## 5 Towards an Information Security Roadmap
### Systematic Mapping
#### 5.2.8 Results and Analysis  
The following is a solution to the research questions posed above. RQ1: How many studies address maturity models as tools for assessing information security or cybersecurity? We found sixty papers discussing Information Security maturity models from 2017 to 2022. All sixty papers discuss the use of maturity models to evaluate cybersecurity or information security, with thirty-four proposing a maturity model for a specific context in cybersecurity or information security, twenty-three applying maturity models to evaluate cybersecurity or information security, and twenty-nine being studies or literature reviews of maturity models in cybersecurity or information security (see Figure 4). None of the papers provided prioritization strategies. Table A1 in Appendix A depicts and summarizes the articles selected for review. Figure 3: Search execution and filtering summary. RQ2: How many of them develop proposals in the field of governmental (public) institutions? We have identified only three works that propose a maturity model for cybersecurity or information security in e-government services, which we review below. In [42], the authors propose a maturity model for the existing e-services of Himachal Pradesh to provide a basis for developing improved electronic services for citizens to access. The authors present a classification of four maturity levels. However, the model lacks a clear description of the dimensions considered and indicators used to conceptualize maturity levels, indicating a need for improvement in terms of usability. In [43], the authors propose a risk assessment framework and a related workflow that can be used semi-automatically in the organization to create an audit report and assess security risks. The proposed framework aims to use the ISO 27001 model and its technical implementations. The study's objective is to analyze the vulnerability assessment methods in information security and propose an effective model after analyzing existing maturity models. In [44], the authors present a CMM for the federal public administration agencies of Brazil, adapted from three internationally recognized maturity models: C2M2 [15], NIST SCF [16], and Community Cybersecurity Maturity Model (CCSMM) [45]. Their model proposes the following levels (N's) and Domains (D's):  
* Does not present any practices for a domain. * Presents a set of initial practices for a domain. * Presents a level of institutionalization of activities. * Documented practices. * Stakeholders are identified and participate. * Necessary resources are provided to support the processes. * Guidelines guiding the application of practices are identified. * Governance exists to guide activities. * Policies include compliance requirements. * Activities are periodically reviewed. * Responsibilities and authority to execute practices are defined. * The team performing the practices has adequate skills and knowledge. * Risk Management. * Asset Management. * Access Management. * Threat and Vulnerability Management. * Continuity Management. * Information Exchange. Figure 4: Article classification into three types. * Training, Awareness, and Culture. * Technological Infrastructure. * Cybersecurity Governance. In summary, from the results of the systematic mapping, we conclude that only three articles meet the criteria for their inclusion in our study; however, of these, we decided that only the model proposed by [PERSON] [44] was worth considering more closely, as it is the only one of the three that presents a detailed description of the domains and levels presented. Please note that our decision to analyze the [PERSON] and [PERSON] model solely does not indicate that the other models are not valuable or noteworthy. Instead, we determined that this particular model was better suited for achieving the specific objectives of our study. As we examined the articles in the Systematic Mapping process and the Related Works section, we came across diverse maturity models that organizations, including government institutions, can choose.