A Context-Aware Cybersecurity Readiness Assessment Framework for Organisations in Developing and Emerging Environments

Abstract

Organisations increasingly face complex cybersecurity threats shaped not only by internal capabilities but also by external regulatory, institutional, and environmental conditions. While existing cybersecurity standards and maturity models provide valuable guidance, they often offer limited support for assessing organisational readiness in a manner that is both context-sensitive and diagnostically meaningful. This paper presents a context-aware cybersecurity readiness assessment framework designed to support organisational evaluation of cybersecurity readiness while explicitly accounting for external environmental influences. The framework adopts a two-tier architecture. Tier 1 assesses organisational awareness of and engagement with the external cybersecurity environment, including national regulatory obligations, institutional support mechanisms, and international collaboration. Tier 2 evaluates internal organisational cybersecurity readiness across governance, operational controls, awareness and culture, and external collaboration practices. The two tiers are designed to operate independently, enabling complementary interpretation without assuming deterministic relationships between external context and internal capability. The framework is developed and evaluated using a Design Science Research approach and is operationalised through a structured assessment instrument and an interpretable scoring model. Empirical validation is conducted across multiple organisational contexts operating in developing and emerging environments, with qualitative case study evidence where available. The results demonstrate that the framework differentiates meaningfully across readiness domains, avoids artificial score inflation or compression, and supports interpretable diagnosis of alignment gaps between external expectations and internal practices. The study contributes a validated assessment artefact that extends cybersecurity awareness research into a broader organisational readiness perspective. From a practical standpoint, the framework provides organisations, policymakers, and researchers with a structured tool to support incremental improvement, informed decision-making, and reflective engagement with both internal cybersecurity practices and external environmental conditions.

1. Introduction

The increasing interconnectivity of organisations, accelerated by cloud adoption, remote working, mobile platforms, and digitised supply chains, has expanded the attack surface and raised the stakes of cyber incidents across sectors. Cyber threats such as ransomware, credential compromise, business email compromise, and data breaches continue to impose operational disruption and financial losses, while also eroding trust and regulatory confidence [1,2]. Although technological controls remain essential, cybersecurity risk is widely recognised as a socio-technical problem in which governance, organisational culture, human behaviour, and external institutional conditions shape outcomes alongside technical capabilities [3,4].

A persistent challenge in cybersecurity management is assessing “readiness” in a manner that is both systematic and meaningful for decision-making. Many organisations implement a mix of controls and awareness initiatives yet struggle to determine whether these efforts are sufficiently embedded, aligned to risk, and responsive to evolving threats [5]. In practice, readiness is multidimensional, encompassing governance and leadership oversight, workforce awareness and behaviour, technical and operational controls, and collaboration mechanisms for incident response and information sharing. Formal standards and frameworks, such as ISO/IEC 27001 and the NIST Cybersecurity Framework, offer guidance on what constitutes good practice, but translating this guidance into an interpretable readiness view can remain difficult, particularly for organisations operating in resource-constrained or rapidly changing environments [6,7].

A further complexity is the role of the external cybersecurity environment. Organisational readiness is influenced by national data protection obligations, incident reporting expectations, national strategies, sectoral guidance, and access to institutional support such as computer emergency response teams. However, readiness assessments often focus primarily on internal controls and management practices, under-representing how organisations perceive and engage with external conditions. Similarly, national-level indices and comparative studies may assess national maturity but offer limited insight into organisational practice. This gap motivates the need for approaches that recognise external environmental awareness while still retaining a clear organisational assessment focus.

This paper addresses this need by presenting and evaluating a context-aware cybersecurity readiness assessment framework for organisations. The framework adopts a two-tier architecture: Tier 1 assesses organisational awareness of and engagement with the external cybersecurity environment, while Tier 2 assesses internal organisational readiness across governance, operational controls, awareness and culture, and collaboration practices. Importantly, the tiers are designed to be independent, enabling complementary interpretations without assuming any relationship between environmental awareness and internal capability. The framework is operationalised through a structured instrument and a scoring model that aggregates readiness across domains using an interpretable multi-criteria approach suitable for diagnostic assessment [8,9].

The study is conducted using a Design Science Research approach, where the primary contribution is a validated assessment artefact. Empirical evidence is used to evaluate the framework’s behaviour, interpretability, and practical usefulness across multiple validation contexts, rather than to benchmark national performance [9,10]. As such, the results are reported to demonstrate domain sensitivity, recurring readiness patterns, and interpretive value.

The remainder of the paper is structured as follows. Section 2 reviews relevant literature on cybersecurity readiness assessment, maturity models, and awareness measurement, and identifies gaps that motivate the proposed approach. Section 3 describes the research methodology. Section 4 presents the framework and scoring model—Section 5 reports results, followed by a discussion in Section 6. Section 7 outlines practical implications, Section 8 presents limitations and future work, and Section 9 concludes the paper.

This study contributes to the cybersecurity readiness literature in three ways. First, it proposes a context-aware assessment framework that explicitly integrates organisational readiness with awareness of the external cybersecurity environment. Second, it operationalises this framework through a structured instrument and transparent scoring methodology suitable for practical diagnostic use. Third, it provides empirical validation evidence across diverse organisational and national contexts, demonstrating the framework’s interpretability and applicability in developing and emerging environments.

2. Related Work

Research relevant to organisational cybersecurity readiness assessment spans three closely related areas: (1) standards- and framework-led approaches to information security management, (2) maturity and readiness models for organisational capability assessment, and (3) cybersecurity awareness measurement and human-factor oriented evaluation. This section synthesises these strands and highlights gaps that motivate the proposed context-aware, two-tier approach.

2.1. Standards and Frameworks for Organisational Cybersecurity

International standards and guidance frameworks provide structured sets of controls and management requirements that organisations can adopt to improve cybersecurity. ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system, including governance, risk treatment, and control implementation [6]. Similarly, the NIST Cybersecurity Framework provides functions and categories that help organisations structure cybersecurity activities across identification, protection, detection, response, and recovery [7].

Early work by Siponen [3] and Von Solms and Von Solms [1] established the organisational and behavioural foundations of information security, which have since been expanded by more recent studies focusing on cybersecurity culture and employee behaviour [11,12].

These approaches are widely used for programme design and assurance. However, they do not always provide a straightforward method for deriving a consolidated readiness view that is interpretable for leadership and comparable across internal domains. Moreover, while such frameworks acknowledge the importance of external dependencies and supply chain risk, organisational assessments often remain primarily internally focused, with limited explicit representation of an organisation’s awareness of national expectations, institutional support, or patterns of external engagement.

2.2. Maturity and Readiness Models

Maturity models aim to represent capability progression through defined stages, enabling organisations to understand their current state and target improvements. In information systems and IT management research, maturity model design has been extensively discussed, including the need for clear construct definition, staged progression, and interpretability for stakeholders [13,14]. In cybersecurity, maturity and readiness approaches are often used to support organisational diagnostics and prioritisation, especially when precise risk quantification is difficult [15,16].

Although maturity models provide useful structure, they can be limited by assumptions of linear progression and by the difficulty of aligning maturity indicators to context-specific realities. Factors beyond internal process design, such as the strength of regulatory enforcement, the availability of trusted incident-response coordination, or sectoral information sharing, may shape organisational cybersecurity maturity. These external influences are typically not represented explicitly in internal maturity scoring, which can reduce interpretive clarity, especially when assessing organisations across different national environments [17].

2.3. Cybersecurity Awareness Measurement and Human Factors

Cybersecurity awareness and associated behaviours are widely recognised as critical to security outcomes, yet difficult to measure reliably. A substantial body of work emphasises that awareness is not merely knowledge but also encompasses attitudes, intentions, and behavioural practices, all of which are influenced by organisational norms and leadership commitment [3,18]. Instruments have been developed to measure human factors in security, including questionnaire-based approaches that capture awareness, attitudes, and tendencies toward policy compliance [19]. Studies of awareness campaigns also highlight limitations of purely informational interventions and advocate integrating awareness into organisational culture and governance [11].

While awareness research provides valuable insight into human-centric security, awareness measures are frequently treated as isolated constructs, separate from broader governance and operational control assessment [12]. This separation can limit the practical usefulness of awareness results for readiness planning, particularly where organisational leadership requires integrated views that connect behavioural aspects to governance and technical capability [20,21].

2.4. Composite Indicators and Multi-Criteria Scoring in Readiness Assessment

When readiness spans multiple dimensions, composite indicator approaches are commonly used to combine varied inputs into interpretable scores. Guidance on composite indicator construction emphasises transparency of assumptions, careful aggregation, and sensitivity analysis to ensure that conclusions are not artefacts of scoring choices [22,23]. Multi-criteria decision-making methods, such as the Weighted Sum Model, have similarly been used to support structured aggregation when criteria differ in importance and are measured on an ordinal scale [8,9].

These approaches are particularly suitable for diagnostic readiness assessment, provided the scoring model is presented as interpretive rather than as a precise measurement of risk. The present study follows this principle by using an ordinal scoring approach and interpreting outputs at the domain and tier level [24].

2.5. Research Gap and Positioning of This Study

Across the literature, three limitations are especially relevant. First, standards and frameworks provide comprehensive guidance but do not always yield a clear, interpretable view of readiness for leadership decision-making. Second, maturity models often focus on internal capabilities and under-represent the ways external environmental conditions shape organisational readiness or how organisations engage with external cybersecurity structures. Third, awareness measurement frequently remains disconnected from broader readiness assessment, despite evidence that awareness effectiveness depends on governance and cultural embedding.

This study addresses these gaps by proposing a two-tier, context-aware readiness assessment framework in which awareness of the external environment (Tier 1) and internal organisational readiness (Tier 2) are assessed independently yet interpreted together. This design supports clearer diagnosis of alignment gaps without assuming deterministic relationships between external context and internal capability. The framework is operationalised through a structured instrument and a transparent scoring model, and it is evaluated as a Design Science artefact using empirical validation evidence across multiple contexts.

Table 1 summarises the main strands of related work reviewed in this study and highlights the limitations that motivate the proposed framework. While existing standards, maturity models, and awareness-focused approaches provide valuable guidance, they tend to address cybersecurity readiness in fragmented ways, often prioritising internal controls or isolated human factors. These limitations underline the need for an assessment approach that integrates external contextual awareness with internal organisational readiness, without imposing rigid benchmarking or false numerical precision.

Table 1. Summary of Related Work and Identified Gaps.

Stream	Focus	Limitation Identified
Standards & frameworks	Control guidance	Limited readiness interpretability
Maturity models	Capability progression	Internal focus, weak contextualisation
Awareness measurement	Human factors	Often isolated from governance
Composite indicators	Aggregation	Risk of false precision

This review of related work establishes the theoretical and empirical foundations for the proposed framework. It highlights the limitations in existing approaches that motivate the research methodology described in the following section.

3. Research Methodology

This study adopts a Design Science Research (DSR) methodology to support the development and evaluation of a context-aware cybersecurity readiness assessment framework. DSR is particularly appropriate for research that seeks to design, operationalise, and evaluate artefacts intended to address real-world problems while maintaining theoretical rigour [10,25].

The methodological focus of this study is not hypothesis testing or population-level generalisation, but rather the evaluation and validation of a practical assessment artefact across diverse organisational and national contexts. In Design Science Research evaluations, heterogeneous samples drawn from multiple environments are commonly used to assess artefact interpretability and applicability rather than to produce statistically representative national measurements. Where available, qualitative insights from case studies also provide complementary interpretive validation of the framework’s outputs.

3.1. Research Design and Rationale

Design Science Research distinguishes between the creation of an artefact and the evaluation of its utility, robustness, and relevance [10]. In this study, the artefact is a two-tier cybersecurity readiness assessment framework, operationalised through a structured survey instrument and associated scoring model.

The research follows the core DSR activities of:

• Problem identification and motivation;
• Artefact design and development;
• Demonstration through application;
• Evaluation using empirical evidence.

Evaluation is conducted by applying the framework across multiple organisational contexts operating in different national cybersecurity environments. These contexts are used to validate the framework’s applicability, interpretability, and robustness, rather than to produce comparative national benchmarks.

This positioning is consistent with DSR guidance, which emphasises that evaluation may take exploratory, observational, or analytical forms depending on the nature of the artefact and research objectives [26].

3.2. Instrument Development

The assessment instrument was developed iteratively, informed by:

• Prior academic literature on cybersecurity awareness and readiness;
• International standards and frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework;
• Insights derived from earlier stages of the doctoral research.

The instrument comprises two independent tiers:

• Tier 1 evaluates organisational awareness and engagement with the external cybersecurity environment, including regulatory obligations, national strategies, institutional guidance, and international collaboration.
• Tier 2 evaluates internal organisational cybersecurity readiness, including governance, technical controls, training and awareness, and collaborative practices.

Both tiers employ a consistent question structure that combines binary, categorical, and ordinal maturity items. Jurisdiction-specific references, such as national laws and regulatory bodies, were adapted to reflect local contexts while preserving conceptual equivalence across all validation settings.

This approach supports contextual sensitivity without compromising structural consistency, a key requirement for validation-oriented research.

The assessment instrument contains a structured set of items distributed across the Tier 1 and Tier 2 domains. Each domain includes multiple questions designed to capture different aspects of organisational cybersecurity readiness, including awareness of external regulatory expectations, governance structures, operational practices, and cultural readiness. Questions combine binary, categorical, and ordinal maturity indicators, allowing the instrument to capture both the presence of practices and their level of organisational maturity. The full survey instrument used in this study is provided in Appendix A.

3.3. Study Contexts and Validation Approach

Empirical data were collected from organisations operating within Ghana, Brazil, South Africa, India, and Japan. These contexts were selected to provide diversity in:

• Regulatory maturity;
• Institutional capacity;
• Cybersecurity governance structures.

The countries are not treated as units of comparison, nor are the results intended to reflect national cybersecurity readiness. Instead, they serve as validation contexts, allowing the framework to be evaluated under differing external conditions.

Four of the validation contexts (Ghana, Brazil, South Africa, and India) include both survey responses and qualitative case study input, enabling triangulation between quantitative scores and organisational narratives. Japan was included only as a survey-based validation context. In this case, data collection was constrained by language considerations, as the instrument was administered in English. While care was taken to ensure conceptual clarity, the absence of a translated instrument limited participation and prevented the collection of qualitative case study data. Japan is therefore treated as a partial validation context that contributes to the evaluation of the survey instrument’s clarity and interpretability but does not provide qualitative triangulation. Nevertheless, the responses obtained from this context still support the cross-environment evaluation of the framework by demonstrating that the assessment instrument remains interpretable and applicable within a different national cybersecurity setting.

The empirical data collected in this study are intended to support artefact validation rather than statistical generalisation. Consequently, the sample sizes are modest and uneven across contexts. In Design Science Research, heterogeneous yet limited samples are commonly used to evaluate an artefact’s behaviour, interpretability, and contextual applicability across different environments. The purpose of the validation stage is therefore to examine how the framework performs across varied institutional contexts rather than to derive representative national estimates. Cross-context interpretations presented in the study should therefore be understood as exploratory validation insights rather than comparative national benchmarking results.

3.4. Data Collection

Data were collected using an online survey instrument distributed to participants responsible for or involved in cybersecurity governance and operations within their organisations. Respondents included individuals in management, technical, and compliance-oriented roles.

Participation was voluntary, and no personal identifiers were collected. Respondents were informed of the academic purpose of the study and their right to withdraw at any stage. Data were handled in accordance with established ethical research practices.

In addition to readiness responses, participants were invited to provide qualitative feedback on the assessment tool, including clarity of questions, relevance of domains, and perceived usefulness. This feedback supports artefact evaluation by providing insight into usability and construct validity beyond numerical scores.

3.5. Case Study Integration

Qualitative case studies were conducted for selected organisations in Ghana, Brazil, South Africa and Japan. These case studies employed the same Tier 1 and Tier 2 question structure, supplemented by open-ended prompts to capture contextual explanations and organisational experiences.

Case study data are not scored independently. Instead, they are used to:

• Contextualise survey findings;
• Explain observed readiness patterns;
• Support interpretation in the Results and Discussion sections.

This mixed-methods approach aligns with DSR evaluation practices, in which qualitative evidence is frequently used to assess the usefulness and explanatory power of artefacts [10,27].

3.6. Data Analysis and Interpretation

Survey responses were analysed using the scoring methodology described in Section 4. Domain-level and overall readiness scores were calculated for both tiers, and results were interpreted at the aggregate level.

The analysis focuses on:

• Recurring readiness patterns;
• Domain-level strengths and weaknesses;
• Alignment between external expectations and internal practices.

Given the exploratory and validation-oriented nature of the study, emphasis is placed on relative patterns and categorical interpretations, rather than marginal differences in numerical scores.

3.7. Ethical Considerations

Ethical approval for the study was obtained in accordance with institutional research governance requirements. The study adhered to principles of informed consent, confidentiality, and responsible data handling.

No organisational identifiers are disclosed in the reporting of results, and findings are presented in a manner that avoids reputational or commercial risk to participating organisations.

4. Context-Aware Cybersecurity Readiness Framework and Scoring Model

This section presents the context-aware cybersecurity readiness assessment framework and its associated scoring model. The framework is designed as a two-tier structure that enables systematic evaluation of organisational cybersecurity readiness while explicitly accounting for external environmental conditions. The framework is grounded in Design Science Research principles and is intended to support diagnostic insight and practical decision-making rather than precise numerical optimisation.

Importantly, the two tiers are not modelled as causally dependent. Tier 1 and Tier 2 operate as independent yet complementary assessment layers, allowing organisations to evaluate internal readiness alongside awareness of the external cybersecurity environment without presupposing a direct or linear relationship between them.

4.1. Framework Overview

The proposed framework adopts a two-tier architecture:

• Tier 1: External Cybersecurity Environment Assessment, which evaluates organisational awareness of national cybersecurity expectations, regulatory obligations, institutional support mechanisms, and external engagement.
• Tier 2: Internal Organisational Cybersecurity Readiness Assessment, which evaluates governance structures, operational practices, technical controls, awareness activities, and collaborative capabilities within the organisation.

This separation reflects the recognition that organisations may operate under similar national conditions yet exhibit different levels of internal readiness. Strong internal practices can exist even in environments with limited external support. Treating the tiers independently avoids oversimplified assumptions about environmental determinism while still allowing contextual interpretation of results.

The framework aligns with established socio-technical perspectives in cybersecurity, which emphasise that organisational security outcomes are shaped by a combination of governance, human behaviour, technical capability, and institutional context rather than by any single factor alone [3,4].

4.2. Tier 1: External Cybersecurity Environment Assessment

Tier 1 evaluates organisational awareness and engagement with the national and international cybersecurity environment in which the organisation operates. Rather than measuring national cybersecurity maturity directly, Tier 1 captures organisational perceptions and interactions with external structures that influence cybersecurity practice.

Tier 1 is structured around eight external readiness domains.

The selection of the eight Tier 1 domains was informed by a structured synthesis of prior literature, international cybersecurity frameworks, and empirical insights from instrument development. Prior research emphasises that organisational cybersecurity is shaped not only by internal capability but also by external institutional, regulatory, and socio-technical conditions, including legal obligations, national strategies, and coordinated response mechanisms [1,3,4].

In addition, key elements of the domains were abstracted from internationally recognised standards and frameworks, including ISO/IEC 27001 and the NIST Cybersecurity Framework, which incorporate external dependencies such as regulatory compliance, supplier assurance, incident reporting, and alignment with recognised practices [6,7].

Finally, the maturity model development literature highlights the importance of defining domains by consolidating conceptually distinct capability areas to ensure coverage and avoid redundancy [13,14,17]. The eight domains, therefore, represent a synthesis of these influences, capturing the principal external structures that shape organisational cybersecurity practice while maintaining analytical clarity and interpretability.

• National data protection and privacy obligations;
• National cybersecurity strategy and policy alignment;
• Vendor and cloud service assurance expectations;
• Cybersecurity assessment and audit expectations;
• Incident reporting and cybercrime response mechanisms;
• Adoption of internationally recognised cybersecurity standards;
• National cybersecurity awareness initiatives;
• International collaboration and capacity-building engagement.

Within each domain, questions follow a consistent progression from awareness, through engagement or action, to perceived maturity. This structure enables differentiation between superficial awareness and substantive organisational alignment.

Tier 1 does not assume that high awareness of national expectations automatically translates into strong internal capability. Instead, it provides contextual information that supports the interpretation of Tier 2 results and helps identify potential misalignments between external expectations and internal practices.

4.3. Tier 2: Internal Organisational Cybersecurity Readiness Assessment

Tier 2 evaluates internal organisational readiness across core cybersecurity capability areas. It focuses on the presence, consistency, and maturity of practices that collectively determine an organisation’s ability to manage cyber risk.

Tier 2 is organised into five internal readiness domains.

The Tier 2 domains were derived from the consolidation of core organisational cybersecurity capability areas consistently identified across ISO/IEC 27001, the NIST Cybersecurity Framework, and cybersecurity maturity model literature [6,7,13,17]. These domains reflect governance, compliance, technical capability, human factors, and collaboration as the principal dimensions of organisational cybersecurity readiness, as widely recognised in both standards and academic research.

• Cybersecurity governance and leadership;
• Data protection compliance and accountability;
• Technical and operational security controls;
• Cybersecurity awareness, training, and organisational culture;
• External collaboration and threat intelligence utilisation.

These domains reflect widely recognised components of organisational cybersecurity capability and align with established standards and maturity models, including ISO/IEC 27001, the NIST Cybersecurity Framework, and broader organisational maturity frameworks [6,7,13].

While cybersecurity awareness is explicitly assessed within Tier 2, it is treated as a human-centric dimension of readiness, embedded alongside governance and technical capability rather than as an isolated construct. This positioning is supported by evidence that awareness initiatives are most effective when integrated into organisational processes and leadership structures rather than delivered as standalone interventions [11,19].

4.4. Independence and Complementarity of Tiers

Table 2 summarises the tier structure and domain coverage of the CSRA framework. Tier 1 captures organisational awareness of, and engagement with, the external cybersecurity environment, while Tier 2 focuses on internal organisational readiness across governance, operational, cultural, and collaborative dimensions. Presenting the framework structure at this point reinforces the analytical independence of the two tiers while supporting their complementary interpretation before operationalisation via the scoring methodology.

Table 2. Tier Structure and Domain Coverage.

Tier	Focus	Domains Covered
Tier 1	External environment awareness	Regulation, strategy, audits, reporting, standards, collaboration
Tier 2	Internal organisational readiness	Governance, controls, awareness, collaboration

A key design decision within the framework is the explicit non-linkage of Tier 1 and Tier 2 at the scoring level. The framework does not assume that Tier 1 scores predict or determine Tier 2 scores, nor are Tier 2 results adjusted or weighted based on Tier 1 outcomes.

This decision is grounded in three considerations. First, empirical research indicates that organisational cybersecurity capability can vary significantly within the same national context due to sectoral, cultural, and leadership factors [28,29]. Second, enforcing a causal relationship between context and capability risks masking internal organisational strengths or weaknesses. Third, Design Science Research emphasises interpretability and usefulness over theoretical determinism [10].

Instead, Tier 1 and Tier 2 are intended to be interpreted side by side, enabling diagnostic insight into whether internal practices align with, lag, or exceed external expectations.

4.5. Scoring Methodology

To operationalise cybersecurity readiness across both tiers, the framework employs a weighted additive scoring approach based on the Weighted Sum Model (WSM). WSM is a well-established multi-criteria decision-making technique that is particularly suitable for aggregating qualitative or ordinal indicators across multiple dimensions in a transparent and interpretable manner [8,9].

The scoring methodology is designed to support diagnostic interpretation rather than precise quantitative optimisation, reflecting the exploratory and evaluative nature of organisational cybersecurity readiness assessment.

4.5.1. Response Scoring

Survey responses are converted into ordinal numerical values to enable structured aggregation. For binary and awareness-based questions, responses are scored as follows:

• Yes/High compliance = 3;
• Don’t know/Uncertain = 1;
• No/Non-compliance = 0.

For scale-based maturity questions, responses are scored as:

• High = 3;
• Medium = 2;
• Low = 1;
• No action taken = 0.

Assigning a non-zero value to “Don’t know” responses reflect the distinction between confirmed absence and organisational uncertainty [30]. Prior research indicates that uncertainty often signals partial implementation, limited visibility, or fragmented responsibility rather than the complete absence of a capability [11,18]. Treating uncertainty as analytically distinct, therefore, improves the interpretive value of the assessment [31].

4.5.2. Importance Weighting

Each assessment item is assigned an ordinal importance weight to reflect its conceptual significance within the overall readiness construct:

• Low importance = 1;
• Medium importance = 2;
• High importance = 3.

Higher-weighted items capture foundational readiness elements such as statutory obligations, governance arrangements, and senior leadership oversight, while lower-weighted items capture enabling or supporting practices. These weights are intended to reflect relative conceptual importance, not precise quantitative relationships.

This ordinal weighting approach is consistent with cybersecurity maturity and organisational capability assessments, where imposing fine-grained numerical precision is neither realistic nor analytically meaningful [13,14].

4.5.3. Score Aggregation and Normalisation

For each respondent, a raw readiness score [32] is calculated as the weighted sum of individual item scores:

$$S_{\mathrm{raw}}=\sum _{i=1}^n{w}_i·r_i$$

(1)

where $r_i$ represents the ordinal response score for the item $i$, $w_i$ represents the corresponding importance weight, and $n$ is the number of applicable items.

To support comparability across respondents, organisations, and validation contexts, raw scores are normalised onto a 0–100 scale:

$$S_{\mathrm{norm}}={\displaystyle \frac{S_{\mathrm{raw}}}{S_{\max }}}\times 100$$

(2)

where $S_{\max }$ represents the maximum attainable score given the applicable items and their associated weights.

Normalisation prevents structural bias arising from differences in the number of applicable questions and supports meaningful interpretation of both overall and case study readiness results. This approach aligns with established guidance on composite indicator construction and multi-criteria aggregation [22,23].

Importantly, the resulting scores are interpreted as indicative readiness levels rather than precise risk measurements, reinforcing the framework’s role as a diagnostic and evaluative tool rather than a predictive or benchmarking instrument.

4.6. Robustness and Methodological Justification

It is acknowledged that all composite scoring systems involve a degree of subjectivity. The methodological concern, therefore, is not the presence of arbitrariness but whether findings are unduly sensitive to specific scoring choices.

To address this, a post hoc sensitivity analysis was conducted using alternative scoring scales and weighting configurations. Across these variations, relative domain patterns and categorical readiness classifications remained stable, indicating that results reflect underlying structural characteristics rather than artefacts of numerical configuration.

This emphasis on robustness, transparency, and interpretability aligns with Design Science Research guidance, which prioritises artefact usefulness and explanatory value over statistical optimisation [10,26].

5. Results

This section presents the empirical results obtained through validation and application of the Cyber Security Readiness Assessment (CSRA) framework. Survey responses collected across multiple organisational and national contexts are used to validate the instrument’s applicability, clarity, and interpretability. At the same time, numerical readiness scores are presented only for the organisational case-study applications, where the framework is intended to be used operationally.

The results are structured to reflect this distinction. Tier 1 and Tier 2 survey findings are reported descriptively to demonstrate validation behaviour, followed by scored results derived from the case study applications.

5.1. Validation Contexts and Response Volumes

Data were collected from organisations operating in Ghana, Brazil, South Africa, India, and Japan. Respondents represented roles including cybersecurity management, technical operations, compliance, and senior leadership. Response volumes varied across countries and tiers, reflecting differences in access, sectoral engagement, and language constraints.

The sample sizes within each validation context are intentionally limited, as the study’s purpose is artefact validation rather than statistical generalisation. Small and uneven response volumes across contexts may influence the distribution of responses and should therefore be interpreted as exploratory validation evidence rather than representative national findings.

Table 3 summarises the number of responses collected for each tier and the availability of case study applications.

Table 3. Distribution of survey responses and case study application across validation contexts.

Country	Tier 1 Responses (n)	Tier 2 Responses (n)	Case Study Applied
Ghana	5	6	Yes
Brazil	5	3	Yes
South Africa	2	8	Yes
India	5	3	Yes
Japan	3	1	No
Total	20	21	—

The validation surveys were not designed to generate statistically generalisable findings or comparative national rankings. Instead, they were used to evaluate whether the CSRA instrument elicited differentiated and meaningful responses across diverse contexts.

5.2. Tier 1 Validation Results: External Cybersecurity Environment Awareness

The following sections present the Tier 1 and Tier 2 validation results, focusing on whether the framework elicited differentiated, interpretable, and contextually meaningful responses.

Tier 1 responses (n = 20) were analysed descriptively to examine organisational awareness of, and engagement with, external cybersecurity environment factors.

5.2.1. National Data Protection and Regulatory Awareness

Across respondents, awareness of national data protection obligations was generally high. However, this awareness did not consistently translate into staff-level training or engagement with regulatory authorities. Across data protection-related Tier 1 items, a notable proportion of responses fell into the “Don’t know” category, indicating uncertainty about the practical application of legal requirements in operational roles.

This pattern demonstrates the framework’s ability to distinguish between nominal awareness and substantive organisational alignment.

5.2.2. National Cybersecurity Strategy and Institutional Alignment

Most respondents indicated awareness of national cybersecurity strategies and coordinating institutions. However, fewer respondents reported active organisational alignment or regular monitoring of national cybersecurity developments by senior leadership. Responses were distributed across all response categories, suggesting that Tier 1 items capture meaningful variation rather than producing uniformly positive outcomes.

5.2.3. Vendor Assurance, Auditing, and Incident Reporting

Vendor assurance and cybersecurity audit practices were reported more consistently than incidents were reported to national authorities. Incident reporting indicators had the lowest proportion of affirmative responses among Tier 1 domains, with several respondents indicating non-engagement or uncertainty.

This recurring gap highlights a disconnect between awareness of reporting obligations and operational follow-through.

5.2.4. International Standards and External Engagement

Awareness of internationally recognised cybersecurity standards was common across respondents. However, the adoption of such standards and engagement with international cybersecurity partnerships or capacity-building initiatives were less prevalent. Engagement beyond the national level was reported inconsistently across validation contexts.

The recurrence of this pattern supports the framework’s ability to identify structural weaknesses that are not confined to a single national environment.

5.3. Tier 2 Validation Results: Internal Organisational Cybersecurity Readiness

Tier 2 responses (n = 21) were analysed descriptively to validate the framework’s ability to capture variation in internal organisational readiness across governance, technical capability, awareness, and collaboration.

5.3.1. Governance and Leadership

The majority of respondents reported having formal cybersecurity governance roles and leadership oversight. However, fewer respondents confirmed the existence of dedicated cybersecurity budgets or organisation-wide governance embedding, indicating variation in governance maturity even where strategic recognition exists.

5.3.2. Technical and Operational Controls

Technical controls such as endpoint protection and patch management were among the most consistently reported practices across Tier 2 items. In contrast, incident response procedures and review of controls were less consistently reported, highlighting differences between control presence and control maturity, as illustrated in Figure 1.

Figure 1. Distribution of organisational awareness across Tier 1 external cybersecurity environment domains.

5.3.3. Awareness, Training, and Organisational Culture

Responses regarding awareness and organisational culture showed the greatest variation across Tier 2 domains. While most organisations reported some form of awareness activity, fewer indicated structured programmes aligned with evolving threat intelligence or embedded within organisational culture.

These findings reinforce the positioning of awareness as a human-centric readiness dimension rather than a standalone capability.

5.3.4. External Collaboration and Threat Intelligence

Engagement with external cybersecurity partners and the use of threat intelligence varied considerably. Some respondents reported active participation in information-sharing networks, while others indicated minimal collaboration beyond compliance-driven requirements.

5.4. Cross-Context Validation Insights

Taken together, the Tier 1 and Tier 2 validation results demonstrate that the CSRA framework:

• Elicits differentiated responses across readiness domains;
• Captures uncertainty as a meaningful indicator of maturity;
• Avoids artificial score inflation during validation;
• Remains interpretable across diverse organisational and national contexts.

These findings support the framework’s suitability for validation without premature aggregation or scoring as illustrated in Figure 2.

Figure 2. Variation in organisational cybersecurity readiness across Tier 2 internal capability domains.

Table 4 consolidates the recurring patterns observed across the Tier 1 and Tier 2 validation results. Rather than introducing new empirical findings, the table synthesises interpretive insights that emerged consistently across validation contexts. This summary provides a structured transition from framework validation to organisational application, presented through case study readiness scoring in the following section.

Table 4. Summary of Validation Patterns Across Tiers.

Tier	Observed Pattern
Tier 1	High awareness, weaker engagement
Tier 2	Stronger technical controls, weaker cultural embedding
Both	Limited external collaboration and reporting

5.5. Case Study Application and Readiness Scoring

The CSRA framework was applied in full within four organisational case studies (Ghana, Brazil, South Africa, and India). Unlike the validation surveys, the case studies enabled execution of the scoring model described in Section 4, producing interpretable overall readiness scores.

5.5.1. Overall Readiness Scores

Table 5 presents the overall cybersecurity readiness scores obtained by applying the framework in organisational case studies. As outlined in Section 4, these scores are derived only where the framework was applied in full as a case study and are not calculated from Tier 1 or Tier 2 survey validation responses alone. The purpose of these scores is therefore diagnostic and illustrative, demonstrating how the framework can be operationalised at the organisational level rather than enabling comparative national assessment.

Table 5. Overall, cybersecurity readiness scores derived from the organisational case study application.

Case Study Context	Overall Readiness Score	Readiness Category
Ghana	69	Medium (Upper)
South Africa	67	Medium (Upper)
Brazil	57	Medium (Lower)
India	56	Medium (Lower)

Note: Overall readiness scores are calculated exclusively from organisational case study applications of the framework and are presented for diagnostic purposes rather than for comparative national benchmarking.

The results indicate that all case study organisations fall within the Medium readiness band, albeit with variation between upper and lower segments of this category. Organisations operating within the Ghana and South Africa case study contexts achieved overall readiness scores of 69.8% and 67.7%, respectively, placing them in the upper range of the Medium category. These scores suggest the presence of established governance structures and technical controls, alongside partial integration of awareness and external engagement practices.

In contrast, the Brazil and India case study applications yielded overall readiness scores of 57.2% and 56.1%, respectively, placing these organisations in the lower segment of the Medium category. While baseline cybersecurity capabilities were evident across governance and technical domains, the scores indicate less consistent organisational embedding, particularly regarding structured awareness initiatives and external collaboration. Across all case study contexts as illustrated in Figure 3, the clustering of scores within the Medium band reinforces the framework’s sensitivity to incremental differences in organisational readiness without producing artificial extremes or score inflation. This behaviour aligns with the design intent of the scoring model, which emphasises interpretability and diagnostic value over fine-grained numerical precision. The results demonstrate that the framework can distinguish relative readiness positions within a realistic organisational maturity range, supporting its suitability for practical application as an evaluative tool.

Figure 3. Overall cybersecurity readiness scores derived from organisational case study applications.

Rather than serving as comparative national rankings, these results demonstrate that the scoring model can be applied end-to-end within real organisational settings, producing outputs that support diagnostic interpretation and organisational improvement planning. The dominant domain-level strengths and gaps identified across the case studies are summarised in Table 6.

Table 6. Dominant domain-level strengths and gaps identified through case studies.

Case Study	Dominant Strengths	Key Gaps
Ghana	Regulatory awareness; institutional visibility	Operational consistency; cultural embedding
South Africa	Governance structures; leadership engagement	Incident response testing; external coordination
Brazil	Formal policies; legal awareness	Integration of controls; organisational embedding
India	Policy awareness; leadership recognition	Formalisation of practices; operational maturity

5.5.2. Domain-Level Insights from Case Studies

While domain-level numeric scores were not reported, the case studies enabled a qualitative interpretation of the dominant strengths and weaknesses across the readiness dimensions.

5.6. Summary of Results

Overall, the results demonstrate that the CSRA framework supports the validation of applicability without relying on premature scoring, while effectively differentiating between external and internal dimensions of organisational cybersecurity readiness. The findings further show that the framework captures recurring structural gaps, particularly regarding the integration of awareness and engagement with external cybersecurity mechanisms. Importantly, the results confirm that meaningful readiness scoring can be achieved when the framework is applied in an organisational case-study context. Taken together, these outcomes provide empirical support for the framework’s validity as a diagnostic and evaluative instrument for assessing organisational cybersecurity readiness.

To facilitate a more systematic comparison of readiness patterns across validation contexts, Table 7 presents a cross-context interpretive synthesis of Tier 1 and Tier 2 observations derived from survey responses and case study insights. The table summarises recurring themes observed across the validation environments while maintaining the study’s position that the framework is not intended to produce national benchmarking or comparative performance rankings.

Table 7. Cross-context interpretive table. Observed readiness patterns across validation contexts.

Context	External Environment Awareness (Tier 1)	Internal Governance and Controls (Tier 2)	Awareness and Cultural Embedding	External Collaboration
Ghana	High awareness of regulatory expectations and institutional structures	Moderately developed governance structures and technical controls	Partial integration of awareness initiatives within organisational culture	Limited engagement with external information-sharing networks
South Africa	Moderate to high awareness of national cybersecurity initiatives	Strong governance recognition and leadership involvement	Awareness activities are present but not consistently embedded across the organisation	External collaboration and incident coordination remain limited
Brazil	Moderate awareness of regulatory and compliance obligations	Formal policies and governance structures reported	Awareness initiatives exist, but are not consistently operationalised	Limited structured collaboration with external cybersecurity stakeholders
India	Awareness of national cybersecurity policies and regulatory obligations reported	Baseline governance structures are present, but operational maturity varies	Awareness activities reported, but organisational embedding remains inconsistent	Limited routine engagement with external threat intelligence or reporting structures
Japan (partial validation context)	Awareness responses are present but limited due to language constraints	Insufficient responses to interpret governance patterns robustly	Not sufficient data for meaningful interpretation	Limited data available for collaboration assessment

6. Discussion

This section interprets the empirical findings in relation to the study’s objectives and situates them within relevant literature on cybersecurity readiness, awareness, and socio-technical security governance. The discussion is framed around the framework’s validity, interpretability, and practical utility as a Design Science artefact, rather than around comparative national performance. This positioning aligns with Design Science Research, where evaluation focuses on demonstrating an artefact’s coherence, usefulness, and robustness within and across contexts [10,25,27].

6.1. Evidence of Framework Validity Across Heterogeneous Contexts

The results support the framework’s suitability as a validation-oriented organisational readiness assessment artefact. Across validation contexts, the framework differentiated across domains without excessive clustering at the extremes, indicating sensitivity to variations in readiness dimensions. In composite indicator construction, such behaviour is desirable because it suggests that an instrument is capturing meaningful variation rather than producing uniformly high or low outcomes [22,23]. From a DSR perspective, the observed interpretability and domain-level separation provide evidence that the artefact meets the criteria of relevance and utility, namely, that it produces outputs that are actionable for intended stakeholders [10,26].

At the same time, the study’s purpose is not statistical generalisation. Instead, the empirical patterns are used to evaluate whether the framework behaves coherently across different external environments and organisational conditions. This is consistent with evaluation approaches commonly used in maturity and readiness assessment research, where the primary goal is diagnostic insight and practical interpretability rather than optimisation or prediction [13,14].

6.2. Interpreting Tier Independence and Complementarity

A central design decision within the framework is the explicit non-linkage of Tier 1 and Tier 2 at the scoring level. The results support this decision by showing that organisations can exhibit different combinations of external awareness and internal readiness. This aligns with socio-technical accounts of security, which emphasise that organisational cybersecurity outcomes arise from interactions between governance, human behaviour, and technical capability rather than from external conditions alone [3,4].

The case study contexts also illustrate how national institutional environments influence organisational engagement with cybersecurity practices. For example, organisations operating within environments where national cybersecurity strategies and regulatory authorities are visible tended to demonstrate higher awareness of regulatory expectations within Tier 1 responses. However, this awareness did not always translate into stronger internal readiness in areas such as operational testing, cultural embedding, and external collaboration. In several contexts, organisational capability appeared to depend more strongly on internal leadership commitment, organisational culture, and resource allocation than on external policy visibility alone. These observations highlight the importance of separating external environmental awareness from internal organisational capability, which represents the core conceptual distinction embedded within the two-tier framework.

Differences in regulatory enforcement, institutional capacity, and national cybersecurity coordination structures appear to shape how organisations interpret and respond to cybersecurity expectations. For example, environments where regulatory authorities and national strategies are more visible tend to generate stronger organisational awareness of compliance obligations and reporting expectations. However, the presence of external structures does not automatically translate into stronger internal readiness. Organisational outcomes appear to depend on how leadership commitment, resource allocation, and internal governance structures translate external expectations into operational practice. This reinforces the value of assessing external environmental awareness and internal organisational readiness separately while interpreting them together.

Treating external environmental awareness (Tier 1) and internal posture (Tier 2) as independent avoids the deterministic assumption that the national context necessarily predicts organisational capability. This is important because organisational capability is known to be shaped by internal leadership commitment, resourcing, culture, and sectoral pressures, which may vary widely even within the same national environment [18,29]. The independent tier design, therefore, enhances interpretability by allowing organisations to identify whether gaps relate to limited external engagement, internal capability weaknesses, or both.

6.3. Awareness as a Human-Centric Dimension of Readiness

The findings reinforce the conceptual positioning of cybersecurity awareness as a human-centric readiness capability embedded within organisational practice rather than as a standalone intervention. Prior work has repeatedly observed that awareness campaigns and training programmes often fail to produce sustained behaviour change when treated as episodic compliance activities rather than as integrated organisational processes [11]. The results are consistent with this literature, as awareness and cultural embedding tend to vary more widely and appear less mature than the deployment of basic technical controls.

This distinction matters because awareness, as a construct, is not simply knowledge acquisition. It encompasses behavioural reinforcement, accountability, and cultural norms that shape everyday decision-making [18,19]. By evaluating awareness and culture alongside governance and operational controls, the framework reflects the socio-technical reality that human factors and organisational structures jointly determine readiness outcomes [3].

6.4. Recurring Readiness Imbalances and What They Imply

A consistent pattern across contexts is the relative strength of visible technical controls, alongside weaker maturity in domains related to culture, collaboration, and external reporting. This aligns with broader observations that organisations often prioritise deployable controls because they are tangible, auditable, and easier to procure. In contrast, cultural change, behavioural governance, and cross-organisational collaboration require sustained leadership commitment and organisational learning [4,11].

From a composite indicator perspective, the fact that domain-level patterns recur across contexts also supports the stability of the framework’s constructs, suggesting that the instrument is capturing structural features of organisational readiness rather than noise introduced by a single environment [22,23]. For readiness assessment practice, the implication is that organisations may need to rebalance investment so that technical baselines are complemented by governance reinforcement, awareness integration, and routine operational testing, which are frequently emphasised in security management standards and maturity approaches [6,14].

6.5. Role of Case Studies in Interpretive Validation

Where case studies were available, qualitative narratives supported interpretation [29] of the scoring outputs and strengthened confidence in the framework’s practical coherence. In DSR, mixed evidence, including stakeholder perspectives, is commonly used to evaluate whether an artefact produces meaningful representations of real-world phenomena and whether its outputs are usable for decision-making [10,27]. The case study material served this purpose by contextualising domain-level results and explaining why certain gaps persisted despite nominal awareness or the presence of policy.

The case study narratives also illustrate how contextual factors influence organisational cybersecurity readiness. For example, organisations operating in environments where regulatory authorities and national cybersecurity strategies are more visible tended to demonstrate stronger awareness of compliance obligations and reporting expectations. However, this awareness did not consistently translate into stronger internal operational practices such as incident response testing or structured awareness programmes. In several case study contexts, organisational readiness appeared to depend more strongly on internal leadership commitment and resource allocation than on the presence of national policies alone. These observations reinforce the value of the framework’s context-aware design, which allows external environmental awareness and internal organisational capability to be examined separately while still supporting integrated interpretation.

Equally, where qualitative triangulation was not feasible, the framework remained usable for survey-based assessment, albeit with acknowledged limitations. This is consistent with the role of validation contexts in DSR, where partial-evaluation evidence can still support claims of applicability, provided that limitations are stated transparently. Claims are appropriately bounded [26].

6.6. Implications for Readiness Assessment Research

The study contributes to readiness assessment research by demonstrating a structured approach that separates awareness of the external environment from internal organisational posture while retaining interpretive complementarity. This separation addresses a frequent limitation in readiness and maturity assessments where contextual factors are either ignored or conflated with internal capability, reducing diagnostic clarity [13,14]. In addition, the framework demonstrates a practical pathway for extending awareness-oriented enquiry to a broader readiness perspective without abandoning human-centric foundations, a direction consistent with socio-technical security scholarship [3,4].

6.7. Summary of Discussion

Overall, the findings indicate that the proposed framework functions as a coherent and interpretable readiness assessment artefact across diverse validation settings. The independent treatment of Tier 1 and Tier 2 supports nuanced diagnosis by avoiding deterministic assumptions about context and capability, while still enabling complementary interpretation of external alignment and internal posture [3,10]. The results further support treating cybersecurity awareness as an embedded, human-centric readiness capability that is most meaningful when assessed alongside governance and operational controls [11,19]. Taken together, these characteristics strengthen the framework’s suitability for validation-oriented organisational readiness assessment and provide a defensible basis for the practical implications discussed in the subsequent section [22,23].

7. Practical Implications

This section outlines the practical implications of the proposed cybersecurity readiness assessment framework for organisations, policymakers, and researchers. The focus is on how the framework can be used in practice as a diagnostic and improvement-oriented tool, rather than as a benchmarking or compliance scoring mechanism.

7.1. Implications for Organisations

For organisations, the framework provides a structured and interpretable approach to assessing cybersecurity readiness across both internal capability and external environmental awareness. By maintaining a clear separation between Tier 1 and Tier 2, organisations can identify whether readiness challenges primarily arise from internal governance and operational gaps, limited engagement with the external cybersecurity ecosystem, or misalignment between the two.

This diagnostic orientation aligns with established cybersecurity governance guidance, which emphasises the importance of understanding organisational context when managing cyber risk rather than relying solely on prescriptive controls [6,7]. The domain-level outputs produced by the framework allow organisations to prioritise improvement efforts in a targeted manner, supporting informed decision-making at the senior leadership level.

In addition, the framework supports progressive maturity assessment. Organisations can reapply the assessment periodically to track changes over time, evaluate the effectiveness of interventions, and support continuous improvement, a principle widely reflected in maturity-based cybersecurity management approaches [13,14].

7.2. Implications for Policymakers and National Stakeholders

For policymakers and national cybersecurity stakeholders, the framework offers insight into how organisational readiness interacts with national strategies, regulatory frameworks, and institutional guidance. Although the framework does not directly measure national cybersecurity maturity, aggregated Tier 1 outcomes can provide indicative evidence of how effectively national initiatives are understood and operationalised at the organisational level.

Prior research has highlighted that the effectiveness of national cybersecurity strategies is often constrained by limited organisational uptake and uneven implementation, rather than by the absence of policy instruments themselves [23]. The recurring gaps observed in areas such as incident reporting, international engagement, and awareness campaign integration suggest that policy interventions may benefit from greater emphasis on organisational enablement and practical guidance.

In developing and emerging contexts, the framework may support policymakers in identifying where regulatory awareness exists but is not yet translating into consistent organisational practice, thereby informing more targeted capacity-building and outreach initiatives.

7.3. Implications for Cybersecurity Awareness and Training Practice

The findings reinforce the importance of positioning cybersecurity awareness as a strategic, human-centric organisational capability, rather than as a standalone or compliance-driven activity. While awareness initiatives are widely implemented, research consistently shows that they are most effective when embedded within governance structures, reinforced through leadership commitment, and aligned with organisational risk management processes [11,19].

By embedding awareness within Tier 2 alongside governance and operational controls, the framework enables organisations to evaluate whether awareness activities are structurally supported and culturally embedded. Staff responsible for training and awareness programmes can use the framework to assess whether initiatives are sufficiently structured, regularly updated, and aligned with evolving threat landscapes, rather than delivered as isolated interventions.

7.4. Implications for Cybersecurity Research and Framework Development

From a research perspective, the framework contributes a validated artefact that bridges awareness-focused studies and broader organisational readiness assessment. It demonstrates how external environmental factors and internal organisational capabilities can be assessed independently yet still support an integrated interpretation.

This approach addresses limitations identified in existing readiness and maturity models, where contextual factors are often either excluded or conflated with internal capabilities, thereby reducing diagnostic clarity [11,14]. Future research can build on this work by adapting the framework to specific sectors, extending the scoring model, or integrating it with technical-maturity or risk-quantification approaches.

7.5. Summary of Practical Implications

Overall, the proposed framework offers a practical and adaptable tool for assessing organisational cybersecurity readiness that is context-sensitive, grounded in human-centric principles, and oriented towards incremental improvement. Its validation across diverse environments highlights its potential value for organisations seeking to strengthen cybersecurity posture, policymakers aiming to improve organisational engagement with national initiatives, and researchers exploring holistic approaches to cybersecurity readiness assessment.

8. Limitations and Future Work

This section outlines the study’s limitations and identifies opportunities for future research and framework development. These considerations are presented in the context of the study’s Design Science Research orientation and its validation-focused objectives.

8.1. Scope and Validation-Oriented Design

A primary limitation of this study is that it does not seek to provide statistically generalisable findings or national-level benchmarking. The framework was evaluated using empirical evidence from multiple organisational and national contexts to validate its behaviour, interpretability, and practical usefulness rather than to infer population-level conclusions. While this approach is consistent with Design Science Research principles, it necessarily constrains how far results can be extrapolated beyond the validation settings considered.

Future work could extend the framework’s application to larger, more diverse samples, enabling further exploration of sector-specific readiness patterns and strengthening external validity.

8.2. Sample Size and Representation

The number of responses varied across validation contexts, reflecting differences in organisational access, sectoral engagement, and language constraints. In particular, the limited number of responses in some contexts restricts fine-grained statistical analysis and reinforces the exploratory nature of the findings.

Future studies could address this limitation by deploying the framework at scale in specific sectors or regions, enabling more detailed comparative analysis while preserving its diagnostic orientation.

8.3. Self-Reported Data and Perceptual Bias

The framework relies primarily on self-reported data, which may be influenced by respondent perception, recall bias, or social desirability effects. Although this is a common limitation in cybersecurity awareness and readiness research, it may lead to overestimation or underestimation of actual practices.

Future research could integrate independent validation measures, such as audit outcomes, incident records, or technical assessments, to triangulate self-reported readiness with objective evidence.

8.4. Language and Instrument Localisation

The assessment instrument was administered in English across all validation contexts. In at least one context, language barriers constrained participation and limited the collection of qualitative case study data. Although care was taken to ensure conceptual clarity, the absence of translated instruments represents a limitation of the current study.

Future work should prioritise systematic localisation and translation of the instrument, including validation of translated versions, to improve accessibility and cultural alignment without compromising conceptual consistency.

The framework can also be applied periodically within the same organisation, allowing readiness assessments to be repeated over time and enabling organisations to monitor the impact of governance improvements, awareness initiatives, and operational security enhancements.

8.5. Framework Extension and Integration

The current framework focuses on organisational readiness and awareness-related dimensions without explicitly integrating technical maturity scoring or quantitative risk metrics. While this design choice supports interpretability and human-centric analysis, it limits direct integration with operational risk management tools.

Future research could explore integrating the framework with technical maturity models, risk quantification approaches, or continuous monitoring systems to enable a more comprehensive assessment of cybersecurity posture.

8.6. Longitudinal Application

The present study provides a cross-sectional view of cybersecurity readiness. As such, it does not capture how readiness evolves over time or in response to interventions.

A valuable direction for future research would be the longitudinal application of the framework, enabling organisations to track progress in readiness, assess the impact of targeted interventions, and evaluate the sustainability of awareness and governance initiatives.

8.7. Summary of Limitations and Future Directions

In summary, while the study demonstrates the framework’s suitability as a validated organisational readiness assessment artefact, its findings are shaped by a validation-oriented design, variable sample sizes, reliance on self-reported data, and language constraints. Addressing these limitations through expanded deployment, localisation, integration with objective measures, and longitudinal analysis represents a clear and constructive agenda for future research.

9. Conclusions

This paper presented a context-aware cybersecurity readiness assessment framework designed to support organisational evaluation of cybersecurity readiness while explicitly accounting for external environmental conditions. Grounded in Design Science Research, the framework was developed and validated as a practical assessment artefact rather than as a benchmarking or predictive model.

The framework adopts a two-tier structure that separates awareness of the external cybersecurity environment from internal organisational readiness. By maintaining the independence of Tier 1 and Tier 2, the framework avoids deterministic assumptions about the relationship between national context and organisational capability, while still enabling complementary interpretation of results. This design choice enhances diagnostic clarity and supports a more nuanced understanding of readiness gaps.

Empirical validation across multiple organisational and national contexts demonstrated that the framework behaves consistently, differentiates meaningfully across readiness domains, and avoids artificial score inflation or compression. The results further reinforced the importance of treating cybersecurity awareness as a human-centric, embedded organisational capability rather than as a standalone intervention. Qualitative case study evidence, where available, supported the coherence and interpretability of the scoring outputs.

The study contributes to cybersecurity readiness research by extending awareness-focused inquiry into a broader, integrated readiness assessment approach that remains sensitive to organisational context. From a practical perspective, the framework provides organisations, policymakers, and researchers with a structured tool that supports incremental improvement, informed decision-making, and reflective engagement with both internal practices and external expectations.

Overall, the proposed framework offers a validated and adaptable approach to organisational cybersecurity readiness assessment, particularly suited to developing and emerging environments where contextual factors play a significant role in shaping cybersecurity practice. The framework provides a foundation for future research and practical application aimed at strengthening organisational resilience in an increasingly complex cyber threat landscape.

Appendix A.1. Tier 1—External Cybersecurity Environment Assessment

Table A1. National Data Protection and Privacy Obligations.

Question	Response Type
Is your organisation aware of the key obligations under applicable national data protection legislation?	Yes/No/Don’t know
Has your organisation taken steps to comply with requirements issued by the national data protection authority?	Yes/No/Don’t know
Are staff trained on how national data protection laws apply to their roles?	Yes/No/Don’t know
Has your organisation had correspondence with the national data protection authority regarding compliance matters?	Yes/No/Don’t know
To what extent is your organisation compliant with national data protection requirements?	No Action Taken/Low/Medium/High

Table A1. National Data Protection and Privacy Obligations.

Question	Response Type
Is your organisation aware of the key obligations under applicable national data protection legislation?	Yes/No/Don’t know
Has your organisation taken steps to comply with requirements issued by the national data protection authority?	Yes/No/Don’t know
Are staff trained on how national data protection laws apply to their roles?	Yes/No/Don’t know
Has your organisation had correspondence with the national data protection authority regarding compliance matters?	Yes/No/Don’t know
To what extent is your organisation compliant with national data protection requirements?	No Action Taken/Low/Medium/High

Table A2. National Cybersecurity Strategy and Policy Alignment.

Question	Response Type
Is your organisation aware of the national cybersecurity strategy or policy framework?	Yes/No/Don’t know
Does your organisation align its risk management frameworks with guidance from national cybersecurity authorities?	Yes/No/Don’t know
Has your organisation participated in national cybersecurity programmes or initiatives?	Yes/No/Don’t know
Does senior leadership engage with national cybersecurity priorities?	Yes/No/Don’t know
To what extent does your organisation actively align with the national cybersecurity strategy?	No Action Taken/Low/Medium/High

Table A2. National Cybersecurity Strategy and Policy Alignment.

Question	Response Type
Is your organisation aware of the national cybersecurity strategy or policy framework?	Yes/No/Don’t know
Does your organisation align its risk management frameworks with guidance from national cybersecurity authorities?	Yes/No/Don’t know
Has your organisation participated in national cybersecurity programmes or initiatives?	Yes/No/Don’t know
Does senior leadership engage with national cybersecurity priorities?	Yes/No/Don’t know
To what extent does your organisation actively align with the national cybersecurity strategy?	No Action Taken/Low/Medium/High

Table A3. Vendor and Cloud Service Assurance.

Question	Response Type
Are cloud service providers used by your organisation recognised or authorised by national regulatory authorities where applicable?	Yes/No/Don’t know
Does your organisation verify whether service providers comply with cybersecurity obligations?	Yes/No/Don’t know
Are security requirements reviewed during vendor due diligence processes?	Yes/No/Don’t know
Does your organisation require service providers to follow minimum cybersecurity standards?	Yes/No/Don’t know
To what extent does your organisation rely on IT service providers that demonstrate cybersecurity compliance?	No Action Taken/Low/Medium/High

Table A3. Vendor and Cloud Service Assurance.

Question	Response Type
Are cloud service providers used by your organisation recognised or authorised by national regulatory authorities where applicable?	Yes/No/Don’t know
Does your organisation verify whether service providers comply with cybersecurity obligations?	Yes/No/Don’t know
Are security requirements reviewed during vendor due diligence processes?	Yes/No/Don’t know
Does your organisation require service providers to follow minimum cybersecurity standards?	Yes/No/Don’t know
To what extent does your organisation rely on IT service providers that demonstrate cybersecurity compliance?	No Action Taken/Low/Medium/High

Table A4. Cybersecurity Audit and Risk Assessment Practices.

Question	Response Type
Is your organisation aware of expectations from national authorities regarding cybersecurity risk assessments?	Yes/No/Don’t know
Has your organisation adopted recognised cybersecurity assessment frameworks (for example ISO 27001 or NIST)?	Yes/No/Don’t know
Are third party cybersecurity audits conducted within your organisation?	Yes/No/Don’t know
Are audit results used to inform senior leadership decision making?	Yes/No/Don’t know
To what extent does your organisation follow a structured approach to cybersecurity auditing?	No Action Taken/Low/Medium/High

Table A4. Cybersecurity Audit and Risk Assessment Practices.

Question	Response Type
Is your organisation aware of expectations from national authorities regarding cybersecurity risk assessments?	Yes/No/Don’t know
Has your organisation adopted recognised cybersecurity assessment frameworks (for example ISO 27001 or NIST)?	Yes/No/Don’t know
Are third party cybersecurity audits conducted within your organisation?	Yes/No/Don’t know
Are audit results used to inform senior leadership decision making?	Yes/No/Don’t know
To what extent does your organisation follow a structured approach to cybersecurity auditing?	No Action Taken/Low/Medium/High

Table A5. Incident Reporting and National Cybercrime Engagement.

Question	Response Type
Is your organisation aware of the role of the national Computer Emergency Response Team (CERT)?	Yes/No/Don’t know
Do internal procedures identify how to report cybersecurity incidents to national authorities?	Yes/No/Don’t know
Are staff informed about organisational responsibilities in relation to cybercrime reporting?	Yes/No/Don’t know
Has your organisation engaged with national authorities in response to a cyber incident?	Yes/No/Don’t know
To what extent are internal procedures aligned with national cyber incident reporting mechanisms?	No Action Taken/Low/Medium/High

Table A5. Incident Reporting and National Cybercrime Engagement.

Question	Response Type
Is your organisation aware of the role of the national Computer Emergency Response Team (CERT)?	Yes/No/Don’t know
Do internal procedures identify how to report cybersecurity incidents to national authorities?	Yes/No/Don’t know
Are staff informed about organisational responsibilities in relation to cybercrime reporting?	Yes/No/Don’t know
Has your organisation engaged with national authorities in response to a cyber incident?	Yes/No/Don’t know
To what extent are internal procedures aligned with national cyber incident reporting mechanisms?	No Action Taken/Low/Medium/High

Table A6. International Cybersecurity Standards Adoption.

Question	Response Type
Is your organisation aware of internationally recognised cybersecurity standards (for example ISO 27001 or CIS Controls)?	Yes/No/Don’t know
Has your organisation voluntarily adopted any recognised cybersecurity standards?	Yes/No/Don’t know
Are these standards embedded in internal organisational policies?	Yes/No/Don’t know
Is the organisation incentivised to align with formal cybersecurity standards (for example through partnerships or compliance expectations)?	Yes/No/Don’t know
To what extent does your organisation implement controls aligned with international cybersecurity standards?	No Action Taken/Low/Medium/High

Table A6. International Cybersecurity Standards Adoption.

Question	Response Type
Is your organisation aware of internationally recognised cybersecurity standards (for example ISO 27001 or CIS Controls)?	Yes/No/Don’t know
Has your organisation voluntarily adopted any recognised cybersecurity standards?	Yes/No/Don’t know
Are these standards embedded in internal organisational policies?	Yes/No/Don’t know
Is the organisation incentivised to align with formal cybersecurity standards (for example through partnerships or compliance expectations)?	Yes/No/Don’t know
To what extent does your organisation implement controls aligned with international cybersecurity standards?	No Action Taken/Low/Medium/High

Table A7. National Cybersecurity Awareness Initiatives.

Question	Response Type
Has your organisation engaged with national cybersecurity awareness campaigns?	Yes/No/Don’t know
Are materials from national cybersecurity awareness campaigns distributed internally?	Yes/No/Don’t know
Are national awareness resources incorporated into employee training programmes?	Yes/No/Don’t know
Is there senior leadership support for participation in national cybersecurity awareness initiatives?	Yes/No/Don’t know
To what extent does your organisation integrate national cybersecurity awareness initiatives into internal programmes?	No Action Taken/Low/Medium/High

Table A7. National Cybersecurity Awareness Initiatives.

Question	Response Type
Has your organisation engaged with national cybersecurity awareness campaigns?	Yes/No/Don’t know
Are materials from national cybersecurity awareness campaigns distributed internally?	Yes/No/Don’t know
Are national awareness resources incorporated into employee training programmes?	Yes/No/Don’t know
Is there senior leadership support for participation in national cybersecurity awareness initiatives?	Yes/No/Don’t know
To what extent does your organisation integrate national cybersecurity awareness initiatives into internal programmes?	No Action Taken/Low/Medium/High

Table A8. International Collaboration and Threat Intelligence.

Question	Response Type
Is your organisation aware of national participation in international cybersecurity initiatives?	Yes/No/Don’t know
Has your organisation benefited from international cybersecurity capacity building programmes?	Yes/No/Don’t know
Are international cybersecurity best practices used to inform internal decision making?	Yes/No/Don’t know
Is your organisation part of networks that share cybersecurity threat intelligence?	Yes/No/Don’t know
To what extent does your organisation actively engage with international cybersecurity partnerships?	No Action Taken/Low/Medium/High

Table A8. International Collaboration and Threat Intelligence.

Question	Response Type
Is your organisation aware of national participation in international cybersecurity initiatives?	Yes/No/Don’t know
Has your organisation benefited from international cybersecurity capacity building programmes?	Yes/No/Don’t know
Are international cybersecurity best practices used to inform internal decision making?	Yes/No/Don’t know
Is your organisation part of networks that share cybersecurity threat intelligence?	Yes/No/Don’t know
To what extent does your organisation actively engage with international cybersecurity partnerships?	No Action Taken/Low/Medium/High

Appendix A.2. Tier 2—Internal Organisational Cybersecurity Readiness

Table A9. Cybersecurity Governance and Leadership.

Question	Response Type
Does your organisation have a designated individual responsible for cybersecurity governance?	Yes/No/Don’t know
Is cybersecurity included in organisational strategic planning?	Yes/No/Don’t know
Does your organisation allocate a dedicated budget for cybersecurity activities?	Yes/No/Don’t know
Does senior leadership regularly review organisational cybersecurity risks?	Yes/No/Don’t know
To what extent is cybersecurity governance embedded across the organisational structure?	No Action Taken/Low/Medium/High

Table A9. Cybersecurity Governance and Leadership.

Question	Response Type
Does your organisation have a designated individual responsible for cybersecurity governance?	Yes/No/Don’t know
Is cybersecurity included in organisational strategic planning?	Yes/No/Don’t know
Does your organisation allocate a dedicated budget for cybersecurity activities?	Yes/No/Don’t know
Does senior leadership regularly review organisational cybersecurity risks?	Yes/No/Don’t know
To what extent is cybersecurity governance embedded across the organisational structure?	No Action Taken/Low/Medium/High

Table A10. Data Protection Compliance and Accountability.

Question	Response Type
Is the organisation aware of its obligations under applicable data protection legislation?	Yes/No/Don’t know
Has the organisation appointed a Data Protection Officer or equivalent role?	Yes/No/Don’t know
Are staff members trained on personal data protection responsibilities?	Yes/No/Don’t know
Are documented procedures in place to manage data subject rights requests?	Yes/No/Don’t know
To what extent does your organisation comply with applicable data protection requirements?	No Action Taken/Low/Medium/High

Table A10. Data Protection Compliance and Accountability.

Question	Response Type
Is the organisation aware of its obligations under applicable data protection legislation?	Yes/No/Don’t know
Has the organisation appointed a Data Protection Officer or equivalent role?	Yes/No/Don’t know
Are staff members trained on personal data protection responsibilities?	Yes/No/Don’t know
Are documented procedures in place to manage data subject rights requests?	Yes/No/Don’t know
To what extent does your organisation comply with applicable data protection requirements?	No Action Taken/Low/Medium/High

Table A11. Technical and Operational Security Controls.

Question	Response Type
Is endpoint protection software deployed across organisational systems?	Yes/No/Don’t know
Are security patches applied according to a defined schedule?	Yes/No/Don’t know
Is a network firewall implemented within the organisation?	Yes/No/Don’t know
Are incident response procedures tested through scheduled exercises?	Yes/No/Don’t know
To what extent are technical cybersecurity controls implemented across the organisation?	No Action Taken/Low/Medium/High

Table A11. Technical and Operational Security Controls.

Question	Response Type
Is endpoint protection software deployed across organisational systems?	Yes/No/Don’t know
Are security patches applied according to a defined schedule?	Yes/No/Don’t know
Is a network firewall implemented within the organisation?	Yes/No/Don’t know
Are incident response procedures tested through scheduled exercises?	Yes/No/Don’t know
To what extent are technical cybersecurity controls implemented across the organisation?	No Action Taken/Low/Medium/High

Table A12. Cybersecurity Awareness and Organisational Culture.

Question	Response Type
Does the organisation provide cybersecurity awareness training to employees?	Yes/No/Don’t know
Are training materials updated to reflect emerging threats or national threat advisories?	Yes/No/Don’t know
Are cybersecurity roles and responsibilities clearly communicated to staff?	Yes/No/Don’t know
Has the organisation conducted internal phishing simulation exercises?	Yes/No/Don’t know
To what extent is cybersecurity embedded within organisational culture?	No Action Taken/Low/Medium/High

Table A12. Cybersecurity Awareness and Organisational Culture.

Question	Response Type
Does the organisation provide cybersecurity awareness training to employees?	Yes/No/Don’t know
Are training materials updated to reflect emerging threats or national threat advisories?	Yes/No/Don’t know
Are cybersecurity roles and responsibilities clearly communicated to staff?	Yes/No/Don’t know
Has the organisation conducted internal phishing simulation exercises?	Yes/No/Don’t know
To what extent is cybersecurity embedded within organisational culture?	No Action Taken/Low/Medium/High

Table A13. External Collaboration and Threat Intelligence.

Question	Response Type
Is your organisation a member of a formal cybersecurity information sharing network?	Yes/No/Don’t know
Are external threat intelligence feeds used to support security operations?	Yes/No/Don’t know
Has your organisation engaged in international cybersecurity capacity building initiatives?	Yes/No/Don’t know
Has your organisation reported cybersecurity incidents to relevant national authorities?	Yes/No/Don’t know
To what extent is cybersecurity embedded within organisational culture?	No Action Taken/Low/Medium/High

Table A13. External Collaboration and Threat Intelligence.

Question	Response Type
Is your organisation a member of a formal cybersecurity information sharing network?	Yes/No/Don’t know
Are external threat intelligence feeds used to support security operations?	Yes/No/Don’t know
Has your organisation engaged in international cybersecurity capacity building initiatives?	Yes/No/Don’t know
Has your organisation reported cybersecurity incidents to relevant national authorities?	Yes/No/Don’t know
To what extent is cybersecurity embedded within organisational culture?	No Action Taken/Low/Medium/High