Portal of Cybersecurity Capacity Maturity Model (CMM) Review Reports

The CMM has been deployed more than 120 times in over 85 nations around the world, including two regional studies in Latin America and the Caribbean through collaboration with the OAS.

Each of the reviews has been coordinated and facilitated either by the GCSCC and one or more of its strategic, implementation or regional partners: Commonwealth Telecommunications Organisation (CTO), Global Forum on Cyber Expertise (GFCE), International Telecommunication Union (ITU), Organization of American States (OAS), World Bank (WB), GIZ (the German agency for international co-operation), NRD Cyber Security (NRD), Norwegian Institute of International Affairs (NUPI), Cybersecurity Capacity Centre for Southern Africa (C3SA), Oceania Cyber Security Centre (OCSC)

• Albania (GCSCC/WB) 2018 Country Report
• Antigua and Barbuda (OAS) 2016 Regional Study and 2020 Regional Study
• Argentina (OAS) 2016 Regional Study and 2020 Regional Study
• Armenia (GCSCC/WB) 2015
• Bahamas, The (OAS/IDB) 2016 Regional Study, 2020 Regional Study and (GCSCC/OAS/ITU) 2021 
  
• Bangladesh (GCSCC/NRD CS) 2018 Country Report
• Barbados (OAS) 2016 Regional Study and 2020 Regional Study
• Belize (OAS) 2016 Regional Study and 2020 Regional Study
• Benin (WB) 2020
• Bhutan (GCSCC/WB) 2015 Country Report
• Bolivia (OAS) 2016 Regional Study and (OAS/IDB) 2020 Regional Study
• Bosnia and Herzegovina (GCSCC/WB) 2018 Country Report
• Botswana (WB) 2019
• Brazil (OAS/IDB) 2016 Regional Study and (OAS/GCSCC) 2020 Country Report and (OAS/IDB) 2020 Regional Study and (GCSCC) 2023 Country Report
• Burkina Faso (WB) 2019
• Cambodia (JICA/GCSCC) 2023
• Cameroon (WB) 2019
• Cabo Verde (WB) 2019 Country Report
• Chad (C3SA/ITU) 2021
• Chile (OAS/IDB) 2016 Regional Study and (OAS/IDB) 2020 Regional Study
• Colombia (OAS/IDB) 2016 Regional Study and (OAS/IDB) 2020 Regional Study
• Cook Islands (OCSC) 2021
• Costa Rica (OAS/IDB) 2016 Regional Study and (OAS/IDB) 2020 Regional Study and (FCDO) 2024
• Cyprus (GCSCC) 2017 and (GCSCC) 2021
• Dominica (OAS/IDB) 2016 Regional Study and (OAS/IDB) 2020 Regional Study
• Dominican Republic (OAS/IDB) 2016 Regional Study and (OAS/IDB) 2020 Regional Study
• Ecuador (OAS/IDB) 2016 Regional Study, (OAS/IDB) 2020 Regional Study, (NRD CS) 2020, (WB) 2022 Country Report
• El Salvador (OAS/IDB) 2016 Regional Study and (OAS/IDB) 2020 Regional Study
• Eswatini (CTO/ITU) 2017
• Fiji (GCSCC/CTO) 2015, (OCSC) 2024
• Gambia, The (GCSCC/WB) 2018 Country Report
• Georgia (GCSCC/NRD CS/FCO) 2018
• Ghana (GCSCC/NUPI/WB) 2018
• Grenada (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Guatemala (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Guyana (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Haiti (OAS/IDB) 2016 Regional Study and 2020 Regional Study, (WB) 2023
• Honduras (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Iceland (GCSCC) 2017 Country Report
• Indonesia (GCSCC) 2015 Country Report
• Iraq (GCSCC/NATO) 2022
• Ivory Coast (WB) 2019
• Jamaica (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Kiribati (OCSC) 2019
• Kosovo (GCSCC/WB) 2015 Country Report and (GCSCC/WB) 2019 Country Report
• Kyrgyzstan (GCSCC/WB) 2017 Country Report
• Lesotho (WB/GCSCC) 2017, (C3SA) 2022 Country Report
• Liberia (WB) 2020
• Lithuania (GCSCC) 2017 Country Report
• Libya (GCSCC) 2023
• Madagascar (GCSCC/ITU) 2016 Country Report
• Malawi (CTO) 2016 and (WB) 2020
• Mauritius (WB/GCSCC) 2019
• Mexico (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Micronesia, Federated States of, (OCSC) 2020
• Mongolia (GCSCC/UK FCDO/JICA) 2024
• Montenegro (GCSCC/WB) 2015 and (WB) 2021
• Morocco (GCSCC & UK Home Office) 2021
• Mozambique (CTO) 2016
• Myanmar (GCSCC/WB) 2018
• Namibia (WB) 2019
• Nauru (OCSC) 2022
• Nicaragua (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Niger (WB) 2019
• Nigeria (GCSCC) 2019 (report available on request)
• North Macedonia (GCSCC/WB) 2018 Country Report
• Panama (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Papua New Guinea (OCSC/ITU) 2019
• Paraguay (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Peru (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Rwanda (CTO) 2017, (NRD CS/UK Home Office) 2022
• Saint Kitts and Nevis (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Saint Lucia (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Saint Vincent and the Grenadines (OAS) 2016 Regional Study and 2020 Regional Study
• Samoa (GCSCC/OCSC/ITU) 2018 Country Report
• Senegal (GCSCC/NL) 2016 Country Report
• Serbia (WB) 2019 Country Report
• Sierra Leone (GCSCC/ITU) 2016 Country Report 
• Somalia (C3SA/WB) 2021
• Sri Lanka (GCSCC/WB) 2019
• Suriname (OAS/IDB) 2016 Regional Study and (OAS/IDB) 2020 Regional Study
• Switzerland (GCSCC) 2019 Country Report
• Tanzania (CTO) 2016
• Thailand (GCSCC/ITU) 2016
• Tonga (GCSCC/OCSC/ITU) 2018
• Trinidad and Tobago (OAS) 2016 Regional Study and 2020 Regional Study
• Tunisia (GCSCC/GIZ) 2019
• Tuvalu (OCSC) 2021
• Uganda (GCSCC) 2015 Country Report and 2020 (C3SA)
• United Kingdom (GCSCC) 2015 Country Report
• Uruguay (OAS) 2016 Regional Study and 2020 Regional Study
• Vanuatu (OCSC/ITU) 2019
• Venezuela (OAS/IDB) 2016 Regional Study and 2020 Regional Study
• Zambia (GCSCC/WB) 2017

Status: October 2024

This list is subject to change as our partners and us continue to deploy the CMM around the world. Please check for updates on this Portal or follow the GCSCC on Twitter @CapacityCentre and LinkedIn https://www.linkedin.com/company/global-cyber-security-capacity-centre/

If you are interested in the CMM, how it is deployed and how the countries are using the CMM report and recommendations, please contact us: cybercapacity@cs.ox.ac.uk