## 3 The Cyber Trust Index (CTI) Framework
The application of AHP begins by constructing multiple logical hierarchies for the systematic assessment of the enablers by making pairwise comparisons for each of the selected criteria against the goal. Our goal is to select Control Enablers that primarily contribute to the security control performance, and our chosen criteria are Mandate, Support, and Influence, which are the qualifying criteria that were stated earlier. Then, the candidate enablers were mapped with the hierarchical structure, as illustrated in Figure 2.  
To accommodate the rating process, we decided to use a 9-point scale, which was recommended by [PERSON] [51], mainly because the scale provided the proper level of granularity and can adequately classify the options upon presentation to experts. The rating for each pair was obtained from experts' consensus during a focus group meeting. Based on the rating results, a normalized criteria table was created, and an Eigenvector (\(\lambda\)) was calculated and used as a weight for assessing the enablers. Based on [PERSON], we used the Random Consistency Index (RI) of 3 for \(n=3\), and the Consistency Index (CI) and Consistency Rate (CR) have been computed using Formulas (1) and (2),  
Figure 2: Hierarchy of goals, criteria, and candidate enablers. respectively. The CR rate was 8.34%, which is less than 10%, so our table can be considered consistent. \[CI=\frac{(\lambda_{max}-n)}{(n-1)} \tag{1}\]  
\[CR=\frac{CI}{RI} \tag{2}\]  
In the next step of the process, a normalized comparison table of candidate Control Enablers and their criteria was created using the weights obtained from the previous step, as described in Table 3. Likewise, the rating for each pair using [PERSON]'s scale was obtained from experts during a focus group meeting. From the AHP results, we can select the top five enablers that most affect our goal. Some of them, such as Policies and Procedures and Organization Structure with Role and Responsibility, have been renamed to improve clarity and understanding. The selected Control Enablers for our framework are listed in Table 4. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Control Enabler** & **Descriptions** & **References** \\ \hline Organization Direction and Process (OP) & Organization Direction and Process refers to how organizations document, mandate, and communicate their cybersecurity direction in the form of policies or procedures. & [52, 53, 54, 55, 56, 57, 58, 59, 60] \\ \hline Organization Structure (OS) & Organization Structure refers to how organizations clearly define roles and responsibilities for cybersecurity controls or tasks and assign resources accordingly. & [52, 54, 61, 62, 63, 64, 65] \\ \hline Automation (AT) & Automation refers to the degree to which security controls are performed automatically to ensure that the controls are continuously operated and updated with minimum human intervention. & [54, 66, 67, 68, 69, 70, 71] \\ \hline Performance Evaluation (PE) & Performance Evaluation refers to how an organization defines metrics for security control outcomes, performs measurements to validate the outcome, and takes corrective or improvement actions as necessary. & [18, 54, 72, 73, 74, 75, 76, 77] \\ \hline Reporting (RP) & Reporting refers to how the output or key information produced from security controls is reported to the intended audience. & [54, 77, 78, 79, 80] \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Proposed Control Enablers.