
he increasing frequency and impact of cybersecurity incidents have made Incident Response Management (IRM) a critical organizational capability. In recent years, Incident Response Management Maturity Models (IRM MMs) have emerged to support the assessment and improvement of incident response practices. However, existing knowledge about their concepts, structures, assessment methods, and operational coverage remains fragmented. This study presents a systematic literature review that identifies and synthesizes academic IRM MMs to consolidate the state of the art and highlight research gaps. Following Kitchenham’s guidelines and the PRISMA framework, models were analyzed with respect to their conceptual foundations, structural characteristics, scope, assessment approaches, and coverage of incident response capabilities. 6 academic IRM MMs published between 2016 and 2024 were identified. Most adopt staged, CMM-like structures and are influenced by ISO/IEC 27035 and NIST SP 800-61, while empirical validation remains limited. Several important operational capabilities—such as inter-organizational coordination, automation and SOAR-enabled response, and dynamic threat intelligence integration—are insufficiently addressed. Moreover, existing models primarily emphasize maturity classification rather than readiness and provide limited guidance for actionable improvement, particularly for small and medium-sized enterprises (SMEs). This repository also provides supplementary materials, including extracted datasets, comparative tables, and analysis artifacts, to support transparency, reuse, and future research.
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 0 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Average | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Average | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Average |
