A Design of Information Security Maturity Model for Universities Based on ISO 27001

BackgroundToday's organizations do not hesitate to invest their share in the fields of Information Technology due to benefits accrued in utilization of technology infrastructure.This is done as an effort to get the convenience and benefits of the use of information technology, which is expected to help the performance of the company to conduct a competitive business strategy (Clinton, 2019).Information technology is a very important requirement for all enterprise organizations because it helps in improving the effectiveness and efficiency of enterprise business processes (Singla, 2019).Because of the benefits accrued in adoption and use of technology and the need to gain competitive advantage Organizations have begun to realize and start doing information security performance evaluation.In not more than two decades ago organizations have begun Identifying, planning, scheduling and implementing information security management as an organizational framework (Kerzner, 2019).In evaluation of information technology, there have been several frameworks that have been widely accepted and proven such as The British Standard for information security management (BS7799) later, International Standards Organization (ISO 27001 & ISO 17799), IETF security architecture (Internet Engineering Task Force), the National Institute of Standards and Technology (NIST 800 series special publications), Control Objectives for Information and related Technologies (COBIT), and Committee of Sponsoring Organizations (COSO) are some of the most prominent initiatives in management of information security and risk management systems (Rhodes-Ousley, 2013; Veljkovic, & Budree, 2019, 2012; Information Systems Audit and Control Association (ISACA), 2012; The ISO 27000 directory, 2007; Yost, 2007; Bowen et al., 2006).The different standards and information security frameworks that are already existing have been helpful to organizations for efficiency in information security risk management (Khouja et al., 2018).However, because of proliferation of the cyber space and more continued reliance on information and related technologies in operations of organizations, has led to elevated levels of information security requirements ( Moulton & Coles, 2003; Posthumus & Solms, 2004; Kooper, Maes, & Lindgreen, 2011; Bahl & Wali, 2014; Edwards, 2018) in view of continued information security needs and ever changing information security landscape, the existing processes and governance structures still appear to be unfit, unstructured, and unreliable. Statement of the ProblemThe need for organizations to adopt information security so as to thrive in today's business environment that is highly technical is indisputable.There are only a few studies focusing towards achieving the right blend of factors that contribute to achieving a secure information technology infrastructure and gaining towards maturity especially in a dynamic organizational environment.Despite such many certification standards and information security frameworks in place, concerns have been raised on the effectiveness of such alignment and information security audit and governance being viewed as an unmanageable mechanism (Laeeq, & Memon, 2018), because individually none of them, on their own, are standalone frameworks but they all have a useful role in the efficient management of IT operations.In addition, there