# A Dynamic and Adaptive Cybersecurity Governance Framework
## 4 Research Method  
The design science research process model (DSRP) was used. In this research context, the DSRP research model comprises problem identification and motivation, objective identification for the solution, design and development of the cybersecurity governance framework, demonstration of the framework, and evaluation and validation of the developed framework. Each phase is presented below. Problem Identification and Motivation: to identify the problems or gaps and to find the motivational factors to conduct this study, researchers have reviewed different literature, existing documentation, standards, best practices, and systems that are currently used by various nations and organizations to secure their network infrastructures [10]. However, most organizations (both public and private sectors) primarily rely on technological solutions to protect and secure their information and networking infrastructure, ignoring cyberspace's governance. There is also a lack of enterprise-wide security structure to address the dynamic nature of cyber threats. To implement the governance frameworks developed by international institutions, most organizations don't have highly skilled manpower. Additionally, the frameworks are complex and require a huge amount of resources. Moreover, their requirement checklists are too much for both compliance and auditing. Due to this and other reasons, organizations are reluctant to implement the stated frameworks. The solution's objective: This research study aims to design a security governance framework for organizations to protect and secure IT systems and business processes. The developed cybersecurity governance focused on the top management's commitment to securing their enterprise resources with the following goals in mind [23]; provide strategic directions towards security the cyberspace, ensure that security objectives are well defined and addressed, ensure that security risks are well assessed and managed and appropriate mitigation options are put in place, and evaluating and validating that enterprise resources are effectively spent for securing their IT systems and business processes. Design and development: This activity involves designing and developing various cybersecurity frameworks. The researcher designed and developed a cybersecurity governance framework. While designing the security governance framework, the following factors were taken into consideration; considering the emerging threat factors, addressing the fastest moving technological landscape, continually working on security awareness to change people's attitudes to create a cyber-aware workforce, giving due attention to the work culture transformation of an organization. In general, whilst designing the proposed cyber security governance framework, the following core components were considered; a risk management and assessment methodology, a cybersecurity strategy and policy directions, development of security standards, which transforms the policy directions into an appropriate set of procedures and guidelines, development of evaluation and monitoring techniques to ensure for the fulfilment of compliance and audit findings, a suitable set of governance process to periodically update, evaluate, and monitor the security strategy, policy, procedures, and guidelines. And finally, the development of an effective security structure that is an integral part of an organizational and IT structure. Demonstration: This activity presents the use of the artifact (in this research, the framework) to solve the identified problem. The essential requirement that is required for demonstration is to gain enough knowledge about how the framework works or how to use the framework to solve the stated security-related problem. To this end, the research output will be demonstrated in selected sectors. Evaluation: this activity is all about measuring how well the developed framework solves the existing problem.