Work

Governing Cybersecurity in Digital Business Ecosystems: A Maturity Model Integrating Enforceable Minimum Security Baselines

Year: 2026

Type: preprint

Abstract: Maturity models are widely used instruments for assessing and guiding organizational capability, yet they assume a single organization advancing along a single-stage path. That assumption is difficult to reconcile with cybersecurity governance in digital business ecosystems, where capabilities develop unevenly across autonomous organizations, and an enforceable baseline of protection must coexist with progressive capability growth. Drawing on design science research, we present a maturity model that integrates Minimum Security Baselines (MSBs) as binding, measurable requirements that every participant must meet, directly into a multi-dimensional maturity structure. We evaluate the model in a seaport ecosystem pilot of 35 transport and logistics partners, combining a six-week field assessment with an expert evaluation using an adapted System Usability Scale. Practitioners judged the model usable, learnable, and adaptable. We position the model against established cybersecurity maturity models and recent maturity-and-resilience frameworks, and show that none couples an enforceable participation baseline with a configurable, multi-dimensional progression at ecosystem scale. The contribution is a governance mechanism that pairs an enforceable participation baseline with configurable, non-linear improvement trajectories across heterogeneous ecosystem members.

Source: Research Square

DOI: 10.21203/rs.3.rs-10933744/v1

Authors: Nuno Seixas, José D’Abruzzo Pereira, João R. Campos, Marco Vieira, Paulo R. da Cunha

Institutions: University of Coimbra, University of North Carolina at Charlotte

Language: English

Topic: Information and Cyber Security

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

SDG: Peace, justice, and strong institutions

Open Access status: green