From Compliance to Resilience: Assessing Cybersecurity Maturity of State Universities and Colleges in the Philippines

ABSTRACT This study evaluated the cybersecurity maturity of six State Universities and Colleges (SUCs) in the Zamboanga Peninsula. Using surveys and interviews, maturity was assessed across five domains: information security, strategy, policy, training, and incident response. Findings showed SUCs were moderately mature in cybersecurity (3.21/5), strongest in information security but weakest in training and incident response. Policies existed, but enforcement and incident readiness lagged, especially where ICT experience and training were lacking. Importantly, the results underscored that demographics like age or sex had no bearing on security maturity; rather, targeted, repeated professional development was decisive. Interviews revealed similar difficulties in governance and funding, matching global trends. The study suggests that focus should be on governance-driven strategies, structured awareness programs, stronger enforcement mechanisms, and tested incident-response plans to help SUCs move beyond basic compliance to real resilience.