## 4 Results
### Cluster Performance Analysis  
To leverage the CTI results on an organization's cybersecurity performance and to suggest benchmarking data for the global community, we analyzed the specific dataset that was created from the top 25 th percentile of organizations. These organizations have scored higher than the other 75% of organizations in our study and should be considered a role model for others. This dataset has eight organizations spread across the telecommunication, insurance, IT, government, and financial sectors. From Figure 6, the top organizations have a solid foundation for managing the legal aspect of cybersecurity. Furthermore, they have a well-established process for ensuring compliance with local and international cyber-related regulations. On the contrary, according to our study, most organizations need to adequately extend their legal practice to cover key suppliers or data processors. Organizations should establish a governance process to manage the compliance obligations of key suppliers through strong contract management. Privilege and access management are the second and third highest-scored clusters, thereby reinforcing the recommendations from other studies [93; 94; 95] that Identity Management and Access Controls are the most critical elements in every cybersecurity program. Log management is the fourth-ranked cluster. It is driven by the Computer-Related Crime Act B.E. 2550 of Thailand (CCA) [96]. The CCA requires organizations to retain and protect access logs for at least 90 days, so most organizations are already in the mature stage of log management. Similarly, many organizations have a formal change management process, making it the fifth-ranked cluster in our study. \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Cluster** & **1** & **2** & **3** \\ \hline Number of objects by cluster & 6 & 4 & 2 \\ \hline Sum of weights & 6 & 4 & 2 \\ \hline Within-cluster variance & 12,272.067 & 28,362.500 & 18,581.500 \\ \hline Minimum distance to centroid & 85.522 & 125.482 & 96.389 \\ \hline Average distance to centroid & 100.265 & 144.974 & 96.389 \\ \hline Maximum distance to centroid & 124.121 & 165.534 & 96.389 \\ \hline D1 Governance & D2 Asset Management & D6 Data Security \\ D5 Access Control & D3 Risk Management & D10 Cloud Security \\ D7 Network Security & D4 End User Management & \\ D9 Application Security & D8 Secure System Install & \\ D11 Operation Security & & \\ D12 Respond and Recovery & & \\ \hline \hline \end{tabular}
\end{table} 
Table 10: K-Mean Clustering results. When we look at the clusters with low scores, organizations must pay closer attention to securing mobile and BYOD devices. This is underscored by the fact that Thailand and many other developing countries have an exponential growth rate of mobile banking and e-payment [97], which has expanded the risk surface. Organizations should also take crucial steps to manage and reduce the risks of using user-owned devices/services in business activities (shadow IT) [98]. Data security is another shortfall cluster among organizations. Security measures such as data classification, labeling, masking, and data leakage prevention should be considered with the aim of identifying and protecting the data based on its sensitivity throughout its life cycle [99; 100]. Most organizations are doing less in baseline security. This is particularly important and has been highlighted by the new version of the ISO 27001 that was published on 25 October 2022 [101], wherein organizations must define secure baseline configurations and ensure all critical information assets are configured according to the baseline. The shift from on-premise to cloud computing and the growing reliance on the cloud that has been driven by the COVID-19 pandemic has created a massive demand for better management of security in the cloud.