Conceptual Design of a Cybersecurity Resilience Maturity Measurement (CRMM) Framework
Date
2019-05-28
Authors
Mbanaso, Uche M.
Abrahams, Lucienne
Apene, Oghenevovwero Zion
Journal Title
Journal ISSN
Volume Title
Publisher
LINK Centre, University of the Witwatersrand (Wits), Johannesburg
Abstract
African countries are at high risk with respect to cybersecurity breaches and are
experiencing substantial financial losses. Amongst the top cybersecurity frameworks,
many focus on guidelines with respect to detection, protection and response, but few
offer formal frameworks for measuring actual cybersecurity resilience. This article
presents the conceptual design for a cybersecurity resilience maturity measurement
(CRMM) framework to be applied in organisations, notably for critical information
infrastructure (CII), as part of cyber risk management treatment.
The main thrusts of the framework are to establish, through assessment in terms
of quantitative measures, which cybersecurity controls exist in an organisation, how
effective and efficient these controls are with respect to cybersecurity resilience, and
steps that need to be taken to improve resilience maturity. The CRMM framework we
outline is conceptualised as being applicable both pre- and post-cyber attack. Drawing
on the NIST cybersecurity framework (NIST CSF) and other relevant frameworks,
the CRMM approach conceptualised in this article would be able to depict an
organisation’s cybersecurity practices and gauge the organisation’s cybersecurity
maturity at regular intervals. This CRMM approach is grounded in the idea that, by
quantifying an organisation’s current practices against established baseline security
controls and global best practices, the resulting status measurement can provide the
appropriate basis for managing cyber risk in a consistent and proportionate fashion.
The CRMM framework defines four cybersecurity resilience quadrants (CRQs),
which depict four different degrees of organisational preparedness, in terms of both
risk and resilience.
Description
Keywords
cybersecurity, cybersecurity resilience maturity measurement (CRMM), cybersecurity resilience quadrants (CRQs), critical information infrastructure (CII), NIST cybersecurity framework (NIST CSF), cyber risk management, cybersecurity resilience, cybersecurity controls
Citation
Mbanaso, U. M., Abrahams, L., & Apene, O. Z. (2019). Conceptual design of a cybersecurity resilience maturity measurement (CRMM) framework. The African Journal of Information and Communication (AJIC), 23, 1–26. https://doi.org/10.23962/10539/27535