# On Data Leakage Prevention Maturity: Adapting the C2M2 Framework
## 2 Materials and Methods
### Concepts
#### 2.4.1 Selection of a Suitable Maturity Framework  
Leveraging an existing model proved advantageous due to its well-established nature, reducing the likelihood of overlooking crucial aspects. Established models not only come with extensive literature and practical examples but also with supporting tools for implementation and documentation, thus offering a solid foundation for a DLP Maturity Model.  
After careful comparison, as detailed in Table 2, we selected the Cybersecurity Capability Maturity Model (C2M2). This model was chosen for its synergistic alignment with the methodologies of NIST and its own comprehensive scope.  
While considering other models, C2M2 emerged as the most fitting due to several factors. ISO/IEC 21827 [50], though significant, is somewhat dated, having not been updated since 2008. The Cybersecurity Maturity Model Certification (CMMC), heavily oriented towards the U.S. Department of Defense, presents limitations in a broader industrial context. In contrast, ISACA's CMMI, not being publicly accessible, restricts its applicability. The popularity and well-established nature of C2M2, as indicated in [49], offer a proven track record of reliability and effectiveness crucial for a robust DLP maturity framework.  
Moreover, the absence of extensive scientific implementation experiments for many models, noted in [15], necessitated a choice that best aligns with DLP's unique demands. The historical reliability and experience offered by C2M2, coupled with its adaptability to specific sector needs, make it a suitable model for this purpose. The adaptation of general models to specific cybersecurity challenges, such as incident management as mentioned in [51], further reinforces the practical and academic viability of tailoring C2M2 for DLP.  
In summary, the selection of C2M2 for DLP in critical infrastructures is justified by its industry-specific focus, detailed cybersecurity practices, modular structure, and compatibility with other standards. Its practical orientation, implementation focus, and proven track record make C2M2 an ideal choice for organizations seeking a robust, adaptable, and effective approach to data leakage prevention.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline  & **C2M2** & **ISO/IEC 21827** & **CMMC** & **CMMI** \\ \hline
**Update Frequency** & Regular updates to align with evolving cybersecurity threats. & Last updated in 2008. & Regularly updated. & Regularly updated. \\ \hline
**Industry Focus** & Broad and adaptable to different sectors, making it suitable for a wide range of industries. & Broad and adaptable to different sectors, making it suitable for a wide range of industries. & Primarily for U.S. Department of Defense contractors, limiting broader applicability. & Broad but restricted due to accessibility. \\ \hline
**Standards Compatibility** & Highly compatible with NIST’s methodologies, ensuring a comprehensive and synergistic approach. & Compatible with the ISO ISMS approach. & Oriented towards suppliers and their cybersecurity maturity. & Unknown due to limited accessibility. \\ \hline
**Proven Track Record** & Well-established with a proven track record of reliability and effectiveness in various sectors. & Lacks extensive scientific implementation experiments due to its last update in 2008. & Track record for third-party security audits. & Maturity levels from this framework are well-established. The rest has restricted applicability due to limited accessibility. Further materials have a restricted applicability due to limited accessibility. \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparison of maturity frameworks.