Critical infrastructures have one of the most important roles for our economy, society and government. The information systems that are often controlling and managing processes from this type of organizations, must fulfill stringent safety and security requirements. As a result, cyber security management becomes a challenging task due to the number, interdependencies and role that information systems have. In this paper we will propose a model to evaluate the cyber security maturity in critical infrastructures, taking into account both technological and human dimension aspects. This will support decision makers in identifying priorities and gaps when it comes to cyber security. This model will be customized for the given context, however it can be adapted and used by any type of organizations.