Crafting good practises aligned with NIST CSF 2.0 and CMMI

• Main Author: Oliveira, Luís Filipe Mesquita
• Publication Date: 2025
• Format: Master thesis
• Language: eng
• Source: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
• Download full: http://hdl.handle.net/20.500.11960/4394
• topic: Information security; Cybersecurity; Risk management; Cybersecurity maturity; CMMI; NIST CSF 2.0; ISO/IEC 27001:2022; CIS Controls; C2M2; CMMC; CIA; Cybersecurity resilience; Segurança da informação; Cibersegurança; Gestão de risco; Maturidade em cibersegurança; Resiliência em cibersegurança

In today’s digital landscape, organizations face increasingly sophisticated cybersecurity threats, often compounded by the absence of standardized and adaptive methodologies for assessing and improving cybersecurity maturity. This thesis introduces a novel framework that integrates the National Institute of Standards and Technology Cybersecurity Framework 2.0 (NIST CSF 2.0) with the Capability Maturity Model Integration (CMMI). The proposed framework aligns best practices across the three core dimensions of CMMI—People, Processes, and Technology—spanning maturity levels 1 to 5, while mapping these practices to the subcategories of NIST CSF 2.0. This thesis undertakes a comprehensive analysis of existing frameworks/standards and maturity models to identify their strengths and limitations. The development and validation of the framework followed a systematic approach, with expert feedback playing a crucial role. The results demonstrate that the framework supports organizations in systematically advancing through maturity levels, offering scalable and tailored practices that address diverse cybersecurity challenges. Furthermore, the validation highlights the framework’s usability, adaptability, and potential to strengthen organizational resilience and security postures. By providing a systematic and adaptable approach for assessing and improving cybersecurity maturity, this thesis contributes to bridging critical gaps in current methodologies.