# The Cybersecurity Focus Area Maturity (CYSFAM) Model
## 4 Artifact Development
### Identifying the Dependencies and Positioning the Capabilities in the Maturity Matrix  
Another step in developing CYSFAM was to identify the dependencies of the capabilities and positioning them in a maturity matrix. Some capabilities in CYSFAM required that one or more other capabilities, either in the same focus area or in another focus area, be implemented first. In this section, first, dependencies between the capabilities are explained. Second, a matrix that presents the dependencies visually is presented. The paragraphs below describe the dependencies of the capabilities and the arguments of these dependencies. Establishing cybersecurity capabilities in an organisation starts with management commitment. The management should allocate resources for further implementations of cybersecurity capabilities [20]. The first capability to be implemented is, therefore, capability A of Cybersecurity Governance. Capability B of Cybersecurity Governance follows next. With this capability, the roles and responsibilities within the organisation are defined. This capability enables all the other organisational capabilities to be implemented. Regarding the technical capabilities, network security should be implemented before every other technical control in cyberspace can be implemented. Therefore, Network Security capability A enables the other technical capabilities. Cybersecurity Governance C requires serious security breaches to be escalated is, therefore, it is dependent on Incident Management B. Incident Management B requires incident response teams to receive vulnerability information from reliable sources. This constitutes a dependency on Vulnerability Management B. Mobile Security A requires an employee awareness program, therefore, it is dependent on Cybersecurity Awareness A. Social Engineering Controls C requires a training and awareness program; therefore, it is dependent on Cybersecurity Awareness capability B. End-user Control B requires the measurement of patch delays; therefore, it is dependent on Server Protection A.  
Cryptography A requires secure application development practices and, therefore, it is dependent on Application Security A. Application Security B requires awareness training for the development staff; therefore, it is dependent on Cybersecurity Awareness A. Incident Management C requires specialised training for the CIRT (Critical Incident Response Team) members; therefore, it is dependent on Cybersecurity Awareness B. Social Engineering Controls \begin{table}
\begin{tabular}{c c c c} \hline \hline \# & **Focus Area** & \
\begin{tabular}{c} **Number of Capability** \\ **Assessment Questions** \\ \end{tabular} & **Standard/Model/Framework** \\ \hline \multirow{2}{*}{1} & Server protection & 16 &
\begin{tabular}{c} ISO/IEC 27032 [17], The ISF \\ Standard of Good Practice for \\ Information Security [51, 53] \\ ISO/IEC 27032 [17] \\ ISO/IEC 27033 [21] \\ ISO/IEC 27033 [21] \\ ISO/IEC 27033 [22] \\ ISO/IEC 27034 [23] \\ ISO/IEC 27035 [24] \\ ISO/IEC 27035 [25] \\ Security Awareness Roadmap [54], \\ ISO/IEC 27001 [20] \\ \end{tabular} \\
8 & Cryptography & 16 &
\begin{tabular}{c} A Maturity Model for Enterprise \\ Key Management [50] \\ Cyber Security Self-Assessment \\ Guidance [47] \\ Guidelines for Managing the \\ Security of Mobile Devices in the \\ Enterprise [52] \\ \end{tabular} \\
11 & Vulnerability management & **8** &
\begin{tabular}{c} A Maturity Model for Enterprise \\ Key Management [50] \\ Cyber Security Self-Assessment \\ Guidance [47] \\ Guidelines for Managing the \\ Security of Mobile Devices in the \\ Enterprise [52] \\ Critical Security Controls for \\ Effective Cyber Defense [46] \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Focus areas of CYSFAM and reference standards, models, and frameworks.