STAGES OF CYBERSECURITY CAPACITY MATURITY Factors are further subdivided into aspects and for each aspect there are indicators, setting out those conditions that define the level of maturity achieved in any given aspect. There are five stages of maturity, discussed below. The maturity scale ranges from the start-up stage, implying an elementary and ad-hoc approach to capacity, to the dynamic stage where a strategic approach has been articulated and where the relevant agencies and organisations have developed the ability to respond and adapt as environmental considerations demand. The five stages are as follows: • • • • • Start-up: At this stage either no cybersecurity maturity exists, or it is very embryonic in nature. There might be initial discussions about cybersecurity capacity building, but no concrete actions have been taken. There is an absence of observable evidence of cybersecurity capacity at this stage. Formative: Some aspects have begun to grow and be formulated, but may be ad-hoc, disorganized, poorly defined – or simply new. However, evidence of this aspect can be clearly demonstrated. Established: The indicators of the aspect are in place, and functioning. However, there is not well thought-out consideration of the relative allocation of resources. Little trade-off decision-making has been made concerning the relative investment in this aspect. But the aspect is functional and defined. Strategic: At this stage choices have been made about which indicators of this aspect are important, and which are less important for the particular organisation or state. The strategic stage reflects the fact that these choices have been made, conditional upon the state’s or organisation's particular circumstances. Dynamic: At this stage, there are clear mechanisms in place to alter strategy depending on the prevailing circumstances such as the technological sophistication of the threat environment, global conflict or a significant change in one area of concern (e.g. cybercrime or privacy). Dynamic organisations have developed methods for changing strategies in stride. Rapid decision-making, reallocation of resources, and constant attention to the changing environment are features of this stage. 15 | Cybersecurity Capacity Review Iceland, 2017