title: DEVELOPMENT OF A FRAMEWORK TO EXPLAIN AND JUSTIFY CYBERSECURITY INVESTMENT: - AN ACTION RESEARCH INQUIRY -
Creators: name: Piacquadio, Juan
Publisher: name: University of Liverpool Repository
Year: 2024

description: The research study is conducted in the context of a high-profile organization, targeted by hackers due to its US critical infrastructure status and strategic partnerships. The company's digital media marketing campaigns also attract unwarranted attention, making it a target for cyber-criminals, hacktivists, and malicious actors. Additionally, the organization's adoption of Industry 4.0 technologies, including Operational Technologies, the Extended Internet of Things (XIoT), Machine Learning, mobility, and multi-cloud environments, further amplifies its cyber risk level of exposure. The research framework is guided by action research which implements a collaborative and iterative process of planning, implementing, observing, and reflecting on interventions aimed at addressing real-world problems and driving organizational improvement. By adopting an action research approach, I, as the action researcher, not only directly contribute to practical solutions but also facilitate the implementation of the research outcomes. This ensures that the research is not only academically rigorous but also relevant and impactful in the context of the organization's needs and challenges. As the lead researcher and head of technology at a mid-sized US critical infrastructure organization, I have experienced firsthand the challenges and risks associated with cybersecurity in the modern digital landscape. 
The research framework is based on a qualitative research approach, which allowed for a deeper exploration of the drivers and factors influencing enterprise cybersecurity investment. This approach enabled a comprehensive understanding of the organization's unique cybersecurity needs and provided valuable insights into justifying the necessity of cybersecurity investments. Through interventions, the drivers of enterprise cybersecurity investment are identified and compared to existing literature models. This qualitative framework is crucial as it goes beyond quantitative metrics, capturing the contextual nuances and complexities associated with cybersecurity investments, and ultimately contributing to the development of a robust and effective cybersecurity program within the US-based pharmaceutical company. 
Through this research, I developed a qualitative model that effectively identified and articulated the importance of investing in cybersecurity within my organization. This framework, which was designed to serve as a communication artifact, played a pivotal role in justifying the need for cybersecurity investments and securing a commitment to a sustainable cybersecurity annual budget. The successful implementation of this qualitative model resulted in the allocation of the required budget and resources to support the organization's cybersecurity plan effectively.
The implications of this research are twofold. Firstly, it highlights the importance of internal and external factors in influencing an organization's exposure to cyber threats and, subsequently, its cybersecurity program and investment. Factors such as attacker motivation, regional context, business model, technology landscape, industry, regulatory framework, social and cultural aspects, and training and awareness play a crucial role in assessing a company's cybersecurity profile and determining the level of security investments. Secondly, the research introduces the concept of a qualitative based communication framework as a guiding principle for cybersecurity budget justification.
This research study offers critical insights to help us understanding the significance of cybersecurity investment and the needs in the pharmaceutical industry, providing insights into the drivers and factors that influence investment decisions. The study significance lies in its practical application of research findings to drive positive change within the organization. The framework for cybersecurity budgeting and long-term investment provides a structured approach to optimize resource allocation, prioritize investments, and strengthen the organization's security posture. By integrating theoretical insights with practical implementation, this study contributes to the broader field of cybersecurity and organizational change, facilitating informed decision-making, and promoting resilience in the face of ever-evolving cyber threats. 
Opportunities for further research are identified, including the assessment of long-term impact, implementation, and evaluation of the framework in other organizations, and effective stakeholder engagement. These avenues of research contribute to the continuous improvement and refinement of the framework, enhancing its effectiveness and promoting organizational change in the face of evolving cybersecurity challenges.
Keywords: Cybersecurity Program; Cybersecurity Posture; Cybersecurity Investment; Cybersecurity Investment Factors; Cybersecurity Investment Drivers; Cyber Risk; Hacker Threat.