A Model for Implementing a Cybersecurity Maturity Model in Government Organizations

Abstract

The purpose of this study was to develop a model for implementing a cybersecurity maturity model in government organizations. In terms of purpose, the study was applied research, and in terms of methodology, it adopted an exploratory approach. The study population consisted of 13 information technology and cybersecurity managers from selected organizations who either held a doctoral degree or were doctoral candidates. Participants were selected using purposive and snowball sampling methods, and sampling continued until data saturation was achieved. The participants included 7 men and 6 women; 8 were under the age of 40 and 5 were over the age of 40. All participants had academic backgrounds in information security, information technology management, or computer engineering. Data were collected through semi-structured interviews totaling approximately 20 hours. To ensure validity, the interview questions were reviewed and refined by two university professors and three cybersecurity experts. Reliability was assessed using the test–retest method with an interval of 5 to 14 days and the participation of two experts, resulting in an overall reliability coefficient of 74.36%. Using qualitative content analysis, the interview data were analyzed through a systematic process. In the first stage, open coding was conducted, and after eliminating irrelevant data, 190 meaningful statements and conceptual codes were extracted. In the subsequent stage, these concepts were categorized into 26 thematic categories based on semantic and conceptual similarities. Finally, the categories were organized into 10 major themes, including strategic management and security planning, security education and awareness, risk assessment and management, security technologies and infrastructures, information and data security, network and communications security, access and control management, incident response and security improvement, organizational collaboration and communications, and customization and adaptability of solutions. This analytical process led to the development of a comprehensive model encompassing multiple dimensions of cybersecurity management.