# A Configurable Dependency Model of a SCADA System for Goal-Oriented Risk Assessment
## 4 Research Methodology
### Data Analysis and Development of a Unified Mind Map  
After the data collection stage, the 36 individual mind maps of a SCADA system were analysed. In this process, we followed the 5 stages of qualitative data analysis [25]:  
* Familiarization--Immersion in the raw data (mind maps) when the researchers observed all mind maps to estimate the richness of the material;
* Identifying themes--Key areas derivation from the raw data;
* Indexing--Linking key areas and other elements throughout all participants' mind maps;
* Charting--Rearranging the data from individual mind maps into a unified mind map containing the data, first, from some and, then, all respondents;
* Mapping--In its general sense, this stage does not refer to mind mapping specifically, but to any form of creating a mental model or a framework of a phenomenon under investigation. In our case, we used mind mapping at this stage to define the phenomenon and find associations. The template analysis method [26] was used in this project as a suitable and well-established method for analysing interpretative phenomenological data collected in the form of mind maps. Each unique element identified in a mind map became a code. The codes were grouped into themes representing the key areas and arranged within a hierarchy. An initial template of key areas and high-level sub-elements was created based on the analysis of 5 randomly selected mind maps. We then worked through all remainingmind maps--element by element--looking for new elements that could be related to previously identified themes or added as or under new themes. All unique elements identified as a result of the analysis of the collected mind maps were captured. Reasonable adjustments were made regarding the naming of the elements. If the analysis showed that the participants referred to the same concept using different names, these similar elements were merged together. For example, analysis of child elements confirmed that the participants referred to the same concept as Networks, Communications, or Interconnections. These elements were united under the term Networks. We also united close terms such as TCP/IP, IP and IP-based networks in one element. The elements Remotely Controlled Devices and Field Devices were merged as well as such elements as Operator Terminal and Human-Machine Interface (HMI). The elements such as business system link, enterprise interface and corporate access were also grouped together under the term Corporate Access. It was imperative to capture the complex hierarchical nature of a SCADA system, and mind maps as a tool served in this goal well. The collected elements were analysed, then grouped and categorised according to their nature to produce a unified mind map. The process required an in-depth knowledge of SCADA systems. In many cases, we had to refer to the SCADA literature to clarify the meaning of concepts and relationships between them. Some elements were grouped together as they referred to closely related concepts; for other elements, we had to add new node layers. Each of the 36 mind maps contained between 14 and 107 elements with the average number of elements per model of 42.25 \(\pm\) 19.10. Overall, 1521 elements were identified out of which 610 were unique. The maximum number of hierarchical levels of the mind maps (max depth) varied in the range between 2 and 8 with the average of 3.89 \(\pm\) 1.17. Each mind map had between 1 and 15 key elements, i.e., the elements whose parent element is the core element of _a SCADA system_. The average number of key elements was 6.89 \(\pm\) 3.79. Through this rigorous process, the unified mind map of a SCADA system was gradually refined. Overall, the final version of the unified mind map comprises 610 elements. Figure 1 shows an early version (work in progress) of the unified mind map. This figure is presented here to demonstrate the richness of the model, not to show the individual elements, which will be discussed in detail in Section 5.