Information security maturity level: A fast assessment methodology

Abstract

In this paper, we propose an entry-level methodology for the determination of an Information Security Maturity Level. The methodology is based on the analysis of three axes and three functional areas (people, processes and technology) and aims to be a first approach, with the simplicity of language and focus on the recipient, for the quantitative measurement of potential security risks. The methodology has been applied in a real context and the results reveals the usefulness of it. The maturity level is simple to understand facilitating the spread of a security awareness culture, while allowing organisations to plan the necessary activities to mitigate the security threats.