# Cybersecurity Risk Assessment: A Systematic Mapping Review, Proposal, and Validation
## 6 Validation of the Model Proposal and Results
### Validation of the Model Proposal  
The objective of the questionnaire was to know the opinion of experts on the proposed risk assessment model presented in Section 5. Forty-two questions were created and divided into four sections as follows: \begin{table}
\begin{tabular}{c c c} \hline \hline
**Variables** & **Qualitative Proposal** & **Quantitative Proposal** \\ \hline Relevance of the Asset in the Process (RAP) & Defined by the owner of the asset & RAP Low = 1, RAP Medium = 2, \\  & & RAP High = 3 \\ \hline Monetary Value of the Asset in Dollars (MVA) & & Proposed by the owner of the asset \\ \hline Value of the Information Contained in the & & Proposed by the owner of the asset \\ Asset in Dollars (VICA) & & \\ \hline Economic Value of the Asset (EVA) & EVA = RPA & EVA = (MVA + VICA )*RPA \\ \hline  & NIST algorithm CVSS: & \\ Value of Vulnerabilities (V) & “Low” = 0–3.9 & \\  & “Medium” = 4–6.9 & V = CVSS quantitative version \\  & “High” = 7–10 & \\ \hline  & Low: Change or not effective & \\ Countermeasure Maturity (CM) & Low: 0–3 times effective & CM = number of times the \\  & Medium: 4–8 times effective & control/countermeasure has been \\  & High: 9–10 times effective & effective (max. 10) \\ \hline Countermeasure Effectiveness (CE) & CE = CM & CE = (IM\({}_{t-1}-\text{IM}_{t}\)) * CM \\ \hline Asset Exposure (AE) & CM and V related by table & Percentage measure defined by the \\  & & SANS institute model \\ \hline Information Available on the Asset (AAI) & “Low” = Incidents \textless{} 1 per year & Number of incidents published \\  & “Medium” = Incidents \textgreater{}1, \textless{} 2 per year & per year \\  & “High” = Incidents \textgreater{} 2 per year & \\ \hline Threat Value (T) & AAI and V related by table & \(\text{T}=[(\text{V}+\text{AAI})/2]*\text{EVA}\) \\ \hline  & Low: 1 to 4 incidents per year & \\ Number of Occurrences (ON) & Medium: 5 to 9 incidents per year & Number of negative events related \\  & High: 10 incidents or more per year & to the asset with public information \\ \hline Registered Years (YR) & & Years of existence of the asset \\ \hline Likelihood (ARO) & ARO = ON & ARO = \(\frac{\text{ON}}{\text{YR}}\) \\ \hline Impact (IM) & T and AE related by table & IM = T * AE \\ \hline Risk Exposure Value (R) & IM and ARO related by table & \(R_{1}=\text{IM}*\text{ARO}\) \\  & & \(R_{2}=[(\text{T}/\text{EVA})*\text{ARO}]/2\) \\ \hline Acceptable Risk Value (ARV) & Value of the risk immediately lower than & \\  & the current one & Defined by the organization \\ \hline Residual Risk (RR) & R and CM related by table & \(RR=(R_{t}-R_{t-1})\) \\ \hline \hline \end{tabular}
\end{table} 
Table 12: Variables created for the cybersecurity risk assessment proposal. * Demographic questions: Eight questions related to the experts' basic information, such as the name of the organization where they currently work, the size of their organization, the country where they work, the industry related to their company, the maturity level of their organization, their current position, the number of years of experience in cybersecurity, and whether they have cybersecurity certifications;
* Risk management practices: Seven questions related to experts' and their organizations' current habits and practices regarding cybersecurity;
* Comments about risk assessment variables: 24 questions divided into six subcategories: (1) identification and evaluation of assets, (2) identification and evaluation of vulnerabilities, (3) threat identification, (4) impact, (5) likelihood, and (6) risk reduction. These subcategories aimed to obtain the experts' opinions on the general variables created for the risk assessment proposal;
* Evaluation of the model proposal: Three questions where the model proposal was formally presented in its two variants, qualitative and quantitative, and where the questionnaire asked for evaluation and feedback. The questionnaire was created in two variants: (1) in the Spanish language and (2) in the English language.