Powered by OpenAIRE graph
Found an issue? Give us feedback
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/ ZENODOarrow_drop_down
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/
ZENODO
Article . 2026
License: CC BY
Data sources: ZENODO
ZENODO
Article . 2026
License: CC BY
Data sources: Datacite
ZENODO
Article . 2026
License: CC BY
Data sources: Datacite
versions View all 2 versions
addClaim

Incident Response Management Maturity Models: A Systematic Literature Review

Authors: Manzano Munizaga, Carlos;

Incident Response Management Maturity Models: A Systematic Literature Review

Abstract

he increasing frequency and impact of cybersecurity incidents have made Incident Response Management (IRM) a critical organizational capability. In recent years, Incident Response Management Maturity Models (IRM MMs) have emerged to support the assessment and improvement of incident response practices. However, existing knowledge about their concepts, structures, assessment methods, and operational coverage remains fragmented. This study presents a systematic literature review that identifies and synthesizes academic IRM MMs to consolidate the state of the art and highlight research gaps. Following Kitchenham’s guidelines and the PRISMA framework, models were analyzed with respect to their conceptual foundations, structural characteristics, scope, assessment approaches, and coverage of incident response capabilities. 6 academic IRM MMs published between 2016 and 2024 were identified. Most adopt staged, CMM-like structures and are influenced by ISO/IEC 27035 and NIST SP 800-61, while empirical validation remains limited. Several important operational capabilities—such as inter-organizational coordination, automation and SOAR-enabled response, and dynamic threat intelligence integration—are insufficiently addressed. Moreover, existing models primarily emphasize maturity classification rather than readiness and provide limited guidance for actionable improvement, particularly for small and medium-sized enterprises (SMEs). This repository also provides supplementary materials, including extracted datasets, comparative tables, and analysis artifacts, to support transparency, reuse, and future research.

Related Organizations
  • BIP!
    Impact byBIP!
    selected citations
    These citations are derived from selected sources.
    This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    0
    popularity
    This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
    Average
    influence
    This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    Average
    impulse
    This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
    Average
Powered by OpenAIRE graph
Found an issue? Give us feedback
selected citations
These citations are derived from selected sources.
This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Citations provided by BIP!
popularity
This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
BIP!Popularity provided by BIP!
influence
This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Influence provided by BIP!
impulse
This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
BIP!Impulse provided by BIP!
0
Average
Average
Average