Abstract

Cybersecurity maturity models, such as NIST CSF, C2M2 and ISO 27001, offer structured frameworks to evaluate organizational security postures. However, these models often fail to provide actionable and prioritized roadmaps to improve cybersecurity practices. To address this limitation, we introduce a scalable, service-oriented platform that operationalizes the AIM Triad - a context-aware strategy that encompasses Awareness, Infrastructure, and Management - to facilitate systematic improvements in cybersecurity maturity. Unlike conventional approaches, the platform generates two distinct outputs: standards-compliant assessment reports aligned with frameworks like C2M2, and customized, prioritized action plans tailored to organizational requirements. The system is built on a microservice architecture utilizing Vue.js, NestJS, and Flask, with Kubernetes orchestration ensuring modular adaptability across multiple maturity frameworks while maintaining scalability and resilience. Our proposed platform incorporates custom prioritization of security actions based on organizational needs, automated simulation of maturity assessments through a model-agnostic engine, and PDF-based reporting to support compliance and strategic planning. By bridging the gap between diagnostic evaluations and executable strategies, the platform serves as a blueprint for next-generation tools designed to advance cybersecurity improvement efforts, specially tailored for small and medium-sized organizations (SMO), but also for public institutions. © 2025 IEEE.