Advancing cyber resilience: A novel framework for assessing cyber security capability maturity

In today's dynamic digital landscape, organisations face an ever-growing array of cyber threats that jeopardise operations, compromise sensitive data, and cause severe financial and reputational damage. A critical challenge lies in the lack of a comprehensive understanding of cybersecurity capabilities, often leading to fragmented and ineffective defence strategies. Cybersecurity Capability Maturity Models (CCMMs) have emerged as a structured approach to assessing and improving an organisation’s cybersecurity posture. However, existing CCMMs suffer from limitations, including rigid structures, a one-size-fits-all methodology, complexity, security scope gaps across technological, organisational, and human dimensions, and the absence of robust quantitative metrics. These shortcomings hinder adaptability and result in incomplete or inconsistent assessments across diverse organisational contexts. To bridge this gap, we propose a novel Cybersecurity Capability Maturity Framework—a holistic, flexible, and quantifiable approach designed to provide organisations with a more actionable and context-aware assessment. By addressing existing limitations, our framework empowers organisations to advance their cyber resilience, enabling more effective risk management and sustainable cybersecurity maturity growth.

Overview: Organisations operate in a rapidly evolving digital landscape where technological advancements introduce both opportunities and escalating cyber threats. Despite growing risks, many organisations lack a clear understanding of their cybersecurity capabilities, leaving them vulnerable to attacks. Without a structured approach to assess their security posture, organisations may overlook critical weaknesses, increasing their exposure to cyber threats.

Cybersecurity Capability Maturity Models (CCMMs) offer a structured framework to evaluate and enhance cybersecurity readiness. Unlike compliance-focused frameworks such as NIST CSF or ISO/IEC 27001, CCMMs provide a progressive roadmap to measure maturity, identify gaps, and drive continuous improvement. However, existing CCMMs have several limitations. Many adopt a one-size-fits-all approach, failing to accommodate diverse organisational needs, risk profiles, and resource constraints. Additionally, they often lack a holistic perspective, focusing on technical aspects while neglecting organisational, operational, and human factors such as employee training, collaboration, and business continuity planning. These gaps create blind spots, leaving organisations exposed to evolving threats.

Moreover, the complexity and rigidity of existing CCMMs hinder their adoption, making implementation costly and time-consuming. The lack of quantitative metrics further limits organisations' ability to measure cybersecurity effectiveness, track progress, or secure funding for improvements. These shortcomings weaken an organisation’s ability to build resilience and respond effectively to cyber threats.

To address these challenges, this study proposes a novel Cybersecurity Capability Maturity Framework (CCMF) that is holistic, flexible, and measurable. Developed using a Design Science Research (DSR) approach, the CCMF integrates insights from literature, expert feedback, and real-world validation to ensure practical applicability. This research aims to provide organisations with a more adaptive and impactful cybersecurity assessment, strengthening their ability to enhance cyber resilience.

Research Question:

How can a cybersecurity capability maturity framework be designed to provide a more adaptable, holistic, and quantifiable assessment for organisations?