## 3 The Cyber Trust Index (CTI) Framework  
We designed and developed each component of the CTI framework based on the Measurement Information Model recommended by ISO 15939 [24], as illustrated in Figure 1, to ensure that our framework is adaptable and reusable by other measurement methods. Figure 1: CTI Components based on ISO 15939 Measurement Information Model. CTI Framework Walkthrough  
This section breaks down the CTI framework into its key elements and describes them based on the measurement information model's taxonomy. Entity means the organization being measured and the information needed are the results that represent how secure the organization is. To obtain the information needed, the CTI uses the following components:  
Attribute  
An attribute is a characteristic of an entity that can be measured and converted into the information needed. [PERSON] et al. and [PERSON] concluded that organizations are more secure when they have suitable and effective security controls in place [42; 43]. Since there is a great deal of variety in security controls that could be used as attributes in our framework, we compiled a baseline security control set from notable security standards and best practices, including ISO 27001 [9], NIST CSF [11], PCI DSS v3.2 [12], NIST SP800-53 R4 [44], SANS Top 20 (CIS Controls) [45; 46], ENISA IAF [47], and OWASP Top 10 [48; 49]. The baseline security control compilation process was straightforward. We used NIST CSF as a foundation, then explored all other standards and best practices referenced by the NIST CSF. We then consolidated the controls with the same objectives into a unique control. A score was assigned to each unique control by counting the number of standards that recommend such a control. The unique controls that have a score of three or more, which means there are at least three standards recommended as controls, were selected to form our baseline security control set. The results were a total of 70 controls categorized into 25 clusters and 12 dimensions. The baseline security control set, as shown in Table 2, serves two objectives. The first objective is its use as an attribute to be measured, and the second objective is to prove that other components of CTI can work with any set of security controls because the baseline security control was derived from various standards and best practices. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Dimension** & **Control** & **Cluster** \\ \hline Governance & 1. Cybersecurity Objective & Policy and Procedure \\  & 2. Information Security Policy/Cybersecurity Policy & \\  & 3. Cybersecurity Roles and Responsibilities & \\  & 4. Legal and Regulatory Requirements regarding & \\  & Cybersecurity & Legal \\  & 5. Supplier Management & Third Party Management \\  & 6. External Parties Personnel Management & \\  & 7. External Parties Services and Delivery & \\ Asset management & 8. Inventory of Asset & Asset management \\  & 9. Asset Categorization & \\  & 10. Vulnerabilities of Asset & \\  & 11. Use of Asset & \\  & 12. Mobile Devices and BYOD & Mobile and BYOD management \\ Risk management & 13. Establishing the Context and Risk Process & Risk management \\  & 14. Risk Assessment & \\  & 15. Risk Treatment & \\ End User management & 16. Position Risk Designation & Human resource management \\  & 17. Prior to Employment & \\  & 18. During Employment & \\  & 19. Termination and Change of Employment & \\ Access control & 20. Access Right Management & Access management \\  & 21. Audit Trails linked to Individual Users & \\  & 22. Authentication for Transaction & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: CTI Controls, Clusters, and Dimensions. A base measure is a variable that we can assign a value to based on the measurement of the attribute. It serves as an intermediate parameter that gives a signal about the attribute. All methods listed in Table 1 do not have base measures, thereby causing the measurement operations to be subjective and further requiring human judgment to rate or assign values to the attributes.