TIM-8720: Industry Laws, Regulations, and Compliance

Vincent, N. E., Higgs, J. L., & Pinsker, R. E. (2019). Board and management-level factors affecting the maturity of IT risk management practices. Journal of Information Systems, 33(3), 117–135. https://doi.org/10.2308/isys-52229
This resource shows the result of a study that examines whether board involvement, board expertise, and top management's risk culture affect the maturity of IT risk management practices (maturity) in firms. Focus reading on the Abstract and Conclusion.

U.S. Department of Homeland Security. (2019, June). Cybersecurity capability maturity model (C2M2).
This resource showcases the C2M2 model, which focuses on the implementation and management of cybersecurity practices associated with the operation and use of information technology and operational technology assets within any organization. This model can be used by any organization to enhance its own cybersecurity capabilities. Focus on reading Chapters 2 (pp. 4-6), 3 (pp. 6-8 ) and 5 (pp. 17-23).

Christopher, J. (2018, November 1). Council post: The cybersecurity maturity model: A means to measure and improve your cybersecurity program. Forbes.
This resource shares what a cybersecurity maturity model is, why organizations should have one, and how to choose the best model based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Cybersecurity Capability Maturity Model (C2M2), which both provide a comprehensive approach that covers everything in cybersecurity.

Schwartz, M. J., & Ross, R. (2019, September 11). Government agencies field more cybersecurity maturity models. Bank Information Security.
This resource highlights how two federal government agencies persuaded their sectors to adopt cybersecurity capability maturity models in alignment with NIST Cybersecurity Framework.

U.S. Department of Health and Human Services. (2020, August 6). HC3 intelligence briefing – Cybersecurity maturity models.
This resource gives guidelines on how to effectively implement any part of the ten domains of C2M2.