# A Dynamic and Adaptive Cybersecurity Governance Framework
## 5 Proposed Cybersecurity Governance Framework
### Cybersecurity Governance Framework Components  
In this section, all the components of the proposed security governance framework are presented in detail. _Cybersecurity strategic planning_: Cybersecurity strategic plans should be developed for three to five years aligned with an organization's overall strategic plan. Strategic planning can be seen from three different but interrelated perspectives shown in Figure 5.  
Firstly, the cybersecurity strategic plan should be integrated with the IT strategic plan, which is an integral part of the company's overall strategic plan. Given the above principles, there are three strategic components: organizational strategic planning, IT strategic planning, and security strategic planning. To sum up, a cybersecurity strategic plan is an integral part of IT strategic plans, which in turn is an integral part of the enterprise strategic plans. This way, it is possible to see cybersecurity holistically across an enterprise that will have a part in achieving the organization's overall strategy. In light of the above facts, key components to developing an effective cybersecurity strategic plan include: clearly understanding how cybersecurity risk is related and affects critical business processes; developing a strategic goal; defining the scope; identifying cybersecurity needs and developing objectives; establishing key performance indicators (KPIs); determine resource needs; determine security risks; and establish continuous monitoring and evaluation techniques. _Cybersecurity risk management_: It is identifying what kind of security threats an organization faces, analyzing security vulnerabilities to assess the threat level, and defining how to address the cybersecurity risk. Cybersecurity risk management includes three processes: risk assessment, risk treatment, and evaluation and analysis of the security risk. The risk assessment process includes identifying and evaluating cyber-risks and risk impacts and recommending risk-reducing measures. Risk treatment refers to giving priority, implementing, and maintaining a suitable set of risk-minimizing techniques recommended from the risk assessment process. The developed risk management program should be periodically monitored and evaluated [13]. _Cybersecurity Policy:_ Security policy should be prepared upon completion of performing security related risk assessment. Security policy is meant to describe the following security related issues such as used to assign responsibilities, define roles, discuss execution processes, specify audit and compliance requirements, and determine acceptable risk levels. Cybersecurity policies are usually updated or revised only when performing risk assessment and when a fundamental change occurs in the organization's operations. Organizations should develop three types of policies: program policy, issue specific policy, and system specific policy. Moreover, security policy shall be developed using standards, guidelines, and best practices. _Incident Response Management:_ One of the principal objectives of any security program is to prevent security incidents. A security incident is a single or a series of undesirable or unexpected security events likely to compromise the company's assets. Whilst cybersecurity incident management is the process of proactively preparing, detecting, responding, mitigating, recovering, reporting, and learning from cybersecurity incidents. As part of the security governance framework, the cybersecurity incident management framework should be developed and used by any type and size of the organization. _Business Continuity and Disaster Recovery Plans:_ It is important to have planning when a security incident happens at the national and organizational levels. If the IT system that supports business operations is interrupted by security breaches, a suitable set of plans and procedures are required that will permit the business to continue essential functions and operations without interruption.