Developing a Maturity Model for Information Security Awareness Using a Polytomous Extension of the Rasch Model

Abstract

Advancing digitization in companies leads to increased significance of information and its security. Since people play a crucial role in protecting information, it is important to sensitize them to information security. Many companies struggle with raising the so-called information security awareness (ISA) in a planned and targeted way. A maturity model (MM) for ISA can help companies to carry out an assessment of the current state regarding ISA and thereby actively manage and plan their future ISA measures. The proposed MM has five maturity levels that were determined mathematically with the help of a polytomous extension of the Rasch model and a hierarchical cluster analysis. Required data for the calculations has been gathered through a survey among 105 organizations. The evaluation has shown that the MM is well-suited to identify strengths and weaknesses with regard to ISA within organizations.