For example, the ISO/IEC 27000 family includes practices such as incorporating information security clauses into administrator contracts or continuous training of technical teams. Committing to an information security standard means having an organizational structure that supports political and top management roles and technical and operational roles. Using a maturity model suggests that the organization is taking a structured approach to improving its processes, procedures, or practices. It means that stakeholders and actors recognize the relevance of developing specific actions or practices, establish standards and norms with which they guide and evaluate their actions, methods, and strategies, and generate adjustments, changes, and innovations that enable improvements in procedures, techniques, technologies, capabilities, and efficacy. In the literature, there are various proposals and applications of maturity models aimed at improving the information security of computer systems in organizations, which implies the need for qualified personnel in security assurance and protection, as well as continuous training and education in security matters [8; 20]. However, the latter is difficult to implement, and many organizations may easily fall victim to attacks that materialize without having the necessary control and knowledge to isolate and counter such attacks on information assets [3]. Deciding on a maturity model for an organization can be complicated due to its multifaceted nature. It covers various areas within the organization, making it difficult to determine where to begin implementing it [23]. The organization may have to deal with multiple models simultaneously, which can be overwhelming and hinder the identification of critical areas needing improvement [24]. Moreover, each maturity model has its requirements, which may require significant changes in the organizational culture, processes, and work practices [25]. Therefore, determining where to start an implementation process of maturity models can be a highly complex task [25; 26]. This article explores some challenges public or government entities face while seeking to implement Information Security Maturity Models. We identify some critical areas that should be considered in any attempt at prioritization while developing a plan considering each organization's specific resources and limitations. As a result, the maturity models implemented are relevant but also efficient and effective since prioritization for investment in information security resources, which supports improved decision-making at the institutional level, becomes an asset for those institutions. A prioritization strategy that allows institutions to navigate the jungle of indicators associated with maturity models presents tangible benefits and adds value to the planning and design work in a subject as sensitive as Information Security. In order to propose a prioritization strategy regardless of a given maturity model, we adopted a procedure validated in the literature, in which we first consider the review of available maturity models through a systematic mapping, from which the common core elements specifically related to Information Security are extracted and grouped in a diagram to visualize the different possible paths in the process of improving the maturity levels. The article is structured as follows: In Section 2, we explore some of the challenges that public or government entities face while seeking to implement Information Security Maturity Models. Section 3 presents some related work on maturity models for governmental institutions and presents relevant features of some internationally renowned maturity models. In Section 4, we adopt a general methodology for developing maturity models, which helps us identify the necessary characteristics for proposing the prioritization idea. In Section 5, we developed the stages defined in the methodology to generate our strategy. Finally, in Section 6, we describe our proposal for the prioritization strategy.