## 2 Cybersecurity Performance Measurement--The Past and the Present Methods  
In this section, we analyze prominent scientific research papers, widely used security standards, and best practices to study the methods, mechanisms, and factors that can be used to gauge and benchmark an organization's security performance. Based on research by [PERSON] et al. [15], there were 14 cybersecurity measurement methods that indexed or ranked the security readiness and capabilities at a country or organization level. We selected five methods for the assessment of organizations, then combined them with our search for methods that have been presented in security standards and academic publications. The result was eight methods including the Cybersecurity Capability Maturity Model (C2M2) [25], Cybersecurity Poverty Index [26], Global Cybersecurity Assurance Report Card [27], Capability Assessment Framework for Information Security Governance in Organizations (CAFISGO) [28], ISP 10 \(\times\) 10 M [29], Composite Cybersecurity Rating Scheme [30], Security Effectiveness Framework [31], and Cyber Resilience Review [32]--as shown in Table 1. Other available methods were excluded from our analysis because they do not measure organization-level performance but do measure at the country level [33; 34], evaluate specific topics [17; 18; 19], or target selected industry sectors only [21; 22]. Similarly, the methods that did not disclose details about scoring calculations were also excluded [35; 36; 37; 38]. Created by U.S. Department of Energy, the Cybersecurity Capability Maturity Model (C2M2) [25] evaluates an organization's cybersecurity capabilities across ten domains (As  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Methods**} & \multicolumn{6}{c}{**Mechanisms**} & \multirow{2}{*}{**Sources**} \\  & **Indicator \& Questions** & & **Performance Scale** & & **Weight** & **Score Calculation** \\ \hline Cybersecurity Capability & 10 domains & & & & Highest maturity & \\ Maturity Model (C2M2) & 43 objectives & Four-point scale & 0-3 & None & & & \\  & 342 questions & Four-point scale & 0-3 & None & & & \\  & 342 questions & Four-point scale & 1-5 & None & & & \\ \hline Cybersecurity & 5 functions & Five-point scale & 1-5 & None & & & \\ Poverty Index & 18 questions & Five-point scale & 0-100 & None & & & \\  & 11 TI components & Five-point scale & 0-100  
set, Change, and Configuration Management; Threat and Vulnerability Management; Risk Management; Identity and Access Management; Situational Awareness; Event and Incident Response, Continuity of Operations; Third-Party Risk Management; Workforce Management; Cybersecurity Architecture; Cybersecurity Program Management). The method was designed to be used by organizations of any type and size. The C2M2 measurement mechanisms use 342 questions, with each of them using four-point-scale Maturity Indicator Levels (MILs) ranging from 0 (Not Implemented) to 3 (Fully Implemented). An organization will achieve a Maturity Level in the respective domain when the related questions of that Maturity Level are rated as Fully Implemented. The final Maturity Level is determined by the highest Maturity Level achieved. The Cybersecurity Poverty Index [26] developed by RSA is a lightweight measurement method with only 18 questions that is designed to assess an organization's ability to identify, protect, detect, respond, and recover from cyber threats following NIST CSF. The index was last run in 2016 with 878 respondents that rated their organizations using a five-point-scale. The final score was produced from the average score of all the questions without weighting. The key results indicated the two most undeveloped capabilities, Incident Response and Cyber Risk Management, which required prioritized improvement. The Tenable Network Security and CyberEdge Group developed the Global Cybersecurity Assurance Report Card [27] in 2017, which used 12 main questions that were separated into 2 discrete areas.