An Integrated Project Management Maturity Model for Digital Qazaqstan Initiatives: Embedding Cybersecurity, AI Governance and Forward-Looking Cyber-Risk Requirements into ST RK ISO 21502-2022

Abstract

The Nationwide Strategy "Digital Qazaqstan" until 2029, approved by Presidential Decree No. 1311 of 9 June 2026, and its Action Plan, approved by Government Resolution No. 760 of 26 August 2026, commit central and local state bodies and national companies to 136 measures, a large share of which deploy artificial intelligence (AI) in citizen-facing, business-facing and intra-governmental services. Project offices that are now translating these measures into implementation plans must simultaneously satisfy the project-management guidance of ST RK ISO 21502-2022, the information-security requirements of ST RK ISO/IEC 27001-2023 and the Unified Requirements on ICT and information security, and the emerging AI-management requirements of ST RK ISO/IEC 42001-2025, ISO/IEC 42005:2025, ISO/IEC 42006:2025 and the Law of the Republic of Kazakhstan "On Artificial Intelligence". Existing project-management maturity models are domain-neutral and contain no cybersecurity or AI-governance criteria, whereas cybersecurity and AI maturity models ignore the project life cycle. This article proposes an integrated project management maturity model (IPM3-DQ) that extends a ST RK ISO 21502-2022 practice-based baseline with three cross-cutting domains: cybersecurity (S), AI governance (A) and forward-looking cyber risk (F). The model uses a uniform 0–5 anchored scale, AHP-derived weights differentiated by project class, and a non-compensatory gating rule under which the maturity level of a project involving critically important digital objects or AI systems cannot exceed its security or AI-governance level by more than one level. A worked example of a G2C AI-assistant project shows that the conventional arithmetic-mean approach classifies the project as "Managed" (3.67), whereas the integrated model places it at "Defined" (2.67) with AI governance as the binding constraint. A validation protocol based on expert panels, Kendall's W, Cronbach's alpha and intraclass correlation is specified. The model gives project offices of state bodies a single instrument for self-assessment, audit and semi-annual reporting under the Action Plan, and provides the regulator with a maturity-based lens for the national cybersecurity standardisation programme.