Learning Objectives:

  • Understand the concept of governance maturity models for cybersecurity.

  • Identify the key elements of cybersecurity maturity assessment.

  • Recognise the importance of benchmarking against best practices.

  • Understand how maturity models support continuous improvement.

7.1 What are Governance Maturity Models?

Governance maturity models provide a framework for assessing the effectiveness of an organisation’s cybersecurity governance and management processes. The Central Bank of Nigeria’s Framework requires goal indicators that demonstrate progress toward target maturity states as assessed by the CSAT tool—this maturity measurement framework is CBN-specific .

Maturity models typically describe a progression from ad hoc, reactive approaches to proactive, integrated, and continuously improving approaches. The model helps organisations assess their current state, identify gaps, and develop plans for improvement.

7.2 Key Elements of Maturity Assessment

Self-Assessment: The Central Bank of Nigeria requires submission of a Cybersecurity Self-Assessment Tool (CSAT) report, signed by the CISO and approved by senior management, to the Director of Supervision no later than 31 March annually . This self-assessment provides a baseline for measuring progress.

Metrics and Indicators: The Central Bank of Nigeria requires key performance indicators (KPIs), risk indicators (KRIs), and goal indicators aligned with strategy . The Framework mandates annual review of cybersecurity metrics to ensure continued relevance and alignment with the institution’s cybersecurity strategy .

Testing and Monitoring: PM-14 testing, training, and monitoring provides the testing and measurement programme; CA-07 continuous monitoring supports ongoing measurement of security posture; PM-04 plan of action and milestones tracks remediation performance .

7.3 Best Practice Benchmarking

Benchmarking against best practices is essential for identifying improvement opportunities. The Saudi Central Bank’s Cybersecurity Framework requires entities to periodically review and update cyber security policies, procedures, and standards taking into consideration the evolving cyber threat landscape . This includes staying informed about industry best practices.

The adoption of internationally recognised standards is common practice in financial institutions. ISO 27001, the NIST Cybersecurity Framework, and CIS Controls are the most common frameworks for implementing cybersecurity governance . While these global standards provide a foundational structure, regional regulatory bodies have developed complementary frameworks tailored to local contexts and requirements .

7.4 Continuous Improvement

Maturity models support continuous improvement by providing a roadmap for progression. The Central Bank of Nigeria’s Framework requires annual review of cybersecurity metrics to ensure continued relevance and alignment with the institution’s cybersecurity strategy . The integration of metrics with the Information Security Steering Committee reporting cycle is a governance requirement .

PreviousNext