This study explores the development of a maturity model for information security within re- gions and municipalities. The study adopts an exploratory approach to address the limited re- search on the specific challenges and issues that municipalities and regional organizations face in relation to information security. By combining exploratory research questions with an abductive approach, the study aims not only to identify problems and challenges but also to deepen the understanding of these ques- tions in a nuanced way. The methodology involves a qualitative research design, using Diva and Google Scholar as primary sources for literature review. Keywords such as "Information Security," "Maturity Model," and "ISO 27000" were used to collect relevant literature. The data collection involved in-depth interviews with consultants at an IT service provider to gain insights into the challenges faced when evaluating information security practices in re- gions and municipalities. The iterative process of model development and evaluation was guided by Peffer's et al. (2007) framework, ensuring model utility and effectiveness. The results contribute to an overall understanding of information security maturity in the public sector, providing valuable insights for IT service providers and others active in the industry.