Using the COBIT Maturity Model Rubrics to Evaluate Information Security: An Exploratory Study

• In Event: Internal Controls

Abstract

Measures of information security activities and overall effectiveness are not readily available to researchers. Consequently, researchers often rely upon self-reported qualitative measures. However, this approach raises issues concerning both the scope and the reliability of data collected. This study avoids such concerns by using rich, holistic scales (the COBIT 4.1 Maturity Model rubrics) created by a professional organization. Our results suggest that the COBIT 4.1 Maturity Model rubrics may be a useful tool for information security researchers.
We show that the COBIT rubric scores reliably predict both subjective (i.e., an overall grade) and objective (security incidents) measures of information security effectiveness.

Authors

• Paul J Steinbart, Arizona State University

• Robyn L Raschke, University of Nevada-Las Vegas

• Graham Gal, University of Massachusetts Amherst

• William N Dilla, Iowa State University