## 8 Conclusions and Future Work  
Information security maturity, as assessed by any available maturity model, can be a hard target to reach since the needs and constraints of a given public institution can significantly differ from another, thus resulting in the need to follow different paths toward maturity. As a result, while maturity models provide snapshots of the information security status at a given moment, as well as identifying areas of improvement, the journey to maturity may vary substantially from one institution to another if the characteristics of the institution subject to evaluation is considered. Thus, the AIM Triad provides an overview of the possible paths that may be taken along this road. Since we did not introduce metrics for evaluating the impact of different choices, a comprehensive quality assessment cannot be derived yet at this stage. This aspect will be the subject of a forthcoming article that considers the use of quantitative mathematical models to support recommendations for prioritization. In this sense, we intend to formalize a methodological proposal for prioritizing the implementation of an information security maturity model in the context of public organizations, by customizing this implementation according to their particular characteristics. This formalization will seek to systematize the prioritization strategy, detailing the artifacts, tools, actors, and products. Secondly, we expect to validate our proposal through quantitative and qualitative techniques, such as expert judgment and adoption studies. Finally, the applicability and effectiveness of the strategy will be tested through case studies in authentic contexts, with data from different public institutions. [PERSON] contributed to the writing and development of the manuscript in all its phases. [PERSON] contributed to the methodology and discussions. [PERSON] contributed to the analysis of the results and limitations of the study. [PERSON] contributed to the review of articles. All authors have read and agreed to the published version of the manuscript. This work received partial support from Proyecto DIUFRO DI21-0079 and Proyecto DI-UFRO DI22-0043, Universidad de La Frontera, Temuco. Chile. Not applicable. The authors are extremely grateful to the reviewers for their kind suggestions for improving the overall quality and readability of the paper. The authors declare no conflict of interest. * [54] A New Adaptive Cybersecurity Capability Maturity Model
* [55] A proposed maturity model for Himachal Pradesh government e-Services
* [56] A structured comparison of the corporate information security maturity level
* [57] A technological analysis of Colombia's cybersecurity capacity: a systemic perspective from an organizational point of view
* [58] Addressing SME Characteristics for Designing Information Security Maturity Models
* [59] Adopting security maturity model to the organizations' capability model
* [60] Advanced approach to information security management system utilizing maturity models in critical infrastructure
* [61] An Analysis of Assessment Approaches and Maturity Scales Used for Evaluation of Information Security and Cybersecurity User Awareness and Training Programs: A Scoping Review
* [62] An explanatory review on cybersecurity capability maturity models
* [63] An extended digital forensic readiness and maturity model  
The article suggests a cybersecurity assessment framework for Higher Education Institutes in the UK, which integrates all security and privacy regulations and best practices. The framework can be used for self-assessment or audit purposes and is web-based for benchmarking. Published by MDPI in 2020. In this study published by Springer Nature Switzerland AG in 2019, a maturity model is validated to measure an organization's ability to escalate IT-related security incidents. Three Swedish health organizations use a self-assessment tool and incident managers are interviewed.