# Resilience in the Context of Cyber Security: A Review of the Fundamental Concepts and Relevance
## 4 Main Stages and Research Aims
Based on the concepts researched by the authors studied and consolidated in Table 1, it was possible to map out seven stages used to characterize a resilience cycle: preparation, detection, resistance, response, adaptation, recovery, and learning. The number of citations for each stage can be seen in Figure 1, where the stages of resistance, response, adaptation, and recovery are most frequently cited by the authors as stages that characterize a state of resilience, while fewer authors present preparation, detection, and learning. Analyzing the authors that specifically address the subject of cyber resilience reveals a modest variation, with resistance, adaptation, and recovery being the most referenced stages, while preparation, detection, response, and learning are less cited, as shown in Figure 2.  
However, it is important to highlight that these concepts are evolving over time as our understanding of the stages of cyber resilience evolves and new terms are adopted. Figure 1: Number of citations to the stages of resilience. Figure 3 shows how the concept of resilience has evolved over the years. Based on the authors studied, resilience was initially understood as resistance, adaptation, and recovery, and over the years and the progress of studies on the subject, other stages have been added, allowing the characterization of new stages such as detection and learning, which are more frequently found in the literature researched from 2020 onwards. Figure 3: Characterization of the stages of resilience over the years. Figure 2: Main citations to the stages of cyber resilience. Also based on the authors studied shown in Table 1, some of the stages in their definitions have overlapping concepts. A regrouping of these stages is therefore proposed by the authors of this work, trying to optimize the representation of cyber resilience, particularly for the purpose of measuring cyber resilience in future field works (Figure 4). Figure 4 presents the mentioned proposal for cyber resilience states based on the mapping carried out with the authors studied, suggesting 4 stages of cyber resilience: Monitoring-Detection; Resistance-Absorption; Response-Adaptation; and Recovery-Reconstruction. The 'Monitoring-Detection' and 'Resistance-Absorption' stages are not always consciously perceived by management, particularly in cases where the system is technically self-sufficient to automatically monitor, detect, resist, and absorb a given adverse event. Therefore, empirical assessments of these two stages would be subjective in nature. It should also be noted that the 'Monitoring-Detection' stage is a process that is carried out continuously and that its execution may overlap in different phases, i.e., monitoring/detection will take place before, during and after a crisis. However, for the purposes of representing cyber resilience, 'Monitoring-Detection' is the first stage of cyber resilience. Empirical assessments of the 'Response-Adaptation' and 'Recovery-Reconstruction' stages, on the other hand, could be made with reasonable objectivity since they are conducted by management. It is important to highlight too that the two other stages (Planning-Preparation and Learning-Optimization) which, although they are not characterized as stages of resilience per se (Figure 4), are equally relevant to resilience. One of them is the planning and preparation stage--which precedes a crisis scenario--and is essential for achieving an effective response to the four stages of resilience presented. Another important stage is that of learning and optimization, since once a service has recovered and stabilized to the initial conditions, the learning produced by an event can be considered to improve the resilience system, adding this new knowledge to prepare an even more resilient system. In this way, we have an initial time (\(t_{0}\)) where a particular IT service is observed in operation, when this service is monitored to identify adverse events (incidents) that could impact its availability/capacity, i.e., its security.