An ISMS (Im)-Maturity Capability Model

Capability maturity models have been used to assess and guide process improvement initiatives for everything from software development to systems engineering, product acquisition, team management and information security to name a few. These models are based on process improvement and provide a framework to guide and measure the implementation and improvement of processes. In all of these models, the higher the level an organisation is assessed, the better (in theory) the organisation is at defining, assessing and improving their process capability This paper proposes a unique process maturity model for assessing the capability and maturity of processes that affect Information Security Management System (ISMS) within an organisation. The model describes nine levels of process maturity, four of which are below the existing five levels defined in most popular models.