## 6 Conclusions and Future Work  
In this article, the problem of cybersecurity configuration of products and systems has been tackled. In particular, the paper is focused on the compliance of those configurations with regard to cybersecurity policies. In order to confront this problem, the CyberSPL framework and its implementation is presented aligned with the five objectives presented. CyberSPL provides users with a set of tools for the definition and the maintenance of a catalogue of cybersecurity policies based on feature models. These policies are associated with different contexts of software products and systems related to cybersecurity to maintain a catalogue (OBJ1). CyberSPL enables the obtaining of the properties of the feature models (OBJ2). On the other hand, CyberSPL enables the automatic detection of configuration failures to validate with cybersecurity policies through the description of features of the different cybersecurity contexts (OBJ3). Moreover, it provides the diagnosis of configurations to isolate and identify the mistakes that cause the non-conformance of the cybersecurity policies (OBJ4). CyberSPL has been evaluated by presenting a catalogue of four real feature models related to a complex scenario encompassed of four different cybersecurity contexts, that is, the configuration of security options in the _Linux_ kernel; the security settings of applications provided by _Android_ SDK API level, the configuration of security channels in the _Apache_ application server, and; the configuration of a Cipher Suite for the _SSL/TLS_ protocol (OBJ5). Those models have been validated and automatic diagnosis capabilities have been also demonstrated fulfilling the defined objectives as described in the methodology Design Science.  
In summary, the CyberSPL framework enables the verification of compliance with cybersecurity policies, and the analysis of product configurations, applications and services that participate. The use of CyberSPL facilitates an important advance in the automated management of cybersecurity policy compliance by cybersecurity managers taken into consideration the results obtained with the evaluation. Moreover, for operational development (DevOps) perspective, where ensuring and checking that a configuration is following the policy, the use of CyberSPL increases the alignment significantly between the development layer and the operational layer.  
Furthermore, our work can be extended in two main directions: (1) to automatically update the feature models in accordance with technological advances or vulnerabilities that occur over time; (2) to maintain a register of the evolution of the feature models for each context, in order to allow more precise diagnosis when changes in cybersecurity policies occur.  
**Author Contributions:** All the authors are responsible for the concept of the paper, the results presented and the writing and contributed equally to this work.  
**Funding:** This work has been partially funded by the Ministry of Science and Technology of Spain by ECLIPSE project (RTI2018-094283-B-C33) and the European Regional Development Fund (ERDF/FEDER) via METAMORFOSIS project.  
**Acknowledgments:** The authors would like to thank the Catedra of Telefonica \"Intelligia en la Red\" of the University of Sevilla for their support in the development of this work, and [PERSON] and [PERSON] for the support of the FAMA tool.  
**Conflicts of Interest:** All the authors have approved the final content of the manuscript. No potential conflict of interest was reported by the authors.