Portal of Cybersecurity Capacity Maturity Model (CMM) Review Reports

The CMM has been deployed more than 120 times in over 85 nations around the world, including two regional studies in Latin America and the Caribbean through collaboration with the OAS.

Each of the reviews has been coordinated and facilitated either by the GCSCC and one or more of its strategic, implementation or regional partners: Commonwealth Telecommunications Organisation (CTO), Global Forum on Cyber Expertise (GFCE), International Telecommunication Union (ITU), Organization of American States (OAS), World Bank (WB), GIZ (the German agency for international co-operation), NRD Cyber Security (NRD), Norwegian Institute of International Affairs (NUPI), Cybersecurity Capacity Centre for Southern Africa (C3SA), Oceania Cyber Security Centre (OCSC)

• Albania (GCSCC/WB) 2018 Country Report
• Antigua and Barbuda (OAS) 2016 Regional Study and 2020 Regional Study
• Argentina (OAS) 2016 Regional Study and 2020 Regional Study
• Armenia (GCSCC/WB) 2015
• Bahamas, The (OAS) 2016 Regional Study, 2020 Regional Study and 2021 (GCSCC) planned
• Bangladesh (GCSCC/NRD CS) 2018 Country Report
• Barbados (OAS) 2016 Regional Study and 2020 Regional Study
• Belize (OAS) 2016 Regional Study and 2020 Regional Study
• Benin (WB) 2020
• Bhutan (GCSCC/WB) 2015 Country Report
• Bolivia (OAS) 2016 Regional Study and 2020 Regional Study
• Bosnia and Herzegovina (GCSCC/WB) 2018 Country Report
• Botswana (WB) 2019
• Brazil (OAS) 2016 Regional Study and 2020 Regional Study and GCSCC/UK Government/OAS 2018
• Burkina Faso (WB) 2019
• Cabo Verde (WB) 2019
• Cameroon (WB) 2019
• Chile (OAS) 2016 Regional Study and 2020 Regional Study
• Colombia (OAS) 2016 Regional Study and 2020 Regional Study
• Cook Islands (OCSC) 2021 in preparation
• Costa Rica (OAS) 2016 Regional Study and 2020 Regional Study
• Cyprus (GCSCC) 2017 Country Report and 2021 (GCSCC) planned
• Dominica (OAS) 2016 Regional Study and 2020 Regional Study
• Dominican Republic (OAS) 2016 Regional Study and 2020 Regional Study
• Ecuador (OAS) 2016 Regional Study, 2020 Regional Study and 2019 (NRD)
• El Salvador (OAS) 2016 Regional Study and 2020 Regional Study
• Eswatini (CTO/ITU)
• Fiji (GCSCC/CTO) 2015
• Gambia, The (GCSCC/WB) 2018 Country Report
• Georgia (GCSCC/NRD Cyber Security/FCO) 2018
• Ghana (GCSCC/NUPI/WB) 2018
• Grenada (OAS) 2016 Regional Study and 2020 Regional Study
• Guatemala (OAS) 2016 Regional Study and 2020 Regional Study
• Guyana (OAS) 2016 Regional Study and 2020 Regional Study
• Haiti (OAS) 2016 Regional Study and 2020 Regional Study
• Honduras (OAS) 2016 Regional Study and 2020 Regional Study
• Iceland (GCSCC) 2017 Country Report
• Indonesia (GCSCC) 2015 Country Report
• Ivory Coast (WB) 2019
• Jamaica (OAS) 2016 Regional Study and 2020 Regional Study
• Kiribati (OCSC) 2019
• Kosovo (GCSCC/WB) 2015 Country Report and 2019 (GCSCC/WB) Country Report
• Kyrgyzstan (GCSCC/WB) 2017 Country Report
• Lesotho (WB/GCSCC) 2019
• Liberia (WB) 2020
• Lithuania (GCSCC) 2017 Country Report
• Madagascar (GCSCC/ITU) 2016 Country Report
• Malawi (CTO) 2016 and (WB) 2020
• Mauritius (WB/GCSCC) 2019
• Mexico (OAS) 2016 Regional Study and 2020 Regional Study
• Micronesia (OCSC) 2020
• Montenegro (GCSCC/WB) 2015 and 2021 (WB)
• Mozambique (CTO)
• Myanmar (GCSCC/WB) 2018
• Namibia (WB) 2019
• Nicaragua (OAS) 2016 Regional Study and 2020 Regional Study
• Niger (WB) 2019
• Nigeria (GCSCC) 2019 (report available on request)
• North Macedonia (GCSCC/WB) 2018 Country Report
• Panama (OAS) 2016 Regional Study and 2020 Regional Study
• Papua New Guinea (OCSC/ITU) 2019
• Paraguay (OAS) 2016 Regional Study and 2020 Regional Study
• Peru (OAS) 2016 Regional Study and 2020 Regional Study
• Rwanda (CTO)
• Saint Kitts and Nevis (OAS) 2016 Regional Study and 2020 Regional Study
• Saint Lucia (OAS) 2016 Regional Study and 2020 Regional Study
• Saint Vincent and the Grenadines (OAS) 2016 Regional Study and 2020 Regional Study
• Samoa (GCSCC/OCSC/ITU) 2018 Country Report
• Senegal (GCSCC/NL) 2016 Country Report and 2021 (C3SA/WB) in preparation
• Serbia (WB) 2019 Country Report
• Sierra Leone (GCSCC/ITU) 2016 Country Report 
• Somalia (C3SA) 2020
• Sri Lanka (GCSCC/WB) 2019
• Suriname (OAS) 2016 Regional Study and 2020 Regional Study
• Switzerland (GCSCC) 2019 Country Report
• Tanzania (CTO) 2016
• Thailand (GCSCC/ITU) 2016
• Tonga (GCSCC/OCSC/ITU) 2018
• Trinidad and Tobago (OAS) 2016 Regional Study and 2020 Regional Study
• Tunisia (GCSCC/GIZ) 2019
• Tuvalu (OCSC) 2021
• Uganda (GCSCC) 2015 Country Report and 2020 (C3SA)
• United Kingdom (GCSCC) 2015 Country Report and 2021 (GCSCC) planned
• Uruguay (OAS) 2016 Regional Study and 2020 Regional Study
• Vanuatu (OCSC/ITU) 2019
• Venezuela (OAS) 2016 Regional Study and 2020 Regional Study
• Zambia (WB) 2017

Status: March 2021

This list is subject to change as our partners and us continue to deploy the CMM around the world. Please check for updates on this Portal or follow the GCSCC on Twitter @CapacityCentre and LinkedIn https://www.linkedin.com/company/global-cyber-security-capacity-centre/

If you are interested in the CMM, how it is deployed and how the countries are using the CMM report and recommendations, please contact us: cybercapacity@cs.ox.ac.uk