Cybersecurity Governance Maturity Model for Critical Infrastructure Organizations (CGMM-CI): An AI-Enhanced Framework for Assessing Governance, Risk, Resilience, and Operational Readiness

Critical infrastructure organizations increasingly operate within highly interconnected digital ecosystems characterized by cloud computing, operational technology convergence, artificial intelligence (AI), third-party dependencies, and rapidly evolving cyber threats. Cybersecurity incidents affecting healthcare, telecommunications, energy, transportation, manufacturing, and financial services can generate consequences that extend beyond organizational boundaries, impacting public safety, economic stability, and national security. Although widely adopted frameworks such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0), ISO/IEC 27001, ENISA cybersecurity guidance, and sector-specific regulatory standards provide valuable cybersecurity controls and governance recommendations, organizations continue to face challenges in measuring cybersecurity governance maturity in a consistent, scalable, and sector-adaptable manner. This study proposes the Cybersecurity Governance Maturity Model for Critical Infrastructure Organizations (CGMM-CI), an AI-enhanced maturity assessment framework designed to evaluate cybersecurity governance capability, risk management effectiveness, operational resilience, and institutional preparedness across critical infrastructure sectors. The framework introduces five progressive maturity levels—Initial, Developing, Defined, Managed, and Adaptive—and evaluates organizations across ten governance domains, including executive oversight, cybersecurity accountability, cyber risk management, Zero Trust readiness, vulnerability governance, incident response and recovery, third-party governance, data protection, AI cyber-risk governance, and digital resilience. Unlike traditional maturity models that focus primarily on technical controls or compliance outcomes, the proposed framework integrates governance accountability, resilience engineering, AI-assisted risk intelligence, and strategic decision-making into a unified maturity assessment methodology. The framework further incorporates a weighted governance scoring engine, an Artificial Intelligence Governance Adjustment Factor (AIGAF), and a Digital Resilience Coefficient (DRC) to support future data-driven maturity evaluation and benchmarking. The study contributes to cybersecurity governance literature by providing a structured and scalable maturity model capable of supporting organizational assessment, benchmarking, policy development, resilience enhancement, and future AI-assisted cybersecurity governance initiatives. The framework is designed to support healthcare, telecommunications, energy, transportation, manufacturing, financial services, and other critical infrastructure sectors seeking to improve cybersecurity governance maturity in an increasingly complex digital environment.