# Fast, Lightweight, and Efficient Cybersecurity Optimization for Tactical-Operational Management
## 1 Introduction  
Cybersecurity has become a significant concern due to frequent and complex cyberattacks and a changing threat landscape, creating an emergency for organizations worldwide [1], such as an increase of up to 62% in cyberattacks to organization's supply chain, and up to 75% in the number of general cyberattacks directly received by organizations [2]. To address this challenge, a holistic management approach and unity of action [3] are required, involving a cross-functional cybersecurity workforce from tactical and operationallevels, with a sense of urgency. However, in today's organizational landscape, managing cybersecurity from a holistic perspective poses significant challenges. One of the most crucial obstacles is the lack of methodological development to manage cybersecurity at lower organizational levels, which can lead to improper organization and alignment with strategic cybersecurity goals, hindering the organization's ability to respond quickly to changing cyber threats. While frameworks such as the Framework for Improving Critical Infrastructure Cybersecurity [4] or the International Organization for Standardization (ISO) 27000 [5,6] family of standards are commonly used at the strategic level, they fail to provide procedural foundations for tactical and operational levels. Another challenge lies in achieving holism [7] when collaborating in cross-functional internal-external teams with different chains of command at lower organizational levels, which necessitates the development of suitable mechanisms. Additionally, the absence of standardized and homogeneous cybersecurity evaluation criteria [8] at lower levels poses a significant challenge to assessing the current and expected cybersecurity status in a holistic manner. To address this set of difficulties, CyberTOMP [9] was designed. It is a framework to manage holistic cybersecurity at tactical and operational levels. The CyberTOMP framework comprises various components that collectively provide organizations with what is necessary for the holistic management of cybersecurity at tactical and operational levels. One of these components is the Unified List of Expected Outcomes (ULEO), which is an organized list of cybersecurity actions in a four-level tree-structure format (asset level at the top, then function level, category level, and expected outcome level at the bottom). It is a common and homogeneous list that represents all the cybersecurity actions that should be implemented to protect a specific asset. Along with this, it defines a set of metrics that can be aggregated and that, together, allow for the evaluation of the current cybersecurity status of assets or their evolution over time, or the establishment of cybersecurity objectives at any level of the organization. This list and set of metrics have been developed by combining cybersecurity actions from different de facto standards in this area [4,10,11]. None of these standards need to be implemented in the organization, but the application of CyberTOMP will allow for their implementation in a much faster and simpler way, if necessary. Furthermore, if any of these standards are already implemented in the organization, the application of CyberTOMP will already be partially achieved. Moreover, the complete list of cybersecurity actions (also called expected outcomes) are grouped in three different implementation groups (IGs) that allow organizations to apply proportionate cybersecurity actions depending on the criticality of assets (e.g., the minimum subset, the intermediate subset, or the whole list of cybersecurity actions). Each outcome has a discrete level of implementation (DLI) assigned to it [12], based on the deployment degree of the required actions to achieve the corresponding expected outcome (Figure 1). This ensures an impartial evaluation of an organization's cybersecurity posture and avoids conflicts, bias, or misinterpretations.