Incident Response Management Maturity Models: A Systematic Literature Review

The increasing frequency and impact of cybersecurity incidents have made Incident Response Management (IRM) a critical organizational capability. In recent years, Incident Response Management Maturity Models (IRM MMs) have emerged to support the assessment and improvement of incident response practices. However, existing knowledge about their concepts, structures, assessment methods, and operational coverage remains fragmented. This repository accompanies the manuscript “Incident Response Management Maturity Models: A Systematic Literature Review” and provides the supplementary materials and replication artifacts used in the study. The study presents a systematic literature review that identifies and synthesizes academic IRM MMs to consolidate the state of the art and highlight research gaps. Following Kitchenham’s guidelines and the PRISMA framework, models were analyzed with respect to their conceptual foundations, structural characteristics, scope, assessment approaches, and coverage of incident response capabilities. A final corpus of 8 academic IRM MMs published between 2013 and 2025 was identified. The original Scopus and Web of Science search produced 6 included studies, and a complementary IEEE Xplore and ACM Digital Library sensitivity search identified 2 additional studies. Most models adopt staged, CMM-like or readiness-oriented structures and are influenced by ISO/IEC 27035 and NIST SP 800-61, while empirical validation remains limited. Several important operational capabilities—such as inter-organizational coordination, automation and SOAR-enabled response, dynamic threat intelligence integration, and actionable improvement roadmaps—remain insufficiently addressed. Existing models also provide limited explicit support for small and medium-sized enterprises (SMEs) and for translating maturity or readiness assessment results into prioritized capability-improvement actions. The repository is organized as SM-1 to SM-7: SM-1: Primary search strategy and Scopus/Web of Science search evidence. SM-2: Inclusion/exclusion criteria and study-selection protocol. SM-3: Quality assessment instrument and per-study scores. SM-4: Data-extraction template and selected-study records. SM-5: Contextual comparison support for representative industry-oriented IRM maturity and capability frameworks. SM-6: Bibliometric script, protocol evaluation documentation, and reproducibility artifacts. SM-7: Complementary IEEE Xplore and ACM Digital Library sensitivity-search evidence, including search metadata, screening decisions, exclusion reasons, quality-assessment notes, and the two additional included studies. These materials support transparency, reproducibility, reuse, and future updates of the review.