SciELO - Scientific Electronic Library Online

vol.23Asymmetry in South Africa's Regulation of Customer Data Protection: Unequal Treatment between Mobile Network Operators (MNOs) and Over-the-Top (OTT) Service ProvidersA Proposed "Agricultural Data Commons" in Support of Food Security author indexsubject indexarticles search
Home Pagealphabetic serial listing  

Services on Demand



Related links

  • On index processCited by Google
  • On index processSimilars in Google


The African Journal of Information and Communication

On-line version ISSN 2077-7213
Print version ISSN 2077-7205


MBANASO, Uche M.; ABRAHAMS, Lucienne  and  APENE, Oghenevovwero Zion. Conceptual Design of a Cybersecurity Resilience Maturity Measurement (CRMM) Framework. AJIC [online]. 2019, vol.23, pp.1-26. ISSN 2077-7213.

African countries are at high risk with respect to cybersecurity breaches and are experiencing substantial financial losses. Amongst the top cybersecurity frameworks, many focus on guidelines with respect to detection, protection and response, but few offer formal frameworks for measuring actual cybersecurity resilience. This article presents the conceptual design for a cybersecurity resilience maturity measurement (CRMM) framework to be applied in organisations, notably for critical information infrastructure (CII), as part of cyber risk management treatment. The main thrusts of the framework are to establish, through assessment in terms of quantitative measures, which cybersecurity controls exist in an organisation, how effective and efficient these controls are with respect to cybersecurity resilience, and steps that need to be taken to improve resilience maturity. The CRMM framework we outline is conceptualised as being applicable both pre- and post-cyber attack. Drawing on the NIST cybersecurity framework (NIST CSF) and other relevant frameworks, the CRMM approach conceptualised in this article would be able to depict an organisation's cybersecurity practices and gauge the organisation's cybersecurity maturity at regular intervals. This CRMM approach is grounded in the idea that, by quantifying an organisation's current practices against established baseline security controls and global best practices, the resulting status measurement can provide the appropriate basis for managing cyber risk in a consistent and proportionate fashion. The CRMM framework defines four cybersecurity resilience quadrants (CRQs), which depict four different degrees of organisational preparedness, in terms of both risk and resilience.

Keywords : cybersecurity; cybersecurity resilience maturity measurement (CRMM); cybersecurity resilience quadrants (CRQs); critical information infrastructure (CII); NIST cybersecurity framework (NIST CSF); cyber risk management; cybersecurity resilience; cybersecurity controls.

        · text in English     · English ( pdf )


Creative Commons License All the contents of this journal, except where otherwise noted, is licensed under a Creative Commons Attribution License