Comparative analysis ofmaturity models to evaluate information security

Abstract

Information security can be defined as: the protection of information assets by processing risks of violating the confidentiality, integrity and availability of information that is processed, stored and transmitted between interconnected information systems; and a process that includes preventing, detecting and responding to information security threats. In world practice, the concept of maturity model is used to determine the stage of organizational and technological development of an organization and its processes. To measure the state of the process, a set of metrics is used that represent certain characteristics. Evaluation of these metrics according to the established scale shows the state of the processes, which will characterize the level of their maturity. In world practice, in contrast to Ukrainian practice, the application of the maturity model for managing information security processes is widespread. An example of this is the ISO27000 series of standards that governs information security management issues implemented on the basis of the Information Security Management System. Obviously, before an organization engaged in information security management, sooner or later the question arises of how to fulfill these requirements, to what extent and at what level of detail, etc. Maturity model can help to answer these and other questions, on the basis of which the level of maturity of information security processes will be evaluated. To identify the main models of information security maturity, an analysis of open sources and best practices related to information security maturity models was carried out. Based on the results of the analysis of the sources, the most applicable models of information security maturity were determined, namely: SSE-CMM, C2M2, NICE and OISM3.