Maturity Models in Information Security Audits

Information security auditing plays an important role in information security management because it assesses the status of security mechanisms, risk management, and regulatory compliance. Most information security auditing methodologies have been based on binary assessments or checklists, an approach that is limited in the constant evolution of cyber threats. This paper presents a comparative analysis of the most recognized maturity level structures, such as the Capability Maturity Model Integration (CMMI), the Cybersecurity Capability Maturity Model (C2M2), and the Cybersecurity Maturity Model Certification (CMMC), in order to identify the most suitable one for an innovative change in the auditing process to obtain a deeper and more detailed evaluation of security controls and, consequently, better decision-making.