Introduction

In the context of public or private organisations, the concept of the term "security" could currently be understood in two ways: as a state or perception, and as a process of risk reduction and protection, or resilience building in the face of possible threat scenarios, (Jore 2019, pp. 157–174).

Security understood as a state or perception can vary significantly according to different 'situational factors' and, notably for individuals, between different places and times of day, also taking into account that such perceptions can be influenced by the adoption of situational crime prevention measures (Hirschfield 2004, pp. 9–20) (George and Mawby 2013, pp. 93–104) or the degree of familiarity with the risk (Borodzicz and Gibson 2007, p. 142). At the organisational level, boards of directors of large companies are paying attention to security risks, as these are also perceived as a cause of disruption in international business (Goosman 2022, pp. 237–244) (Dau et al. 2018, pp. 79–97) (White 2013, pp. 425–442); while depending on the functional area asked, perceptions may vary within the organisation itself (Burns 2016).

Security understood as a process (in addition to routinely managing those operational risks of organisations intentionally induced by humans) actively collaborates in obtaining and analysing intelligence information received by senior management for strategic decision-making (Crump 2015), as well as in comprehensive crisis management (Borodzicz and Gibson 2007, p. 142) when facing serious disruptive events (global pandemics, natural disasters, large-scale cyber-attacks, etc.).

In an earlier study by the authors on security risk management, it was concluded that, over the last thirty years, the discipline of security risk management has established itself on the one hand as a subject area in its own right, and on the other hand as a field closely linked to enterprise risk management (hereafter ERM). Among its conclusions, it was considered pertinent to delve deeper into the current contribution to the organisational resilience of a security management system (hereinafter SMS) based on Enterprise Security Risk Management (hereinafter ESRM). In parallel, it was highlighted that it would also be relevant to identify and analyse the managerial implications of corporate security leadership and its capacity to promote organisational resilience through ESRM.

To avoid the SMS being misaligned from the rest of the organisation's corporate functions and the achievement of its objectives (Bernardo et al. 2018, pp. 453–480), such a system should be embedded in the organisation’s integrated management system (hereinafter IMS), together with other corporate areas involved in risk governance. Especially those areas with shared responsibility for the governance and implementation of processes that constitute, together with risk management, the core of the organisations' operational resilience and the preparation of their response plans: crisis management, business continuity and emergency or incident management (Mehravari 2013, pp. 119–125).

According to Petruzzi y Loyear (Petruzzi and Loyear 2016, pp. 44–56), ESRM involves all parts of businesses, proactively recognising and addressing risk without overlooking that the alignment of business continuity and crisis management within the ESRM philosophy are key requirements in any resilience programme. Along these lines, ASIS International already refers to these resilience processes in its standard ORM.1–2017 "Security and Resilience in Organisations and their Supply Chains"(ANSI/ASIS 2017). It is closely linked to sustainability and the supply chain, where it highlights the need to “continually integrate and optimise their risk and business management processes”. In the fields of business management and supply chain management, sustainability is considered a component of resilience, i.e. increasing the sustainability of the system makes the system more resilient (Balugani et al. 2020, p. 1742). According to Ogrean (Ogrean 2018, pp. 526–536), both of these—resilience and sustainability—have emerged as some of the biggest challenges facing organisations in their strategic pursuit of performance and competitiveness.

In the current Volatile, Uncertain, Complex and Ambiguous (V.U.C.A.) environment, in which companies and organisations operate, it is necessary to improve the efficiency of their internal processes through specific management systems. Many of them have started by implementing one or more management systems, usually beginning with quality, environmental and occupational health and safety, but as the number of management systems to be implemented grew, problems arose from the multiplicity of management systems, which were subsequently mitigated after the implementation of IMS (Zeng et al.

  • o

    Purpose and scope.

  • p

    Standards for consultation.

  • q

    Terms and definitions.

  • r

    Organisational context.

  • s

    Leadership.

  • t

    Planning.

  • u

    Support.

  • v

    Operation.

  • w

    Performance evaluation.

  • x

    Improvement.

    • The content of each of the first three clauses is discipline-specific and each standard may even have its own associated bibliography. From a governance and compliance point of view, the remaining seven sections are perfectly quantifiable for any organisation that intends to implement it, and a desirable target maturity level could therefore be determined.

    Security management systems

    Among the international standards and guidelines related to security are those described in Table 3. Although no two security functions are the same, many organisations often appoint a senior security executive to implement a strategic security framework with a wide range of responsibilities (ASIS 2022a), particularly in multinationals or where they are required for regulatory compliance such as in the case of critical infrastructure, essential services or a state's defence-related industry. Of these, ISO 28000 has been revised in 2022 and now allows for better alignment with ISO 31000 in terms of recommendations on principles; and also with ISO 22301 in terms of security strategies, procedures, processes, treatments and security plans. Figure 5 shows that ISO 28000 also applies the Plan-Do-Check-Act (PDCA) model to plan, establish, implement, operate, monitor, review, maintain and continually improve the effectiveness of an organisation's security management system. This ensures a degree of consistency with other management system standards, such as ISO 9001, ISO 14001, ISO/IEC 27001, and ISO 45001, which ensures consistent and integrated implementation and operation with related management systems.

    Table 3 List of guidelines and standards related to security risk management available from various sources
    Full size table
    Fig. 5
    figure 5

    PDCA model applied to the security management system, extracted from ISO 28000:2022

    Full size image

    Integrated management systems

    According to the Spanish Association for Quality, the integration of management systems is defined as the set of related or interacting elements that make it possible to implement and achieve the policy and objectives of an organisation, in terms of various aspects such as quality, environment, health and safety, or other management disciplines (AEC 2019). For reasons of efficiency in implementation, reduced bureaucracy, ease of auditability, and a better unitary vision, organisations tend to develop integrated management systems in such a way that links their components, instead of kee** each management system separate in silos (Calvo and Zapata 2010, pp. 1555–1564), regardless of which function within the company is ultimately responsible for governing them within its area of responsibility. Other authors highlight that this integration uses common resources to support the improvement of stakeholder satisfaction (Bernardo et al. 2017, pp. 121–133). Both ISO and BSI organisations, among others, have also contributed to the integration of these management systems, especially due to the similarities and compatibility of these standards, such as ISO 9001, ISO 14001, ISO 45001 or PAS 99.

    There could be different motivations for implementing an IMS, such as customer or public regulator requirements, or following the competitors' lead. If we focus on the benefits, it is obvious that simplifying the number of audits and the process of self-certification or certification bodies, it reduces the associated costs and bureaucracy. (Zeng et al. 2010, pp. 171–179). It also seems logical that the greater the number of systems and processes to be integrated, the greater the difficulty of implementation. (Bernardo et al. 2012, pp. 23–33). There is abundant literature addressing the benefits and drawbacks of IMS implementation, including delving into the different levels of integration and strategies adopted (Domingues et al. 2016, pp. 164–174), but it must be up to each organisation to determine the boundaries and applicability of the IMS to establish its scope.

    In accordance with the purpose of this study, a proposed methodology will be presented through which we will be able to discern the state of our security management system, with sufficient flexibility to indicate its level of maturity regardless of the matters attributed by each organisation to the security function, including the transversal governance of the organisation's operational resilience.

    Methodology

    The academic community is already aware of the urgency regarding resilience and has some development in this area. However, there is still limited research on metrics, the delivery mechanism and the relationship with other organisational variables (**ao and Cao 2017, p. 4021), such as its interaction with security as a function responsible for the governance of operational resilience within the organisation. There are a number of integrated organisational resilience models that have been successfully implemented in a variety of different organisations, but for such models to make a significant contribution to organisational resilience, they must be based on a robust risk management programme that provides the foundation that links different organisational capabilities, such as emergency, business continuity, security, and crisis management (Gibson and Tarrant 2010, pp. 8–14).

    A Maturity Model (MM) is a technique that has proven valuable for measuring different aspects of a process or an organisation and represents a path towards an increasingly organised and systematic way of doing business in organisations (Proença and Borbinha 2016, pp. 1042–1049). The authors of this research have also reviewed the literature on governance models for security risk based on ESRM, noting an incipient production in academia of specific models that determine the maturity of a security management system linked to organisational governance and ERM through an ESRM programme, to have a clear correspondence not only with internationally recognised management systems, but also with the specificity of the operations inherent to the security function within their organisation.

    In the review of the international standards related to security, it has been noted that the specifications of some of the standards are not specific, remaining at a very general level and serving only to indicate compliance or non-compliance under the auditor's criteria, but without providing a breakdown of the minimum points that determine the level of maturity in the operational area. For this reason, a flexible model is needed in terms of the attributes that can be selected from a wide range, historically entrusted to the business security function and corporate security departments of organisations, such as security of assets, people, and information; but also crisis management and intelligence. All common steps in the structure of an ISO standard are met in this model, with the "Operation" section being the one that will vary from one organisation to another without influencing the final maturity assessment, allowing flexibility in the operational approach chosen by the organisation. For example, there will be organisations where security has operational responsibility for crisis management, in others, it will have prerogatives in terms of business continuity or emergency management, whilst it is also common for it to have intelligence attributions (ASIS Foundation 2022) in support of the business strategy. This model makes it possible, regardless of the powers assigned to security, to establish a level of maturity and strategies to advance from an initial starting point to the desired level for senior management in accordance with its strategic objectives.

    Organisations where the corporate security function is also in charge of the cross-cutting governance of operational resilience, even if the responsibility for its implementation lies with the business itself, can utilise the flexibility of this model by matching resilience management systems (i.e.: ISOs 22316, 22361, 22301 and 22320) and security-specific ones (i.e.: ISO 28000). As can be seen in Fig. 3, the whole process of operational resilience could be divided into three phases. The first phase begins with the implementation of the management system, which may be embedded within the security management system, and continues until the moment when an event previously identified as triggering one or more of the response plans occurs, either by a real disruptive scenario or the performance of an exercise created for testing and training the teams. The third phase is the "new normal" phase, where the acquired capabilities will be part of the continuous improvement process included in the first phase.

    Results

    Taking into account all of the above, a model called ERMsec © has been developed, which is made up of a questionnaire divided into two sections. The first section consists of six initial control questions that help to frame the organisation within its geographical and activity sector (Fig. 6), and a second section with thirty-four variables distributed in seven parts that coincide with the seven clauses of Fig. 5. The result of the second section determines the maturity level according to the Capability Maturity Model Integration scale initially developed by Carnegie Mellon University (CMMI Institute 2020), in establishing 5 levels of process maturity: Non-Existent/Not Wanted (0); Ad Hoc (1); Repeatable (2); Defined (3); Managed (4); Optimised (5).

    Fig. 6
    figure 6

    © questionnaire. Source own elaboration

    First section of the ERMsec

    Full size image

    A variable is a magnitude whose values are the object of study, and its definition makes measurable what is intended to be evaluated (Medianero Burga 2014, p. 61). In general, a variable (Fig. 7) has five basic elements:

    1. I.

      Name. It should be short and easy to remember. It must be unambiguous, avoiding confusion with other variables.

    2. II.

      Operational definition. A variable is an attribute or characteristic that can be measured, but that without an adequate operational definition could not be measured.

    3. III.

      Criteria for reference measurement. To measure the variables, it is necessary to indicate the measurement scale that will be used for information processing. In this tool, each variable has included requirements that will serve as a reference to obtain a value associated with the CMMI maturity level. For example, if any one of the requirements is met, the value of the variable will be "1" at the CMMI maturity level; and if all the requirements are met, the value will be "5".

    4. IV.

      Procedure to collect the data. To obtain data from primary sources, a survey has been prepared consisting of questions and their responses, which for their systematic processing have been grouped into two sections with different measurement scales.

    Fig. 7
    figure 7

    © questionnaire. Source own elaboration

    Example of a variable in the second section of the ERMsec

    Full size image

    The first section is made up of six initial control questions, which are not complex as it is easy to obtain a numerical value, choose an option from a list or fill in a free text field. These questions will allow us to compare organizations according to their position in the stock market, sector of activity, resources allocated to the security function and the position of the Senior Security Executive and its department in the organization's hierarchy. (Fig. 6).

    The second section consists of a total of thirty-four variables, with their respective criteria for reference measurement. In order to develop a high-level assessment that would provide consistent and substantiated results, an effort was made to identify the key cross-cutting compliance indicators of the international standards on which each of the variables, which contains the detailed assessments of the management system, is based. The international norms and standards that have been correlated to develop each of the issues in the second section have been, among others: COSO ERM – 2017; UNE-EN-ISO 22301:2019; ISO 22316:2017; UNE-ISO 28000:2007; UNE-ISO 31000:2018; UNE 166006:2018; UNE-EN ISO/IEC 27001; ESRM Maturity Assessment (ASIS 2022b); ANSI/ASIS ORM.1-2017; ANSI/ASIS/RIMS RA1-2015; ANSI/ASIS PAP.1: 2012; ANSI/ASIS PSC.1: 2012; BS 65000:2014. The correlation between them has been based on Annex SL (ISO 2021).

    1. V.

      Indicators of data collected. These two sections of the questionnaire will make it possible to compare the results obtained in order to determine whether the company's position in the market or sector, as well as the size of the resources, influence the maturity of the integrated security management system.

    In the second section, there are the questions that will allow for specific data to be obtained about the management system itself, and the assessments that will result in both the partial result of each of the questions and the total result of the questionnaire. The result of each of the seven parts in Fig. 8 will be the average of the questions that compose it and will be represented graphically. Those graphs have also been incorporated in the results template to improve its comprehension and therefore facilitate the determination of action plans to reach the desired target (an example segment is available in this link). In addition, it allows for the comparison of business units within the organisation itself, specific operations or comparisons with other organisations in its sector or area of influence. It would be recommended for a better strategic governance to set a reference target to compare with the resulting value, as shown in Fig. 9.

    Fig. 8
    figure 8

    Source own elaboration

    Example of ERMsec@ questionnaire results.

    Full size image
    Fig. 9
    figure 9

    Source own elaboration

    Example of ERMsec@ graph based on questionnaire results.

    Full size image

    In part 5 of the second section, which coincides with the "Do" of the Deming cycle, a proposal is made for security-related operations, which can be adapted to each organisation. In each of the security activities, it is desirable that the issues to be assessed come from a standardised source, such as the information systems security activity which has been referenced to ISO 27000. It should be noted that it does not take into account who owns the risk (the function or the business unit) or who is responsible for its management, as the aim here is to visualise the security management system situation either in the organisation as a whole or in a specific business unit.

    Conclusions

    Within organisations, security—understood as a process —bases its implementation on the management of the risks in its scope through ESRM, constituting a thematic area closely linked to ERM, but not necessarily requiring ERM to be already implemented in the organisation (Feeney 2019). In order to further explore how the security function contributes to organisational resilience, it has been demonstrated through a theoretical framework and literature review that it is possible and desirable to create security management and operational resilience models that are compatible with existing IMS in organisations. In the review of academic literature in prestigious databases, no such models have been found, which is why the proposed model is considered to be academically innovative and also a contribution to the strategic management of organizations and enterprises; as this model is equipped with a structure and a questionnaire through which the current maturity level is obtained, and even with the option of adjusting the target level within the strategic planning decided by each organisation, in line with its business objectives. This model is a governance tool for the security function while being flexible, as it allows the comparison of different businesses or sub-units within the organisation's own structure and even with other organisations, regardless of their size, sector of activity or geographical location.

    In general, those organisations with multiple management systems perceive more benefits than those that executed only one standard or are managed separately in silos. While there is no single quick fix, single process, management system or software application that creates resilience (Gibson and Tarrant 2010, pp. 8–14) this does not preclude organisations from being able to establish the sweet spot they want to achieve in line with their strategic objectives. The ERMsec© model is based on the ideas proposed for the operational resilience process, providing an academic basis and scientific support to practitioners, mainly in its business application due to its flexibility to adapt to different types of organisations. The next step after proposing this model would be to test it through a process of quantitative research through surveys of large business organisations, for which preliminary tests have already been carried out and now require a formal study.

    In the future, it would be interesting to delve deeper into a maturity framework that encompasses not only the operational resilience component, where the security function in companies contributes value, but the whole of organisational resilience in a transversal framework of a strategic nature, where some authors (Gracey 2020, pp. 313–327) (Denyer 2017, pp. 8–25) (Balugani et al. 2020, p. 1742) have already made some concrete proposals, and others propose its close connection with another strategic challenge such as sustainability (Ogrean 2018, pp. 526–536). Also related to operational resilience is the possibility of future studies on the operation of intelligence to support operational resilience in decision-making by crisis committees, business continuity and incident response teams. Other possible lines of research that emerge from this study:

    • Transfer this methodology to small and medium-sized companies, with a simpler survey that facilitates online responses from a larger number of companies, and that allows for comparison of key points with the first study carried out in large companies.

    • Based on the ASIS SSE-2022 Senior Security Executive Standard (ASIS 2022a) the managerial implications of security leadership and its ability to influence the promotion of operational resilience through ESRM could be further explored academically.

    • Resilience capability will depend to a large extent on the expertise of the organisation's specialists and managers (Groenendaal and Helsloot 2020, pp. 102–109), which is why it is necessary to propose new models of intervention for managers who sit on committees and exercise leadership in crisis management (Lalonde 2011, pp. 443–464).

    • Deepen in operational areas, potentially within the security area of responsibility such as intelligence, information security or operational resilience (incident management, business continuity and crisis management) transversally throughout the organisation.