Governing Cybersecurity in Digital Business Ecosystems: A Maturity Model Integrating Enforceable Minimum Security Baselines

Abstract Maturity models are widely used instruments for assessing and guiding organizational capability, yet they assume a single organization advancing along a single-stage path. That assumption is difficult to reconcile with cybersecurity governance in digital business ecosystems, where capabilities develop unevenly across autonomous organizations, and an enforceable baseline of protection must coexist with progressive capability growth. Drawing on design science research, we present a maturity model that integrates Minimum Security Baselines (MSBs) as binding, measurable requirements that every participant must meet, directly into a multi-dimensional maturity structure. We evaluate the model in a seaport ecosystem pilot of 35 transport and logistics partners, combining a six-week field assessment with an expert evaluation using an adapted System Usability Scale. Practitioners judged the model usable, learnable, and adaptable. We position the model against established cybersecurity maturity models and recent maturity-and-resilience frameworks, and show that none couples an enforceable participation baseline with a configurable, multi-dimensional progression at ecosystem scale. The contribution is a governance mechanism that pairs an enforceable participation baseline with configurable, non-linear improvement trajectories across heterogeneous ecosystem members.