications by industry, or by information/cyber security domain, etc.)?

The aim of the qualitative synthesis is to show relationships between studies to gain a deeper understanding of the research topic. We aim to integrate key findings to identify parallels, variations, or divergent perspectives. In addition, we aim to identify potential gaps and suggest some directions for future research. If our final collection of relevant publications includes enough research articles (at least 10), we will limit the qualitative synthesis to those. Namely, in our opinion, research articles provide a more reliable basis for summarising conclusions. Through qualitative synthesis, we aim to answer the following research questions:

• RQ2: How can recent studies on ICS MMs be categorised based on their contributions to the development of information/cyber security maturity assessment?
• RQ3: In which sectors and industries have ICS MMs been applied most effectively and what type of organisations have found the concept of information/cyber security maturity assessment useful?
• RQ4: What are the key drivers for ICS MM adoption?
• RQ5: What are the main gaps or limitations that the authors have identified regarding the implementation of ICS MMs in organisations?
• RQ6: What opportunities and future research directions in the field of information/cyber security maturity assessment have the authors identified?

4. Conducting the Review

Following a predefined review protocol, the selected source databases were searched. The query strings as well as the results of the searches are listed in

Table 4. Query strings and results of selected databases search.

Source	Query	No. of Results
IEEE Xplore	((((“Abstract”:“maturity”) AND (“Abstract”:“model” OR “Abstract”:“framework” OR “Abstract”:“assessment” OR “Abstract”:“evaluation” OR “Abstract”:“level”)) AND (“Abstract”:“information security” OR “Abstract”:“INFOSEC” OR “Abstract”:“information system security” OR “Abstract”:“IT security” OR “Abstract”:“IS security” OR “Abstract”:“cyber security” OR “Abstract”:“cybersecurity”))) Filters Applied: Conferences, Journals, 2012–2024	126
ACM Digital Library	[Abstract: “maturity”] AND [[Abstract: “model”] OR [Abstract: “assessment”] OR [Abstract: “evaluation”] OR [Abstract: “level”]] AND [[Abstract: “information security”] OR [Abstract: “infosec”] OR [Abstract: “information system security”] OR [Abstract: “it security”] OR [Abstract: “is security”] OR [Abstract: “cyber security”] OR [Abstract: “cybersecurity”]] AND [E-Publication Date: (1 January 2012 TO 31 July 2024)] Filters Applied: Research Article	37
Web of Science	(AB=(((“maturity”) AND (“model” OR “framework” OR “assessment” OR “evaluation” OR “level”)) AND (“information security” OR “infosec” OR “information system security” OR “IT security” OR “IS security” OR “cyber security” OR “cybersecurity”))) AND (DT==(“ARTICLE” OR “REVIEW”) AND DT==(“ARTICLE” OR “REVIEW”) AND LA==(“ENGLISH”) AND TASCA==(“COMPUTER SCIENCE INFORMATION SYSTEMS” OR “MANAGEMENT” OR “BUSINESS” OR “COMPUTER SCIENCE SOFTWARE ENGINEERING” OR “TELECOMMUNICATIONS” OR “ENGINEERING ELECTRICAL ELECTRONIC”)) Refined By: Document Types: Article or Review Article + Languages: English + Publication Years: 2012–2024	69
Science Direct	“maturity” AND (“model” OR “assessment” OR “evaluation” OR “level”) AND (“information security” OR “cyber security” OR “cybersecurity”) Custom range 2012–2024 Filters Applied: Review article + Research Article	49
Total		281

. The search was conducted in August 2024. 281 studies were included in the selection process. Given the descriptive and qualitative nature of our systematic review, it was not possible to conduct formal sensitivity analyses as well as the detailed risk of bias assessment for each study. However, to enhance the robustness of our findings, we cross-validated our results with the existing literature and meta-analyses. This process provides confidence in the reliability of our results.

Figure 2 shows that after application of the inclusion criteria (IC) and exclusion criteria (EC) and validation of the selection process by two independent reviewers, 159 studies were excluded from the study, 1 because of a publication language other than English [76], 1 because the full text was not available [74], and 157 due to inappropriate scope. The final collection therefore contained 96 studies.

It was agreed that in the case of missing data, the two independent reviewers would analyse the available information and attempt to find additional material to fill any gaps identified.

5. Reporting the Review

The results were analysed using both quantitative and qualitative approaches. The quantitative analysis included indicators such as the distribution of publications per year, the sectoral focus, and geographical distribution trends. In contrast, qualitative synthesis categorised the studies into three main groups: those dealing with the development of new models, those applying existing frameworks, and those focussing on supporting methodologies. Preparing the data for synthesis involved systematically organising the extracted information into predefined categories.

5.1. Quantitative Analysis

The final collection for the quantitative analysis comprises 96 studies, of which 60 (62.5%) are conference papers and 36 (37.5%) research articles. To answer RQ1, we have extracted all the necessary quantitative indicators from the collection, which are presented below. We will discuss the results in more detail in Section 6.1.

The annual distribution of publications over the chosen time span (2012–2024) is presented in Figure 3, while the distribution of studies by the industry sectors is given in

Table 5. The distribution of studies according to the industry sectors.

Sector	No. of Studies	% of Studies
Organisations in General	30	31.25
Utilities	13	13.54
Information Technology	9	9.38
Government	8	8
Financial Services	7	7.29
SME Sector	7	7.29
Healthcare	5	5.21
Education	4	4
Public Sector	3	3.13
Transportation	3	3.13
Manufacturing	2	2.08
n/a	5	5.21
Total	96	100

.

The distribution of studies by the information/cyber security domain and corresponding subdomains is illustrated in Figure 4, while Figure 5 shows the list of journals where the 36 research articles from our collection were published.

5.2. Qualitative Synthesis

In our qualitative synthesis, we focussed exclusively on journal articles (36 research articles), as these tend to provide a more in-depth analysis, a broader theoretical framework, and a longer timeframe for the development and testing of ideas. Journal articles also provide a more consistent overview of research methods and findings, which is essential for systematic comparison and the identification of trends in the field of information and cyber security maturity assessment. Conference papers, on the other hand, often present early-stage research findings or very specific case studies that do not always lend themselves to comprehensive qualitative analysis. A complete list of the articles examined can be found in the Appendix A. All 36 articles were reviewed by two independent reviewers in depth to extract all the information we needed to answer our research questions RQ2–RQ6. A summary of the results is presented below (see

Table 6. Categorisation of the studies into three groups.

	Group of Studies	ID
Group 1	Development of new maturity concept	RA3, RA4, RA6, RA9, RA12, RA13, RA14, RA15, RA16, R18, RA19, RA25, RA26, RA28, RA31, RA32
Group 2	Implementation of already known maturity concept	RA2, RA7, RA8, RA10, RA11, RA20, RA21, RA27, RA30
Group 3	Other	RA1, RA5, RA17, RA22, RA23, RA24, RA29, RA33, RA34, RA35, RA36

,

Table 7. Studies that contribute to the development of a new information/cyber maturity concept.

ID	Title/Name of the New Maturity Concept	Is the New Concept Based on Already Known Maturity Concept?	Is Validation or Testing of the New Concept Provided?
RA3	Vulnerability-Driven Cybersecurity Maturity Model	No.	Yes, validated with critical infrastructure preparedness data.
RA4	Advanced Information Security Maturity Assessment (AISMA)	Yes. CMMI.	Yes. Validation provided through simulation in critical infrastructure (thermal power plants).
RA6	Cybersecurity Resilience Maturity Measurement (CRMM)	Yes. CRMM adapts and integrates elements from several well-established frameworks, including NIST CSF, COBIT 5, CIS Controls, SoGP for IS, and ISO/IEC 27005 [93].	Partly. The model has been partially validated through expert consultations, but lacks full practical implementation.
RA9	Holistic Cybersecurity Maturity Assessment Framework (HCYMAF) for Higher Education Institutions in the United Kingdom	Yes. CMM.	Yes. Validation through case study in education UK institutions.
RA12	Cybersecurity Vulnerability Mitigation Framework Through Empirical Paradigm (CyFEr)	Yes. NIST CSF.	Yes. Validation is provided through a real-world cyberattack demonstration.
RA13	LiSRA (Lightweight Security Risk Assessment)	Not directly but it incorporates general principles from ISO/IEC 27001 [80] or NIST SP 800-30 [94].	Partly. The model has been validated through case studies but lacks broader practical testing.
RA14	Method for Adaptive Information Security Maturity Modelling in Clusters (MAISMMC)	Yes. Information Security Focus Area Maturity Model (ISFAM).	Partly. The model has been validated through case studies but lacks broader practical testing.
RA15	Digital Forensic Readiness Capability Maturity Model	Yes. CMMI and Software Process Improvement and Capability Determination (SPICE).	Partly. The application of the model is tested through a case study based on publicly available information about the Target Corporation data breach.
RA16	Cyber Security Capability Maturity Model (CSCMM)	No.	Yes, validation of the model is based on an empirical study and view from almost 200 cross-sector cyber security experts.
RA18	Cyber Threat Intelligence-driven SOC Maturity Mode (CTI-SOC2M2)	Yes. CMMI.	Yes, tested in SOC environments.
RA19	Cybersecurity Maturity Assessment Framework (SCMAF) for Higher Education Institutions in Saudi Arabia	Yes. HCYMAF.	Yes. Validated through case studies in higher education institutions in Saudi Arabia.
RA25	Information Security Maturity Model for Healthcare Organisations in the United States	No.	Yes, validated through use cases in healthcare organisations.
RA26	Incident Response Management Maturity Model (IRM3)	No.	Partly. Tested through simulations of incident response scenarios.
RA28	Dynamic Capabilities in Cybersecurity Intelligence (DCCI) Framework	No.	Partly. Based on a meta-synthesis of 47 case studies, but direct empirical testing is not provided.
RA31	Zero Trust Cybersecurity Maturity Assessment Framework	Yes. NIST Zero Trust Architecture.	Party. The model was designed and validated by cyber security experts from various industries, but the study does not describe practical validation in real organisations.
RA32	Logging Maturity and Decision Model	No.	Yes. Validated using MITRE ATT&CK data and illustrative case studies.

,

Table 8. Studies that focus on the implementation of already known information/cyber maturity concepts.

ID	Maturity Concept Used	Short Description
RA2	IT Capability Maturity Framework (IT-CMF)	Implements IT-CMF for assessing and improving IT capabilities, with a focus on security governance.
RA7	Cybersecurity Capability Maturity Model (C2M2)	Adapts the C2M2 in the railway sector, focussing on improving cyber security preparedness and resilience.
RA8	NIST CSF	Uses NIST CSF to prioritise and mitigate vulnerabilities through empirical gap analysis.
RA10	Socio-technical maturity models, CMMI, Information Security Governance Frameworks	Applies socio-technical and governance frameworks for assessing information security performance.
RA11	NIST CSF	Proposes a cyber security evaluation tool for SMEs, based on the five NIST CSF categories, to help assess and improve their cyber security maturity.
RA20	Promoting Global Cyber Resilience for Sectors and Society (ProGReSS)	Integrates systems thinking to enhance resilience maturity.
RA21	COBIT	A case study is conducted where practitioners assessed a subset of the ISO/IEC 27002 security controls for a hypothetical scenario using the COBIT 5 maturity levels.
RA27	Information Protection Culture Assessment (IPCA) assessment framework	Shows how IPCA can be applied to measure and improve the cyber security culture within an organisation through tailored surveys and actionable improvement measures.
RA30	Bahrain Government framework Cyber Trust Program (CTP)	Uses the CTP to assess and improve cyber security maturity in government entities in Bahrain.

,

Table 9. Studies that provide supporting methodologies or frameworks that contribute to the understanding of information/cyber security maturity.

ID	Short Description	Relation to Information/Cyber Security Maturity
RA1	Explores maturity assessment for information security management in SMEs.	Provides a methodology for SMEs to assess and improve their information security maturity.
RA5	Introduces a metric-based approach for evaluating security concerns in business processes.	Provides metrics to evaluate and improve maturity in business processes.
RA17	Adapts security maturity model to align with organisational capabilities.	Suggests a way to align organisational capabilities with security maturity models, contributing to the understanding of maturity adaptation to different organisational contexts.
RA22	Proposes an agile architecture approach for managing information security risks.	Introduces agile approaches to information security risk management and provides an indirect framework for understanding risk-related aspects of security maturity.
RA23	Conducts a systematic literature review on cyber security maturity models for startups.	Reviews existing cyber security maturity models and provides insights into gaps and needs to support the development of future maturity models. Summarises existing models and frameworks to improve startup maturity.
RA29	Utilises taxonomic engineering for security baseline compliance in regulatory frameworks.	Focusses on compliance and provides a framework that indirectly measures maturity through adherence to security standards.
RA33	Proposes a method for updating security-level evaluation instruments.	Proposes improvements to evaluation instruments, contributing to the continuous development and understanding of security maturity.
RA34	Explores managing security evidence in safety-critical organisations.	Discusses the management of security evidence that indirectly contributes to maturity through operational effectiveness and security management.
RA35	Assesses cyber-physical risk and investment planning for power substations.	Examines risk and investment strategies for resilience and provides a context for understanding how cyber-physical systems affect maturity.
RA36	Analyses cyber security investment and maturity among Dutch firms.	Analyses whether higher investment in cyber security correlates with a higher level of maturity and thus contributes to understanding the readiness and maturity of organisations.

,

Table 10. Sectors and organisations where ICS MMs have been effectively applied.

Sector/Industry	Type of Organisation	Related Articles	Description of ICS MM Application
Critical infrastructure	Railways, Energy, Utilities, Cyber-physical systems	RA3, RA4, RA7, RA35	Focusses on improving preparedness and resilience in critical infrastructure through models like C2M2 and vulnerability-driven models.
Government institutions	Government agencies, Public sector organisations	RA18, RA20, RA30	Government agencies have adopted models like the Cyber Trust Program and CTI-SOC2M2 for information/cyber security maturity and threat intelligence.
Healthcare	Hospitals, Healthcare providers	RA25, RA26	Healthcare Information Security Maturity Model helps ensure compliance with regulations and improves sensitive patient data security.
Higher education	Universities, Colleges	RA9, RA19	Higher education institutions use customised maturity frameworks to address the specific information/cyber security challenges in academia and research.
Small and Medium-sized Enterprises (SMEs)	Private sector, SMEs	RA1, RA11, RA13, RA14, RA16	Maturity models and evaluation tools tailored for SMEs help improve security readiness with limited resources.
Technology startups	Startups and emerging tech companies	RA23	Maturity models help startups align cyber security practices with business growth and scalability.
Digital forensics	Law enforcement, Cyber security teams	RA15	The Digital Forensic Readiness Capability Maturity Model focusses on improving forensic readiness in organisations that need to handle digital evidence effectively.
Financial services	Financial institutions	RA36	Focusses on analysing cyber security investments and improving maturity in banking and financial firms.

,

Table 11. Key drivers for the adoption of ICS MMs in different sectors and industries.

Driver	Sector/Industry	Related Articles	Description
Regulatory compliance	Healthcare, Government, Public sector, Critical infrastructure	RA18, RA25, RA30, RA35	ICS MMs ensure compliance with laws (such as Health Insurance Portability and Accountability Act (HIPAA) in healthcare) and regulations in critical infrastructure sectors. Government agencies implement ICS MMs to align with international standards and improve compliance (e.g., the Cyber Trust Program).
Cyber security threat resilience	Critical infrastructure, Energy, Railways	RA3, RA4, RA7, RA18, RA35	ICS MMs help to increase the resilience of critical infrastructure and the energy sector to cyber security threats.
Data protection	Healthcare, Higher education	RA9, RA19, RA25	The protection of sensitive data (e.g., patient or research data) is a key driver in adopting ICS MMs in healthcare and academic institutions.
Risk management and mitigation	SMEs, Financial services, Technology startups	RA11, RA12, RA13, RA23, RA36	Managing and mitigating cyber security risks is critical for SMEs and financial institutions, especially for the protection of assets with limited resources.
Incident response preparedness	Government, Critical infrastructure	RA18, RA20, RA26	Incident response maturity helps organisations, especially in critical infrastructures, to manage security incidents effectively.
Investment in cyber security	Financial services, Startups, Large enterprises	RA23, RA36	ICS MMs support organisations in prioritising information/cyber security investments and aligning them with the company’s growth objectives.
Enhancing security culture	Government, Public institutions, SMEs	RA9, RA18, RA27	Promote a security-conscious culture through maturity models, especially in government organisations and SMEs where cultural awareness is crucial.
Improving business continuity	Critical infrastructure, Railways	RA3, RA7, RA26, RA35	Ensuring business continuity by improving maturity in sectors such as rail transport and electricity supply that rely on uninterrupted operations.
Cost-effective security solutions	SMEs	RA11, RA13, RA16	Maturity models such as LiSRA help SMEs to introduce cost-effective security solutions that are tailored to their limited resources.

,

Table 12. Main gaps and limitations in the implementation of ICS MMs in organisations.

Gap/Limitation	Description	Related Articles
Resource constraints	SMEs often lack the resources (time, money, personnel) to effectively implement ICS MMs, which are usually designed for larger organisations.	RA1, RA11, RA13, RA14, RA16
Complexity of models	Some ICS MMs are considered too complex and difficult to understand and implement, especially in organisations with limited cyber security expertise.	RA11, RA12, RA16, RA30
Customisation to specific sectors	A lack of sector-specific customisation in many models, leading to difficulties in implementation for sectors with specific requirements (e.g., healthcare, higher education).	RA7, RA9, RA16, RA19, RA25
Lack of practical guidance	While many models offer assessments, they lack detailed, actionable guidance on how to implement the improvements needed to increase maturity.	RA12, RA25, RA26
Cultural and human factor barriers	Resistance to change, lack of cyber security awareness and an inadequate security culture are barriers to successful ICS MM implementation in some organisations.	RA18, RA27
Alignment with business objectives	Difficulties in aligning cyber security maturity models with broader business objectives, leading to a mismatch between security and strategic goals.	RA13, RA36
Lack of automation and tool support	Limited integration of automation tools in ICS MMs, making the process of tracking, managing, and improving maturity tedious and resource intensive.	RA11, RA31
Inconsistent metrics and evaluation	The lack of standardised metrics and evaluation methods for the various models makes it difficult for organisations to measure progress or compare it with industry standards.	RA21, RA24
Integration with existing systems	Challenges in integrating ICS MMs into existing organisational processes (e.g., risk management systems, incident response) and adapting them to existing structures.	RA10, RA20, RA26
Financial barriers	High implementation costs are a common constraint, especially in resource-limited organisations that cannot afford the full range of tools and expertise required for ICS MMs.	RA13, RA36
Limited focus on emerging technologies	Some models do not adequately account for emerging technologies and modern threats (e.g., cloud computing, AI), making them less relevant to today’s rapidly evolving cyber security landscape.	RA28, RA32
Time-consuming assessments	The time required to assess and reassess information/cyber security maturity is often considered too high, especially for organisations that need a quick assessment.	RA11, RA30

and

Table 13. Opportunities and future research directions in information/cyber security maturity assessment.

Opportunity/Future Direction	Description	Related Articles
Empirical validation of models	The need to test existing conceptual models more empirically in different sectors and validate them in practice.	RA6, RA9, RA12, RA15, RA16, RA19
Sector-specific customisation	Development and refinement of models that meet the specific needs of different industries and sectors (e.g., healthcare, education, SMEs).	RA7, RA9, RA13, RA16, RA19, RA25
Integration with emerging technologies	Research on how maturity models can adapt to new technologies and threats such as cloud computing and AI-driven attacks.	RA28, RA32
Automation and tool support	The opportunity to improve maturity models through automation and better tools for managing assessments and tracking improvements.	RA11, RA31
Simplified models for SMEs	Development of lightweight and cost-effective models tailored to the specific challenges of SMEs.	RA1, RA11, RA13, RA14
Cross-organisational comparisons	Creation of standardised metrics and frameworks to enable cross-organisational comparisons of cyber security maturity.	RA21, RA24
Integration with risk management	Expanding models to more fully integrate risk management practices to help organisations better align security with risk mitigation efforts.	RA10, RA20, RA26
Alignment with business goals	Future research could focus on better aligning maturity models with strategic business objectives, especially for SMEs and startups.	RA13, RA36
Focus on incident response maturity	Opportunities to refine models that focus specifically on incident response capabilities to ensure rapid recovery from cyber attacks.	RA12, RA18, RA26

), with a more in-depth discussion in Section 6.2.

Table 6 shows that the studies included in the qualitative synthesis can be effectively categorised into three main groups: those that contribute to the development of a new maturity concept (see Table 7), those that focus on the implementation of already known maturity concepts (see Table 8), and those that provide supporting methodologies or frameworks that contribute to the understanding of information/cyber security maturity (see Table 9).

Table 10 presents a summary of the sectors and industries where ICS MMs have been applied effectively and the types of organisations that have benefited from the maturity assessment concepts.

Table 11 provides an overview of the key drivers for the adoption of ICS MMs in different sectors and industries and summarises the reasons why companies are using these models to improve their security practices.

Table 12 summarises the most important gaps and limitations in the implementation of ICS MMs and shows the obstacles that organisations face when introducing and implementing maturity models.

Table 13 summarises the key opportunities and future research directions identified in the 36 research articles reviewed and highlights areas for further development and innovation in cyber security maturity assessment.

6. Discussion and Research Questions Analysis

Aligned with our approach to SLR, we first discuss the findings of a quantitative analysis (RQ1), followed by the findings of a qualitative synthesis (RQ2–RQ6).

6.1. Findings from the Quantitative Analyses of SLR Results

The data for answering the RQ1 (What are the general trends of ICS MM studies during the last twelve years?) can be obtained from Section 5.1. Figure 3 shows that the trend of publications is continuously increasing, which confirms the relevance of the topic. This is particularly evident from 2019, when the total number of publications almost doubled compared to previous years. As only the first half of 2024 was considered, this trend is expected to continue. Analyses show that most authors come from Asia (32.29%) and Europe (31.25%). As shown in Table 5, most studies (31.25%) are general in nature and do not focus on a specific industry sector. Furthermore,13.54% of the studies are focussed on utilities (e.g., critical infrastructure, energy distribution, industrial control systems), while 9.38% of the studies deal with information technology. Government (8%), financial services, and the SME sector (both 7.29%) are also well represented.

Figure 4 shows that more studies focus on cyber security (53.1%) than on information security (29.17%), while 17.71% of the studies combine both approaches. Most studies focus on compliance with frameworks and standards (38.54%) and information/cyber security governance (27.08%).

The growing number of conferences from year to year (see Figure 3) is further proof that the concept of assessing the maturity of information/cyber security is becoming increasingly topical. Most conferences (41.67%) were held in Asia, which is consistent with the fact that most authors are of Asian origin.

Figure 3 also shows that before 2019, research articles on the topic of information security/cyber security maturity assessment were quite rare, while afterwards the number of research articles increased steadily. Consequently, this means that the field of information/cyber security maturity assessment is becoming a relevant and important scientific field. The vast majority (77.78%) of journals are indexed with the JCR impact factor. Furthermore, almost 90% (89.28%) of the journals are in the first two quartiles [95]. This confirms that reputable journals are interested in publishing research related to information/cyber security maturity assessment. In terms of JCR subject categories, the largest number of research articles were published in the ‘Computer Science, Information Systems’ category. Given the increasing relevance and rapid advances in information and cyber security, it would be highly beneficial to establish a new bibliographic category specifically for ‘Information/Cyber Security’. This would not only better reflect the specialisation of research, but also encourage more focussed and impactful studies in this area and meet the increasing demand for robust security frameworks across all industries.

6.2. Findings from the Qualitative Synthesis of SLR Results

The qualitative synthesis is one of the most difficult and time-consuming parts of our research, as each of the 36 articles had to be examined in detail. This process was carried out by two independent reviewers. Below we present the main findings, focussing on the answers to research questions RQ2–RQ6.

• RQ2: How can recent studies on ICS MMs be categorised based on their contributions to the development of information/cyber security maturity assessment?

The results of our qualitative synthesis (Table 6) reveal that recent studies on ICS MMs can be categorised into three main groups based on their contributions to the development of information and cyber security maturity assessment: (1) the development of new maturity concepts, (2) the implementation of known maturity concepts in different contexts, and (3) the provision of supporting methodologies or frameworks that enhance the understanding or practical application of maturity models.

The first category comprises 16 of 36 (44%) studies (Table 7). These studies show clear progress towards more adaptable, sector-specific ICS MMs and reflect an evolving understanding of cyber security as a dynamic, ongoing process. The evolution of ICS MMs shows clear trends towards sector-specific customisation, resilience, simplification, and accessibility, as well as intelligence-driven adaptability. While the traditional approach focussed on broad applicability and often offered a one-size-fits-all solution, more recent studies are helping to broaden the field by developing sector-specific models that address the challenges in specific industries. For example, RA3 introduces a vulnerability-focussed cyber security maturity assessment model aimed at improving the security of critical infrastructure, while RA9 presents a holistic cyber security maturity assessment framework designed for higher education institutions. This trend highlights the growing demand for customised approaches that address sector-specific challenges. Some models, such as the CRMM in RA6, go beyond prevention to include organisational resilience—how effectively an organisation can recover from incidents. This recognises the inevitability of attacks and focusses on recovery and adaptability, as opposed to traditional models that emphasise prevention. Studies such as RA13 and RA14 focus on making cyber security assessment simpler and more accessible, especially for smaller organisations with limited resources. These lightweight frameworks fill a gap left by earlier, more complex models and encourage the wider adoption of cyber security best practices. In addition, some models are focussed on data-driven adaptability, integrating real-time threat data to enable dynamic and responsive cyber security assessments. RA18, for example, integrates real-time threat data, making assessments more dynamic and responsive to evolving threats. This adaptability represents a move away from traditional approaches that rely on fixed metrics and addresses the need for continuous adaptation in a rapidly changing cyber landscape.

As we can see from Table 8, 9 out of 36 (25%) articles were categorised in the second category. These studies contribute by demonstrating how established models and frameworks can be applied in real-world scenarios, addressing challenges and offering insights to improve their effectiveness. Several studies in this group are focussed on practical application and sector-specific adaptation. RA7, for example, adapts C2M2 for railway systems and shows how sector-specific needs are integrated into a general framework. Similarly, RA2 and RA8 provide case studies on how existing maturity models or frameworks (e.g., IT-CMF or NIST CSF) are applied in different organisational environments, such as critical infrastructures or SMEs. These implementations emphasise the versatility of established models and prove their usefulness in different industries. Some studies go beyond mere application by refining these frameworks. RA11, for example, develops a cyber security evaluation tool (CET) based on the NIST CSF and improves it for use in SMEs by simplifying the model for smaller organisations with limited resources. Similarly, RA20 integrates systems thinking into a cyber security resilience framework and refines its approach to incorporate broader organisational processes. The studies in this group also highlight the practical challenges in implementing existing maturity models. RA10 discusses the difficulties organisations face in integrating socio-technical aspects into security assessments and emphasises the need for a more holistic approach that considers both technical and human factors. RA27 focusses on cyber security culture, identifying it as a critical but often overlooked component of maturity assessments and offering a unique insight into the cultural challenges faced by organisations. 9 out of 36 (25%) articles were categorised in the second category. These studies contribute by showing how established models and frameworks can be applied in real-world scenarios, addressing challenges and providing insights to improve their effectiveness. Several studies in this group are focussed on practical application and sector-specific adaptation. RA7, for example, adapts C2M2 for railway systems and shows how sector-specific needs are integrated into a general framework. Similarly, RA2 and RA8 provide case studies on how existing maturity models or frameworks (e.g. IT-CMF or NIST CSF) are applied in different organisational environments, such as critical infrastructures or SMEs. These implementations emphasise the versatility of established models and prove their usefulness in different industries. Some studies go beyond mere application by refining these frameworks. RA11, for example, develops CET based on the NIST CSF and improves it for use in SMEs by simplifying the model for smaller organisations with limited resources. Similarly, RA20 incorporates systems thinking into a cyber security resilience framework and refines its approach to include broader organisational processes. The studies in this group also highlight the practical challenges of implementing existing maturity models. RA10 discusses the difficulties organisations face in integrating socio-technical aspects into security assessments and emphasises the need for a more holistic approach that incorporates both technical and human factors. RA27 focuses on the culture of cyber security, which is identified as a critical but often overlooked component of maturity assessments and provides a unique insight into the cultural challenges faced by organisations.

The focus of studies in the third group (see Table 9) is generally on analysing gaps, limitations, or challenges in cyber security maturity models and proposing theoretical insights or methodological improvements. Some studies in this group critically evaluate existing maturity models and identify areas for improvement. RA27, for example, emphasises the importance of assessing an organisation’s cyber security culture, a dimension that is often overlooked in traditional maturity models. The authors highlight how cultural maturity directly impacts the effectiveness of cyber security strategies, and call for models that integrate these softer, human-centred aspects. Other studies, such as RA21, examine practitioners’ skills in evaluating information security controls. This article demonstrates that there are inconsistencies in the measurement of security maturity across organisations, pointing to the need for standardised and more precise evaluation procedures. RA10 contributes to this discussion by focussing on the difficulties that organisations face in integrating socio-technical factors into their maturity assessments, showing that a purely technical evaluation often fails to capture the full picture of an organisation’s cyber security readiness. This group also includes articles that point to areas that should be explored in the future. RA30, for example, highlights the impact of the Cyber Trust Program on government cyber security maturity and points to the need for further study on how such programmes can improve maturity in other sectors. Similarly, RA27 and RA21 point to gaps in current maturity models that require more attention, particularly regarding cultural and human factors, thus offering directions for future research.

• RQ3: In which sectors and industries have ICS MMs been applied most effectively and what type of organisations have found the concept of information/cyber security maturity assessment useful?

The results of the qualitative synthesis in Table 10 show that ICS MMs have been applied across a wide range of sectors, industries, and organisation types, particularly where cyber security is critical to business continuity and risk management. Key sectors where ICS MMs have proven successful include critical infrastructure, healthcare, education, and SMEs. These industries benefit from maturity assessments due to their high exposure to cyber threats, regulatory pressures, and the need to protect sensitive data.

Critical infrastructures, including railways, energy, utilities, and cyber-physical systems, have benefited significantly from ICS MMs such as the C2M2. These models help to improve resilience and preparedness against cyber threats, especially in high-risk sectors where business continuity is essential (RA3, RA4, RA7, RA35). The success of ICS MMs in these areas demonstrates their value in sectors where risk mitigation and security are prioritised due to the potential for serious disruption.

Government institutions have also found ICS MMs to be effective, using models such as the Cyber Trust Program (CTP) and tailored Capability Maturity Model Integration (CMMI) to improve incident response capabilities and ensure compliance with international standards. The ability of these models to improve both resilience and compliance demonstrates their adaptability in public sector organisations (RA18, RA20, RA30).

Furthermore, the healthcare sector has effectively utilised ICS MMs, particularly to comply with regulations and protect sensitive patient data. RA25 introduces an ISMM designed specifically for healthcare organisations to address the challenges of data security in a highly regulated environment. Lessons learned from recent security incidents, such as the WannaCry ransomware incident in May 2017, which crippled transport and other government systems worldwide and forced the UK healthcare system to turn away patients even though no patient data were compromised, show that such incidents not only have the potential to inflict financial loss on individuals and organisations, but also pose a very real threat to healthcare facilities in fulfilling their critical mission of patient care [96]. Therefore, due to compliance requirements such as HIPAA, healthcare organisations have determined that ICS MMs are essential to ensuring the confidentiality, integrity, and availability of sensitive data.

Higher education institutions facing challenges in balancing openness and security have also successfully applied ICS MMs, such as the HCYMAF. These models help universities protect research data and respond to the growing complexity of cyber threats in the academic environment (RA9, RA19).

The results of our analysis show that SMEs also benefit from cyber security maturity models, especially when these models are tailored to their unique constraints. RA11 presents a cyber security evaluation tool based on the NIST CSF to help SMEs improve their security posture despite limited resources. RA13 and RA14 develop lightweight models to support risk management in SMEs and show that even smaller organisations can use maturity models effectively if they are tailored to their needs.

• RQ4: What are the key drivers for ICS MMs adoption?

The authors point out several key factors that motivate organisations to introduce and implement ICS MMs in different industries. The most influential factors are summarised in Table 11.

One of the strongest drivers is regulatory compliance, especially in sectors such as healthcare and finance, where strict data protection laws and regulations apply. For example, RA25 highlights the need for healthcare organisations to comply with regulations such as HIPAA, which is driving the adoption of ICS MMs to ensure compliance with data security standards. Similarly, RA30 emphasises regulatory requirements in government institutions where cyber security compliance is mandatory.

Resilience to cyber threats is another important factor, especially in sectors such as critical infrastructure. RA3 and RA7 show how the implementation of maturity models in critical infrastructure sectors increases resilience to cyber threats. These sectors, which are vital to national security and economic stability, require robust cyber security measures to protect against evolving threats. ICS MMs help these organisations assess their vulnerabilities and improve their ability to detect, respond to and recover from cyber incidents.

Data protection is an important concern for organisations that handle sensitive information, such as healthcare providers and educational institutions. RA9 and RA19 show that universities and research organisations apply maturity models to protect sensitive research data and personal information. Similarly, RA25 addresses the importance of data protection in healthcare, where data breaches can have serious consequences for patient privacy and safety. The need to protect sensitive information is a strong motivator for the adoption of maturity models that improve data security practices.

Risk management and risk mitigation are also important drivers for the adoption of ICS MMs, especially in sectors that are constantly exposed to cyber risks. RA11, RA13, and RA36 emphasise that organisations are adopting maturity models to manage cyber risks more effectively and implement targeted risk mitigation strategies. SMEs, which may not have the resources to develop internal risk management capabilities, are adopting simplified maturity models to manage their cyber security risks cost-effectively.

Another important driver is the need to ensure business continuity in the face of cyber threats. RA7, RA3, and RA35 highlight that industries such as transport, energy, and finance are adopting maturity models to ensure that they can maintain their operations during and after a cyber incident. Ensuring business continuity is essential in sectors where an unplanned downtime could lead to serious economic or societal disruption.

Finally, the introduction of maturity models is often driven by the need for cost-effective security solutions. RA13 and RA11 show how SMEs are adopting lightweight maturity models that provide a structured approach to cyber security without the high costs typically associated with more comprehensive models. The ability to implement effective cyber security practices without significant financial investment is therefore one of the key factors for the adoption of ICS MMs in resource-constrained environments.

• RQ5: What are the main gaps or limitations that the authors have identified regarding the implementation of ICS MMs in organisations?

As can be seen from Table 12, the authors identified several gaps and limitations in the implementation of ICS MMs in organisations. Overcoming the challenges listed will be crucial for improving the usability and effectiveness of ICS MMs in various industries.

One of the most frequently mentioned barriers is limited resources, especially in SMEs. RA1, RA11, and RA13 emphasise that smaller organisations often struggle with the financial, human, and technical resources required to implement comprehensive maturity models. These organisations tend to have limited expertise in information and cyber security, making it difficult to apply complex models. This scarcity of resources is exacerbated by the need for ongoing assessments and improvements, which smaller organisations may find burdensome.

The complexity of models is another issue. RA11 and RA16 note that some ICS MMs are overly complex, making them difficult to understand and implement, especially for organisations with limited technical resources. These complex models may require a high level of information/cyber security maturity before an organisation can begin the assessment process, which can be a significant barrier for many organisations.

Another limitation is the lack of practical guidance on how to effectively implement and utilise ICS MMs. RA25 and RA26 emphasise that while many maturity models provide a conceptual framework, they do not provide the detailed guidance that organisations need to take concrete steps to improve their cyber security posture. This can lead to organisations not knowing how to prioritise and apply the recommendations resulting from maturity assessments, which reduces the effectiveness of these models.

Another challenge is the customisation of ICS MMs to specific sectors. RA7, RA25, and RA9 point to the need for sector-specific adaptations of maturity models, as generic models often do not meet the specific requirements of industries such as healthcare, higher education, and critical infrastructure. The lack of customised models limits the relevance and applicability of maturity assessments in these sectors.

In addition, another challenge is to harmonise maturity models with corporate goals. RA36 and RA13 point out that it can be difficult for organisations to align cyber security maturity goals with broader business goals such as cost reduction or operational efficiency. If maturity models are not aligned with an organisation’s strategic priorities, information/cyber security initiatives may be seen as a drain on resources rather than an enabler of the business. This misalignment can reduce executive commitment to supporting the necessary information/cyber security investments.

The lack of automation and tool support is another limitation identified in the literature. RA11 and RA31 mention that the manual processes required for many maturity assessments are time consuming and prone to human error. Organisations need automated tools that can streamline the assessment process and monitor the progress of information/cyber security maturity in real time. Without such tools, implementing ICS MMs can become a resource-intensive task, reducing their attractiveness to organisations.

Finally, the inconsistent metrics and evaluation criteria used across different maturity models pose a challenge for organisations attempting to benchmark their cyber security posture. RA21 and RA24 highlight the lack of standardisation in the way maturity is assessed, which can make it difficult for organisations to compare their results with industry standards or with the results of similar organisations. This inconsistency undermines the effectiveness of maturity models as a tool for measuring progress over time or against competitors.

Despite the many identified gaps or limitations in the implementation of ICS MMs, we agree with the assertions of many previous studies that information and cyber security maturity models can help organisations assess their capabilities, create a roadmap or action plan, and improve their progress in information/cyber security governance and management processes (see, e.g., [60,97,98]).

• RQ6: What opportunities and future research directions in the field of information/cyber security maturity assessment have the authors identified?

The area of information and cyber security maturity assessment is still evolving, and several opportunities and future research directions have been identified in the literature. These findings are summarised in Table 13.

One of the main opportunities identified is the need for empirical validation of the models. Many of the conceptual maturity models that have been developed in recent years have not been rigorously tested in real-world environments. Studies such as RA6, RA9, and RA15 call for more empirical research to validate the effectiveness of these models in improving information/cyber security practices. Empirical validation would not only increase the credibility of the models, but also provide valuable feedback to refine and improve their design. Table 13 highlights several studies that emphasise the importance of empirical testing for progress in this area. Furthermore, this problem has already been emphasised by some authors in previous systematic literature reviews in the field of information and cyber security assessment (e.g., [53,79]).

As mentioned in earlier sections, another important research direction is the adaptation of maturity models to specific industries. RA7, RA9, and RA25 indicate that more sector-specific adaptations of maturity models are needed. Future research should therefore focus on the development of sector-specific maturity models and frameworks that meet the specific regulatory, technical, and operational requirements of different industries. However, [99] emphasises the need to support SMEs with tailored models that are more situational and can adapt to their specific needs. An adaptable maturity model has a higher value, because the resulting capabilities and areas for improvement match the expectations and characteristics of SMEs [100]. All this evidence confirms our assumptions about the lack of suitable ICS MM concepts for SMEs and open ideas for future research, which should continue to focus on developing models that are accessible to smaller organisations without compromising the robustness of maturity assessment.

The integration of emerging technologies into maturity models is another important area for future research. RA28 and RA32 discuss the need to incorporate technologies such as cloud computing, artificial intelligence, and blockchain into maturity assessments. These technologies are becoming increasingly important for managing cyber security risks, but many existing maturity models do not consider their unique challenges and opportunities. Research in this area would help ensure that maturity models remain relevant in a rapidly evolving technological landscape.

There is also a great opportunity to develop automated tools that support the implementation of maturity models. RA11 and RA31 highlight the potential benefits of automation by streamlining the assessment process, reducing human error, and enabling real-time monitoring of information/cyber security maturity. The development of automated tools would make it easier for organisations to adopt and maintain maturity models, especially in industries with limited information/cyber security resources. This could also help solve the problem of manual, time-consuming assessments, as described in RA11.

In addition to these technical opportunities, future research could focus on simplifying models for SMEs. RA13, RA14, and RA1 emphasise the need for maturity models that are accessible to smaller organisations with limited resources. Developing lightweight, cost-effective models that SMEs can easily adopt would broaden the applicability of maturity assessments and provide smaller organisations with the tools they need to improve their cyber security posture.

Finally, there is an opportunity to focus on cross-organisational comparisons by standardising the metrics and evaluation criteria used in maturity assessments. Significant differences in maturity levels across organisations have been identified, which calls for more consistent assessment and more precise definitions of maturity levels [6,65,101]. RA21 and RA24 call for more research to develop standardised metrics that would allow organisations to compare their information/cyber security maturity across industries and regions. This would increase the value of maturity models as benchmarking tools and provide organisations with better insight into their cyber security performance compared to their peers.

While this study provides a broad perspective on the assessment of information and cyber security maturity, we recognise that the depth of analysis for each sub-sector is limited by the scope of this review. Sub-sectors such as critical infrastructure, healthcare, or SMEs, as shown in Table 10, deserve specific studies to examine their particular challenges and requirements. Future research should build on this foundation to provide deeper, sector-specific insights to further improve our understanding of cyber security maturity.

7. Conclusions

This study provides critical insights into the drivers, challenges, and future opportunities for information and cyber security maturity. Our findings from qualitative synthesis (especially RQ4–RQ6) reveal that regulatory compliance, cyber threat resilience, and the demand for cost-effective solutions are the main drivers for the adoption of maturity models across various industries. However, significant challenges remain, including model complexity, insufficient sector-specific customisation, and limited resources, particularly for SMEs.

Future research should prioritise the development of simplified, adaptable frameworks tailored to specific sectors, with a focus on SMEs. Integrating emerging technologies such as AI, cloud computing, and automation into maturity models will improve their adaptability and responsiveness to evolving cyber threats. In addition, efforts to empirically validate these models in real-world environments will strengthen their credibility and practical relevance.

By bridging these gaps, maturity assessments can help organisations improve their resilience, align their security efforts with business objectives, and manage the complexity of digital transformation. This study highlights the critical role of information and cyber security maturity in driving organisational security and resilience and paves the way for wider adoption and innovation in this area.