@article {904,
	title = {Secure by Design: Cybersecurity Extensions to Project Management Maturity Models for Critical Infrastructure Projects},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {06/2015},
	pages = {26-34},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Many systems that comprise our critical infrastructures {\textendash} including electricity, transportation, healthcare, and financial systems {\textendash} are designed and deployed as information technology (IT) projects using project management practices. IT projects provide a one-time opportunity to securely "design in" cybersecurity to the IT components of critical infrastructures. The project management maturity models used by organizations today to assess the quality and rigour of IT project management practices do not explicitly consider cybersecurity. This article makes three contributions to address this gap. First, it develops the argument that cybersecurity can and should be a concern of IT project managers and assessed in the same way as other project management capabilities. Second, it examines three widely used cybersecurity maturity models {\textendash} i) the National Institute of Science and Technology (NIST) framework for improving critical infrastructure cybersecurity, ii) the United States Department of Energy{\textquoteright}s Cybersecurity Capability Maturity Model (C2M2), and iii) the CERT Resilience Management Model (CERT RMM) from the Carnegie Mellon Software Engineering Institute {\textendash} to identify six cybersecurity themes that are salient to IT project management. Third, it proposes a set of cybersecurity extensions to PjM3, a widely-deployed project management maturity model. The extensions take the form of a five-level cybersecurity capability perspective that augments the seven standard perspectives of the PjM3 by explicitly assessing project management capabilities that impact the six themes where IT project management and cybersecurity intersect. This article will be relevant to IT project managers, the top management teams of organizations that design and deploy IT systems for critical infrastructures, and managers at organizations that provide and maintain critical infrastructures.},
	keywords = {C2M2, capability maturity models, CERT RMM, critical infrastructures, cybersecurity, NIST, P3M3, PjM3, project management},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/904},
	url = {http://timreview.ca/article/904},
	author = {Jay Payette and Esther Anegbe and Erika Caceres and Steven Muegge}
}
@article {837,
	title = {Cybersecurity Capability Maturity Models for Providers of Critical Infrastructure},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {10/2014},
	pages = {33-39},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Critical infrastructure such as power generation and distribution systems, telecommunications networks, pipelines and pipeline control networks, transportation control networks, financial networks, and government information and communications technology (ICT) have increasingly become the target of cyber-attacks. The impact and cost of these threats, as well as regulatory pressure to mitigate them, have created an impetus to secure these critical infrastructures. Managers have many controls and models at their disposal to help them secure infrastructure technology, including cybersecurity capability maturity models to enable measurement and communication of cybersecurity readiness to top management teams, regulators, and customers, thereby facilitating regulatory compliance, corporate responsibility, and improved brand quality. However, information and awareness is lacking about which models are most appropriate for a given situation and how they should be deployed.

This article examines relevant cybersecurity capability maturity models to identify the standards and controls available to providers of critical infrastructure in an effort to improve their level of security preparedness. These capability models are described and categorized by their relevance to different infrastructure domains, and then recommendations are provided on employing capability maturity models to measure and communicate readiness. This article will be relevant to regulators, critical infrastructure providers, and researchers. },
	keywords = {adoption, bersecurity, capability maturity models, compliance, critical infrastructure, framework, municipalities, protection, regulation, standards},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/837},
	url = {http://timreview.ca/article/837},
	author = {Walter Miron and Kevin Muita}
}
