## 5 Discussion
### Leverage Control Enabler to Drive Cybersecurity Performance--The Internal Factor  
Referring to RQ2, we aimed to identify the key factors that drive cybersecurity performance. Table 12 shows that top performer organizations (org score 81-93) have all Enablers (OP, OS, AT, PE, RP) in Tier 4 or more with an average Enabler score of 4+. Advanced organizations have most Enablers in Tier 3-4 with an average Enabler score of 3-3.9. Intermediate organizations have some Enablers in Tier 2 or 3 with an average Enabler score of 2-2.9. Last, beginner organizations have most Enablers in Tier 1 with an average Enabler score of 0-1.9. As illustrated in Figure 7, the positive correlation confirms that Control Enablers in the higher Tiers will help organizations achieve better cybersecurity performance. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Group** & **Beginner** & **Intermediate** & **Advanced** & **Leader** \\ \hline Capability Tier & 0–2 & 2–3 & 3–4 & 4+ \\ \hline Enabler Score & 0–1.9 & 2–2.9 & 3–3.9 & 4+ \\ \hline Org CTI Score & \(\leq\)50 & 51–70 & 71–80 & 81–93 \\ \hline Grade & F & D–C & B & A \\ \hline \hline \end{tabular}
\end{table} 
Table 12: Organization cybersecurity performance profile based on Capability Tier and Enabler Score. Figure 7: Contribution of Control Enabler to Organization Cybersecurity Performance. By analyzing the profiles of leader organizations in Figure 7, we found the five best practices that can deliver a better cybersecurity performance--all are closely tied to our Control Enablers. 1. Make the security policy and process \"live\". Although many organizations nowadays are shifting focus from policy-based to platform- or technology-based security controls, policy- and process-based controls are still important, especially in areas where technology is not mature or costly [16; 87]. One of the critical success factors of advanced entities in CTI ranking is that they have a documented policy and process, communicate them to all stakeholders, and take proactive steps to ensure that the policies and processes are consistently followed. Organizations can implement this best practice by improving the OP Enabler to reach at least Tier 4. In fact, OP is the most cost-effective Enabler based on the responses of leader organizations, as it helps drive the performance of most clusters in all dimensions. 2. Build human-centric cybersecurity. There are four subsequent best practices that organizations can follow and all of them are part of leveling the OS Enabler up to Tier 4: (1) Roles and responsibilities must be clearly defined for employees who will take care of security controls operations. These roles must cover all clusters of the CTI. Once defined, the roles and responsibilities must be reviewed and updated on an annual basis; (2) ensure that the security team has adequate staff; (3) consider segregating or having dedicated roles for some specific CTI clusters, such as Legal, Risk Management, Human Resource Management, Access and Privilege Management, Incident Management, and Business Continuity Management. These are the top dedicated roles that have been reported by leader organizations; and (4) since humans are the first line of defense [107; 108], organizations must cultivate human-centric cybersecurity by constantly raising awareness and providing security education that is appropriate for each role. The content of the training and awareness education must be reviewed for its effectiveness. Additionally, employees and the security team must be consistently evaluated to ensure the possession of adequate skills and knowledge for their roles and responsibilities. 3. Use technology to optimize operations. Organizations should harness modern technology, such as cybersecurity automation, AI, and machine learning, to deliver better results, reduce staff workload, and enable faster cyber threat detection and response. Automation is one of our recommended Enablers. The organization can gain significant value by implementing automation technology at Tier 4 of the OT Enabler.