# From Security Frameworks to Sustainable Municipal Cybersecurity Capabilities
## 3 Methodology
### Interactive Expert Interviews and Card-Sorting Activity: A Co-Creative Dialogue  
Each expert interview session was designed as an interactive and iterative process forming a co-creative dialogue between the researcher-practitioner and the expert participant, centered around a modified Delphi card-sorting activity [11] and guided by a semi-structured interview approach based on [PERSON]'s diamond aspects. The card-sorting methodology provides for an interactive interview with a tangible and engaging technique, thus benefiting the flow of the discussion and aiding in the discussion of abstract concepts. Card sorting is a method for knowledge elicitation used in several research areas to elicit mental models or domain knowledge. The method has its origin in psychological research [49], but has been used in different fields, such as developing human factors categories for learning from maritime accidents [50], for understanding differences in risk perception of online cybersecurity warnings between children and adults [51], or determining the required cybersecurity knowledge levels of strategic-level decision makers [52]. The cognitive load of card sorting with many cards [53] was addressed by using a modified Delphi approach [9], presenting participants with a model that they gradually modified. While the traditional Delphi method aims for consensus-building through iterative rounds of expert consultation, this study adapts the card-sorting method primarily as a qualitative tool to: (a) structure the interview process around concrete cybersecurity tasks; (b) leverage the researcher's and experts' shared understanding of cybersecurity terminology to elicit knowledge about how these tasks are understood and categorized by experts in practice; (c) encourage interactive engagement and \"thinking aloud\" about complex, abstract concepts related to cybersecurity capabilities, fostering a collaborative exploration; and (d) provide a tangible artifact for exploring and refining a capability model together with each expert. The quantitative data generated by card sorting (e.g., measures of agreement) are considered secondary and serve primarily to support and contextualize the rich qualitative data derived from the sorting process and subsequent in-depth discussions. While alternative methods such as brainstorming (focused on idea generation) and the Nominal Group Technique (NGT, for structured prioritization) exist for group input, this study required a method suited for the iterative co-creation of a nuanced capability model. Our modified Delphi approach, which incorporates interactive card sorting, was chosen because it enabled structured, tangible engagement with complex tasks, allowed for iterative refinement based on expert feedback, and generated rich qualitative insights through a \"think-aloud\" process [54]. This emphasis on collaborative model-building and understanding the \"why\" behind task categorization aligned more closely with our research goals than methods primarily focused on idea listing or ranking. A dedicated, open-source web-based tool was developed for the card sorting. The tool consists of a researcher interface that allows for the import of card sets to be sorted, and card-sorting results to be exported, as well as functionality for quantitative analysis such as similarity matrixes, dendrograms, and graph cluster analysis, as well as an external interface for the contributors of the study to perform and submit card-sorting sessions. While off-the-shelf software for card sorting exists, it is commercial, and no open source tool with suitable functionality, for example, for copying sorted sessions to support the continual Delphi sorting process, was found. The tool is made available freely available for other researchers from [12]. The interview sessions, lasting on average 1.5 h, were recorded to facilitate accurate transcription and detailed analysis and consisted of two main phases:  
1.