Improving cybersecurity readiness with a maturity framework for organizations in U.S. and Canada
Bibliographic record
Abstract
The increasing frequency and sophistication of cyber threats have underscored the need for enhanced cybersecurity readiness among organizations in the U.S. and Canada. To address this need, this paper introduces a Cybersecurity Maturity Framework (CMF) designed to assist organizations in systematically assessing and improving their cybersecurity capabilities. The framework provides a structured approach for evaluating current security postures, identifying gaps, and prioritizing investments to mitigate risks effectively. The proposed CMF consists of five maturity levels: Initial, Developing, Established, Advanced, and Optimized. Each level encompasses critical domains, including governance, threat intelligence, incident response, and workforce development, with defined benchmarks to measure progress. By incorporating best practices from the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Canada's Cyber Security Strategy, the CMF ensures alignment with regional regulatory requirements and industry standards. A key feature of the framework is its adaptability to organizations of various sizes and sectors. The CMF integrates advanced technologies such as artificial intelligence (AI) and machine learning (ML) for threat detection and predictive analytics while emphasizing the importance of human factors, including continuous employee training and leadership engagement. Moreover, the framework promotes collaboration between public and private sectors to facilitate information sharing and collective defense against evolving cyber threats. Through case studies, the application of the CMF is demonstrated in enhancing cybersecurity readiness for small and medium enterprises (SMEs) and large organizations in critical sectors such as healthcare, finance, and energy. Results indicate improved incident detection rates, faster response times, and strengthened resilience against sophisticated cyberattacks. This research highlights the necessity of adopting a maturity-based approach to cybersecurity, ensuring organizations can evolve their capabilities to counter dynamic threats. The Cybersecurity Maturity Framework provides a roadmap for sustainable improvement, empowering organizations in the U.S. and Canada to achieve a higher state of preparedness and resilience in the face of an ever-changing cyber threat landscape.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.007 | 0.015 |
| Meta-epidemiology (narrow) | 0.001 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.001 |
| Bibliometrics | 0.011 | 0.008 |
| Science and technology studies | 0.006 | 0.002 |
| Scholarly communication | 0.007 | 0.004 |
| Open science | 0.002 | 0.004 |
| Research integrity | 0.001 | 0.002 |
| Insufficient payload (model declined to judge) | 0.002 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".