# A Dynamic and Adaptive Cybersecurity Governance Framework
## 2 Review of Existing IT and Cybersecurity Governance Frameworks
### Information Technology Infrastructure Library (ITIL)  
ITIL provides a suitable set of standards, guidance, and best practices that were developed by the United Kingdom's Office of Government Commerce (OGC) [13]. ITIL is composed of five main strategies in the form of services such as:  
Service strategy--it comprises the _management of a service portfolio_ that mainly deals with the process of maximizing return on investment (ROI); _financial management_ that directs, monitors, and evaluates investments in services to assist in strategic decision-making; and  
Figure 4: Proposed Cybersecurity Governance Framework. Demand management_ that mainly dealt with the identification and producing pattern of business demand. Service design--it originates with a set of business requirements and ends up with the solution design to meet the business needs. Service transition--it mainly dealt with managing changes to the business, risk, and quality assurance while delivering service into operation. Service operations--mainly address the issues of daily operations and look for the effectiveness and efficiency of services. Continual service improvement--it provides guidance and best practices on how to enhance the overall efficiency of service processes. Some of the benefits of ITIL are improving the efficient utilization of available resources, building a mechanism that leads to more competitiveness, avoiding repeated activities and processes, improving reliability, availability, and security of IT related services, and finally delivering key performance indicators (KPI). However, some of the limitations of ITIL are presented as follows; it was mainly designed as service management standards that focused on the services of IT systems, not the governance of IT and security related activities. COBIT and ISO/IEC 27014 guide on what should be done. However, ITIL gives direction on how IS system should be doing. ITIL mainly focuses on IT services and processes; it doesn't address the security aspects of the IT system. Additionally, one of the major limitations is its implementation cost. It requires high financial costs, including resources and training for the setting up of the framework in an organization. Therefore, it is infeasible for most organizations as it requires a huge investment to implement. It also has a complex Process to implement, especially for an organization that doesn't have prior knowledge of the governance aspect. The other problem of ITIL is its rigidity. It doesn't change according to the dynamically changing technological landscape. IT officers and top management must have high analytical skills to implement. As a concluding remark, COBIT can be used to determine if an organization's business process is well supported by IT and partly addresses the issue of security. ISO/IEC 27014 can be used to determine the company's security posture. Table 2 compares three of the most widely used IT and security governance frameworks and standards: COBIT, ISO/IEC 27014, and ITIL. To compare them, we have used different parameters.