## 1 Introduction  
There has been a significant increase of cybersecurity attacks during the latest years. Frequently, these attacks are caused by an absence of proper security configurations [1], or by inappropriate default configuration values [2, 3] of software products and systems that do not follow the desirable cybersecurity policies. The default configuration or the improper configuration of systems can unleash critical damages for the organisations as the leak of information [4]. For instance, the use of default accounts or usernames and passwords is a very common in industry [1, 5, 6]. In general, the use of default parameters of systems is the first attack vector used for attackers [7]. OWASP project [8] establishes the A6:2017-Security Misconfiguration and A9-Using Components with Known Vulnerabilities, as two of the top-10 vulnerabilities for Web systems. Likewise, the complexity in the configuration of systems and products can lead to improper configurations or misconfigurations [2]. For instance, in access control systems, the improper configuration of rules can derive a granted use of unauthorised resources. The complexity in the configuration of software products and systems is a known challenge in the software industry. An example of a configuration tool is KConfig [9], where developers are able to select among more than 12,000, Linux Kernel configuration options. An incorrect or inappropriate configuration can trigger security problems, such as attacks due to the use of a non-secure channel configuration in the communications when the cybersecurity policy establishes a strong security channel. In this paper, Software Product Lines (SPL) [10], more specifically, the use of variability analysis and feature analysis techniques (Feature-oriented Domain Analysis, FODA) [11] are the baseline to propose a solution that facilitates the detection of non-compliance of the cybersecurity policies by the system configuration. The Carnegie Mellon Software Engineering Institute [12] defines SPL as \"a set of software-intensive systems that share a common, managed set of features satisfying the specific needs of a particular market segment or mission and that are developed from a common set of core assets in a prescribed way\". Feature models are a specific representation of the products which composes a SPL. Previous works related to cybersecurity have faced up the problem also using SPL, such as extracting and selecting the features from the log file [13], applying machine learning to detect cybersecurity threats, to verify the security mobile application configurations by applying partial model checking [14], or the feature-oriented approach to the modular construction of fault trees, which enables reusing the structures of fault propagation roads [15]. However, the automatic verification of cybersecurity policies according to the possible configuration is still an open problem. The development of SPL has been frequently analysed by using feature model techniques. In this article, the use of feature model techniques is proposed to fulfil cybersecurity policies by checking the appropriate configurations of the software systems and products. Feature models could be considered as a model-based cybersecurity design, where software products and systems are designed according to the requirements of cybersecurity design policies. Feature models [11] are the main concept of the functional decomposition of the product line approximation. These models will be used for representing the configuration parameters according to established policies. Moreover, these models allow setting constraints and attributes between the characteristics of the configurations, as it was proposed in a previous work [16], allowing a greater expressiveness of dependencies and relationships between the different characteristics related to cybersecurity. Once the proper configurations are modelled as a feature model, automatic formal verification techniques [17] can be applied.