## 5 Analysis of the Results
These results highlight which security requirements tend to have high coverage (such as 'TA1.1' and 'AM1.1') and which ones tend to have low coverage (such as 'CR3.2' and 'TA2.2'). Figure 18 shows the average qualitative score for each cybersecurity requirement, where a higher score indicates better coverage. The results show that the following requirements have high coverage:  
* TA1.1: Implement a vulnerability management program. * AM1.1: Use access control mechanisms to control access to systems and data. * MC1.2: Monitor information systems and networks for security events. * TA1.3: Respond to security incidents in a timely and effective manner. The following requirements have low coverage:  
* CR2.1: Conduct risk assessments to identify and prioritize cybersecurity risks. * CR3.2: Implement a security awareness and training program. Figure 18: Top 10 Security Baseline requirements by their coverage. * TA2.2: Implement and maintain a configuration management program. * RP2.1: Regularly review and update security policies and procedures. As explained above, taking the average of a qualitative score is a common practice in research, particularly in the field of cybersecurity. This is because it can be difficult to quantify the effectiveness of cybersecurity legislation, and qualitative scores provide a way to compare different pieces of legislation on a common scale. These requirements are covered mostly in comparison with other requirements by the standards, directives, or regulations that are presented in Figure 19.  
It is clear that GDPR has the highest average coverage, indicating that it tends to fully meet the requirements, while NIS 2 has the lowest average coverage, suggesting that it often does not meet the requirements or only partially meets them. This analysis can be beneficial for organizations to understand which standards and compliance levels are best suited to their needs and where they might need to focus their efforts to improve their security practices. ISO/IEC 27001:2022 is a standard for Information Security Management (ISMS), while the General Data Protection Regulation (GDPR) is a regulation in the European Union (EU) that sets out rules on the protection of personal data. Although ISO/IEC 27001:2022 and the GDPR are different in nature, there is a significant overlap between the two frameworks. Both frameworks require organizations to implement a number of measures to protect data, such as:  
* Conducting risk assessments to identify and prioritize security risks;
* Implementing appropriate security controls to mitigate those risks;
* Monitoring and reviewing security controls on an ongoing basis;
* Providing training on security awareness to employees. Both ISO/IEC 27001:2022 and the GDPR require organizations to have a process in place for responding to security incidents. The following are some specific examples of the overlap between ISO/IEC 27001:2022 and the GDPR:  
* ISO/IEC 27001:2022 Control A.12.6.1 requires organizations to implement access control mechanisms to control access to information systems and data. This is similar to article 25 of the GDPR, which requires organizations to implement appropriate technical and organizational measures to protect personal data. * ISO/IEC 27001:2022 control A.13.1.1 requires organizations to implement measures to detect and report security incidents. This is similar to article 33 of the GDPR, which requires organizations to notify the supervisory authority within 72 h of becoming aware of a personal data breach. Figure 19: Distribution of coverage per different legislation. * ISO/IEC 27001:2022 control A.8.2.1 requires organizations to implement measures to protect the confidentiality of information. This is similar to article 32 of the GDPR, which requires organizations to implement appropriate technical and organizational measures to protect the confidentiality of personal data. The overlap between ISO/IEC 27001:2022 and the GDPR makes it logical to compare the two frameworks.