## 4 CyberSPL: Cybersecurity Software Product Line
### CyberSPL Workflow and Operation  
As aforementioned, CyberSPL is focused on verifying the compliance of cybersecurity policies according to a configuration problem. The CyberSPL workflow is based on the business process shown in Figure 4. This process enables evaluating different cybersecurity contexts for an organisation. The process, inputs, outputs, stakeholders, and the specification are detailed to describe each activity. NIST 800-181 categories National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework: [[https://csrc.nist.gov/publications/detail/sp/800-181/](https://csrc.nist.gov/publications/detail/sp/800-181/)]([https://csrc.nist.gov/publications/detail/sp/800-181/](https://csrc.nist.gov/publications/detail/sp/800-181/))) have been used to represent the stakeholders' areas of responsibility for each activity:  
1. There is a _selection of security contexts_ (cf., Define SPL context) according to this cybersecurity policy. In this stage, the organisation has to do an effort on the analysis of the enterprise architecture, thus, to identify the assets and the security control in all the stages of every enterprise layer. \begin{table}
\begin{tabular}{l l c} \hline \hline  & Number of features & 12 \\  & Mandatory & 2 \\  & Optional & 5 \\  & OR & 2 \\  & XOR & 0 \\  & Attributes & 1 \\  & Cross-Relations & 2 \\ \hline \multirow{2}{*}{Model Analysis} & Valid & ✓ \\  & Number of configurations & 8 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Relevant characteristics for the example in Figure 1.  
Afterwards, the organisation should delimit the scope, the context, by identifying the ecosystems to take into account for the application of the cybersecurity policy. * _Input_: Cybersecurity policy, Assets. * _Output_: Cybersecurity Context. * _Specification_: Analysis of the resources, processes, systems, security controls, and the cybersecurity policy conditions. * _Stakeholders_: Operate and Maintain (OM), Protect and Defend (PR), Investigate (IN), and Analyse (AN). 2. Once the context is delimited, feature models are selected (cf., Select/Build feature models), if any in the catalogue or constructed. Thus, CyberSPL provides a set of public or private repository of models that can be useful for the analysis of the systems in the selected context. The organisation, through product managers, just should select or define the feature models needed. * _Input_: Cybersecurity Context, Feature Model Catalogue. * _Output_: Feature models. * _Specification_: Selection of feature models or definition of feature models that describe the context. * _Stakeholders_: Securely Provision (SP). 3. A customisation of _the features, attributes and constrains_ are set (cf., update features, attributes and constraints). The selected or defined feature models must be fully updated with the latest details of the cybersecurity policy established by the organisation. In this case, product managers must adjust certain parameters into the models regarding the subsequent analysis. The adjustments generate new versions of the models that are stored. * _Input_: Feature Models. * _Output_: Refined feature models store in the catalogue. * _Specification_: Include, delete, modify, and update into the models. Thus, update and readjust feature models. * _Stakeholders_: Securely Provision (SP). 4. Once the models are adjusted, the organisation is able to analyse the context and possible configurations (cf., Analysis Feature Models). Thus, the organisation can apply different operations: (1) validate the models, thus, validate the context of the organisation; (2) determine the number of possible configurations in the context; (3) determine and export all the possible configurations in the context; (4) validate certain configuration product or service according to the established models that describe the context; (5) diagnose certain configuration with regard a context. * _Input_: Refined feature models.