## 5 Results
### Frameworks and Good Practices  
Interviewees highlighted the importance of adopting frameworks that offer standardized structures for process management, risk assessment, and security controls. Good practices and frameworks ensure that internal audits can assess cyber risk management entirely, accurately, and efficiently, promoting greater organizational security and resilience. Interviewee INT07 made the following observation in his registration unit on the topic: \"_Frameworks and best practices are generally products that are tested, approved and constantly improved by the community and offer an opportunity to \"talk\" to the \"rest of the world\" at events, forums, and organizations\"_.  
Interviewees indicated the NIST CSF [31], ISO/IEC 27001 [9], COBIT 2019 [25] and CIS Controls as essential frameworks to help both the organization and internal audit to manage and assess cyber risks. The literature search also indicated that the Cybersecurity Capability Maturity Model (C2M2) [71] can help verify and monitor the company's cyber maturity and [48] propose a validated framework that assesses not just compliance but also the maturity and readiness of security controls in real-world scenarios. Ref. [50] concluded that even with the existence of consolidated frameworks, such as ISO 27001 [9] and NIST CSF [31], internal auditors still face obstacles in ensuring the complete and consistent assessments of cyber controls, particularly when considering industry-specific factors, such as local regulations and the specific threat profile of the Brazilian banking sector. Table 4 summarizes the approaches that Internal Audit can adopt to evaluate the effectiveness of cybersecurity controls. According to the interviewees, implementing the techniques and strategies presented in this research can achieve the following **benefits**:  
* **Strategic Decision-Making and Resource Allocation--**The visibility provided by clear reports and dashboards enables managers to assess the cybersecurity landscape, facilitating data-driven decision-making accurately. The availability of strategic intelligence supports efficient resource allocation, directing investments to high-risk areas while avoiding waste. Additionally, identifying improvement areas through objective metrics allows for continuous adjustments, aligning security measures with organizational goals. * **Proactive Risk and Vulnerability Management--**The ability to identify vulnerabilities and prioritize mitigation actions is essential for an effective defensive posture. Combined with trend analysis, which anticipates emerging threats, organizations can take preventive measures before risks materialize. Rapid response to indicators ensures that changes in the security environment are addressed swiftly, reducing potential impacts. Comprehensive risk mapping guarantees that no critical threats are overlooked. * **Continuous Monitoring and Evaluation--**Real-time KPIs and KRIs enable ongoing monitoring of security postures, facilitating early detection of anomalies. Periodic evaluation of implemented policies and controls helps measure their effectiveness, ensuring they fulfill their intended purposes. Furthermore, performance analysis of security controls verifies their alignment with organizational needs. * **Resilience and Process Validation--**Organizations enhance their ability to withstand and recover from cyber incidents, strengthening overall resilience. Penetration testing and other process validation methods verify the efficiency of vulnerability assessments, patch management, and incident response, ensuring readiness for real-world scenarios. * **Operational Efficiency and Standardization--**Optimized security processes lead to productivity gains and reduced rework, fostering lasting structural improvements. Standardized methodologies ensure consistent risk assessments, while streamlined audits improve execution efficiency. Clearly defined security controls eliminate ambiguity and promote best practices.