# A Dynamic and Adaptive Cybersecurity Governance Framework
## 5 Proposed Cybersecurity Governance Framework
### Proposed Cybersecurity Governance Framework Principles  
Figure 6 shows the proposed cybersecurity governance framework principles. Each of them is presented as follows:  
Flexible:The framework should be dynamic and flexible enough to adapt according to the current cybersecurity threats and technological landscapes.  
Risk based approach:Organizations should spend money and budget for security controls according to the security risk of that enterprise. Today, we are shifting from managing security in a simple IT department to a more proactive and risk based approach.  
Standards, compliance and conformance requirements:In addition to the proposed governance framework, organizations should evaluate their IT systems against a set of standards and regulations, including NIST 800-53, NIST Cybersecurity Framework, SOC-2 and ISO 27001. Cybersecurity compliance comprises meeting various security controls (usually enacted by a regulatory authority, law, or industry group) to protect the security triads such as confidentiality, integrity, and availability of information assets.  
Holistic Approach:In this dynamic technological time and threat landscape, cybersecurity requires a holistic approach, which addresses people, skills, and technology as well as processes and governance. Organizations should clearly comprehend how to achieve cyber defense and resilience efficiently.  
Separate governance from management:cybersecurity governance is the process of directing, controlling, and monitoring security programs and processes; defining accountability, and providing oversight to ensure that cyber-risks are sufficiently alleviated. While cybersecurity management is the framework to establish, operate, monitor, review, maintain, and improve the cybersecurity posture within the organization. The proposed cybersecurity governance framework clearly distinguished between them, as shown in Figure 4.  
Adaptive governance framework: cybersecurity governance framework should be periodically reviewed, evaluated, and monitored to adapt according to the dynamic technological change and threat landscape.  
Tailored to enterprise needs: most cybersecurity frameworks are generic and may not appropriate according to an organization's security needs. To make the security governance framework efficient, it should be tailored according to the organization's needs, resources, and other related issues.  
Build a culture of cybersecurity: to develop and implement cybersecurity program, there is a need to create cyber-aware culture and training across the enterprise. Employee education, training and awareness are a must to create a security-aware workforce and culture and to make sure that all employees know how to use the security systems and tools that are planning to implement.  
End-to-end governance system: the proposed framework covers the IT function and all functions and processes across the entire organization. It treats information and related technologies as assets that need to be dealt with like any other organizational asset.  
Collaboration and cooperation: Since cyberspace is borderless, it needs both national and international collaborations. Moreover, governments, public and private sectors should work together to combat the worst security problems that come from cyber-criminals.  
Figure 6: Proposed Cybersecurity Governance Principles.