Construto de Maturidade em Gestão de Segurança da Informação

The digital transformation and the cyber threat scenario mean that public organizations need to continuously improve their information security management processes. The aim of this article is therefore to propose a maturity construct to represent and understand the information security management process in organizations. The adopted method combined a literature review of maturity models, field research through a survey with information security managers from public and private organizations, and documentary research to map the regulatory framework related to information security in the Brazilian federal Government Agencies. The main results include the definition of a maturity construct made up of fifteen variables. It is concluded that the definition of the construct, based on reference documents used by managers and documents from the Brazilian regulatory framework, has the potential to contribute to the improvement of security management processes and to further studies on the subject in the country, especially in the public service.