Advancing information security maturity models: a systematic analysis of empirical developments (2021–2025)

Purpose This research aims to conduct an empirical analysis of the development of Information Security Maturity Models (ISMMs) from 2021 to 2025, focusing on challenges of fragmentation, standardization and the integration of data-driven analytics within information security maturity frameworks. Design/methodology/approach A Systematic Literature Review was undertaken following the PRISMA protocol. Data were synthesized from 25 empirical studies retrieved from Scopus, Web of Science, IEEE Xplore, ScienceDirect and Google Scholar. Thematic and analytical synthesis (QA1–QA6) was conducted to form the basis for comprehensive analysis. Findings Four key themes emerged: 1. Gaps in fragmentation and standardization 2. Adaptability and contextual pliability 3. Assimilation of data-driven intelligence 4. Governance and organizational readiness. The study highlights a transition in contemporary ISMMs from a static compliance-focused approach to a more adaptive and analytical framework. Practical implications The results of this study indicate that successful implementation of the ISMM will require a balance of architectural approach, between structural standardization and context flexibility. Maturity models are not to be understood as strict compliance tool only, but as a governance structure, which can be adjusted to the current risk profile, degree of digital maturity and organizational resources. Originality/value This research advances the fragmented theoretical and empirical streams into a composite theory on sustainable cyber resilience. By integrating standardization, data analytics and organizational readiness, it contributes to the development of more sophisticated ISMMs and supports trailblazing studies on AI-driven security maturity models.