A cyclical evaluation model of information security maturity

Abstract

Purpose

This paper aims at presenting a cyclical evaluation model of information security (IS) maturity. The lack of a security evaluation method might expose organizations to several risky situations.

Design/methodology/approach

This model was developed through the definition of a set of steps to be followed to obtain periodical evaluation of maturity and continuous improvement of controls.

Findings

This model, based on controls present in ISO/IEC 27002, provides a means to measure the current situation of IS management through the use of a maturity model and provides a subsidy to take appropriate and feasible improvement actions, based on risks. A case study is performed, and the results indicate that the method is efficient for evaluating the current state of IS, to support IS management, risks identification and business and internal control processes.

Research limitations/implications

It is possible that modifications to the process may be needed where there is less understanding of security requirements, such as in a less mature organization.

Originality/value

This paper presents a generic model applicable to all kinds of organizations. The main contribution of this paper is the use of a maturity scale allied to the cyclical process of evaluation, providing the generation of immediate indicators for the management of IS.

Citation

Alencar Rigon, E., Merkle Westphall, C., Ricardo dos Santos, D. and Becker Westphall, C. (2014), "A cyclical evaluation model of information security maturity", Information Management & Computer Security, Vol. 22 No. 3, pp. 265-278. https://doi.org/10.1108/IMCS-04-2013-0025