# The Cybersecurity Focus Area Maturity (CYSFAM) Model
## 2 Related Work
### Information Security and Cybersecurity Maturity Models  
Previous studies have investigated information security and cybersecurity maturity models [26; 27; 28]. These maturity models have different focuses according to their purpose and target. Some examples of purpose and target for the existing maturity models are critical infrastructures, generic organisations, and cybersecurity workforce planning [29]. Among the information security and cybersecurity maturity models in the literature, ISFAM [15] is the only focus area maturity model, and it is based on widely-implemented industry standards. This model is elaborated upon in Section 2.5. There is no previously developed focus area cybersecurity maturity model in literature. We believe the capability interdependency presentations in focus area maturity models have the benefit of providing organisations with guidance for capability implementation planning. In Table 2, we present the comparison of several information security and cybersecurity maturity models. The list of the maturity models presented in Table 2 is as follows:  
* CYSFAM: The Cybersecurity Focus Area Maturity Model introduced in the present paper. * C2M2: Cybersecurity Capability Maturity Model [30]. * SSE-CMM: System Security Engineering Capability Maturity Model [31]. * NICE: National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework [32]. * O-ISM3: The Open Group Information Security Management Maturity Model [33]. * ISFAM: The Information Security Focus Area Maturity Model [15]. The features in Table 2 are briefly explained as follows:  
Cybersecurity-focused: This feature shows whether the maturity model is designed to cover the cybersecurity domain. It is obvious for the information security maturity models that they are not focused on cybersecurity but information security. FAM or CMM: This feature shows whether the maturity model is of focus area maturity model type (FAM) or capability maturity model type (CMM). Target sector: This feature shows whether the maturity model's target audience is a specific sector or any generic organization. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Security Domain/Topic** & **Standard** & **Reference** \\ \hline \multirow{3}{*}{Information security} & ISO/IEC 27001:2013—Information technology—Security & [20] \\  & techniques—Information security management & [21] \\  & systems—Requirements & \\ \multirow{3}{*}{Cybersecurity} & ISO/IEC 27032:2012—Information technology—Security & [17] \\  & techniques—Guidelines for cybersecurity & \\ \multirow{3}{*}{Network security} & ISO/IEC 27033-1:2015—Information technology—Security & [21] \\  & techniques—Network security—Part 1: Overview and concepts & [22] \\ \multirow{3}{*}{Application security} & ISO/IEC 27034-1:2011—Information technology—Security & [22] \\  & techniques—Application security—Part 1: Overview and concepts & [23] \\  & ISO/IEC 27035-1:2016—Information technology—Security & [23] \\ \multirow{3}{*}{Incident management} & techniques—Information security incident management—Part 1: & [23] \\  & Principles of incident management & \\ \multirow{3}{*}{Supplier relationships security} & ISO/IEC 27036-1:2014—Information technology—Security & [24] \\  & techniques—Information security for supplier relationships—Part 1: & [24] \\ \multirow{3}{*}{Privacy} & Overview and concepts & \\  & ISO/IEC 29100:2011—Information technology—Security & [25] \\ \cline{1-1}  & techniques—Privacy framework & [25] \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Cybersecurity standards for generic organisations published by ISO [19].