# A Dynamic and Adaptive Cybersecurity Governance Framework
## 1 Introduction
Organizations need to develop and implement different cybersecurity frameworks to safeguard cyberspace that can be used for national security, national interest, and economic prosperity as the author [13] researched recently. Currently, most organizations are applying technological solutions to protect their IT systems and business processes, which include: applying firewalls, intrusion detection and prevention systems; applying general and application specific security controls such as IPSec, a corporate virtual private network (VPN), secured socket layer (SSL) etc. However, all these technological solutions provide some security solutions. Apart from technological solutions, different cybersecurity frameworks should be developed and implemented for an organization to enhance its security posture. To this end, there is a need to design a cybersecurity governance framework that should be aligned with the business mission of an organization. Cybersecurity management is also a major breakthrough in cybersecurity, including planning, budgeting, performance management, etc. It is also identified that cybersecurity needs a security strategy at the organizational level. The cybersecurity risk management approach is not an exception. There is a need to design a risk management framework from multidimensional perspectives, which includes policy, people, operations and management. Appropriate cybersecurity policy, standards, governance, and strategy at the organizational level should also be designed, implemented, and monitored. Finally, the cybersecurity operational part should also be dealt with, such as mission analysis, situation awareness and planning, executing and assessing, analyzing and reporting, evaluating and giving feedback on the cyber system. If all the aforementioned mitigation options are implemented, organizational security and interest can be well achieved [13, 14]. In light of the above facts, this research aimed to first review existing IT and security governance frameworks, make comparisons and see their gaps, overlaps, and limitations. According to the review made, the following major limitations are observed;  
* The existing frameworks are complex and have complicated concepts and structures to implement, and they have too many requirement checklists for compliance and audit findings, so organizations are reluctant to implement them. Moreover, they require a lot of resources and investments to implement. * There is also a lack of well-prepared guidelines for the implementation and well justified and confirmed benefits compared to the huge budget required. * Most of the frameworks require highly skilled manpower and knowledge. * Since most of them are very wide in content, it takes time for IT and security officers to assess the whole components and frameworks. * The existing frameworks also require high training costs and highly qualified security professionals and experts in the field to implement and evaluate their security postures. * Some of the frameworks, such as COBIT, are business frameworks that can't be used for securing cyberspace, while the other frameworks, like ITIL, are mainly focused on the IT parts and the service of the IT systems, not the governance of the IT and security-related activities. In addition to existing frameworks and standards, the most relevant previously done research towards the problem domain is thoroughly investigated along with the research gap. The following major limitations are identified:  
* Almost all of the proposed frameworks lack the following components, which we have added to the proposed security governance frameworks; security training and awareness (SETA) program, research and development framework, regional and international collaboration framework, public-private partnership framework, incident management business continuity and disaster recovery frameworks, change and configuration management frameworks, etc. * Some of the proposed governance frameworks are specific to some application domains. They are not generic and can be used by any sector.