# A Dynamic and Adaptive Cybersecurity Governance Framework
## 1 Introduction  
According to international standards for Organizations (ISO) 38500, cybersecurity governance is a mechanism for an organization to direct, control, monitor, and evaluate information system security to support the business process [1]. Cybersecurity governance is integral to corporate and information technology (IT) governance systems. Cybersecurity in the organization is directed by developing a suitable set of security policies, standards, procedures, and guidelines that span from strategic directions through the tactical to the operational level. Moreover, cybersecurity in the organization is mainly managed and controlled by evaluating, monitoring, measuring, and reporting compliance from the operational through tactical to the strategic level [2, 3]. These days, due to the dynamic and varying nature of cyber threats and technological landscapes, every organization needs to have a complete and suitable set of cybersecuritygovernance frameworks to fully address all of its security needs. According to the IT governance institute, implementing good security governance ensures that cybersecurity strategies are aligned with IT and overall organizational strategy and support to achieve organizational objectives, provides and maximizes business value to all stakeholders, manages cyber risks and resources proactively, and measures organizational performance using key performance indicators to achieve organizational objectives [4, 5]. The cybersecurity governance framework should mainly focus on the responsibilities and practices that should be exercised and addressed by top-level management of organizations (board and executive management) having the following main goals: provide strategic direction towards securing the IT system that supports the business operation; ensuring that security objectives are well defined and achieved; making sure that security risks are analyzed and managed appropriately; and validating that company resources are optimally used and spent for securing the company assets [6, 7]. The cybersecurity governance framework does have a vital role in accomplishing the security objectives of an organization for both existing problems and future challenges [8, 9, 10]. To address current security issues, the security governance framework should examine and consider the following points [11, 12]:  
* If there is already existing security policy and strategy, it needs periodic review and updates to address the current security vulnerabilities and threat landscapes. However, if there is no security policy, it is highly recommended to implement a suitable set of security controls to audit and assess the security posture of an organization periodically,
* Design and implement security awareness and training programs among employees, end users, etc. Moreover, for future cybersecurity challenges, the security governance framework should address the following points:  
* Considering the emerging and dynamic threat factors and landscapes,
* Considering and addressing the fastest-moving technological revolution;
* Continually working on people's attitudes towards security to create a cyber-aware workforce; and
* Focusing on the work culture transformation. Despite the development and implementation of governance frameworks, the major problem in most organizations is they do not see cyber security as a multidimensional and cross-sector issue. It is still considered a technical or technological problem that can be addressed by a simple information technology (IT) department [13]. Simply buying more hardware and software tools is not the comprehensive solution for the existing security problem that organizations are facing. Currently, organizations spend lots of money on security devices due to a lack of appropriate security governance framework, risk management process, and mechanisms to efficiently utilize the security tools and equipment.