# Cyber Resilience Progression Model
## 1 Introduction  
The consistently growing number of cyberattacks and variety of cyber threats through the previous years' reports [1; 2; 3] demonstrates the risk that the current cyber scenario represents for companies. Moreover, these cyber threats are being targeted towards small and medium-sized enterprises (SMEs) because these represent a significant payload as a group and often have limited knowledge and resources to face these threats [4]. This cyber threat scenario makes cyber incidents one of the most impactful and one of the most probable risks that companies face [5; 6]. On the other hand, technology is advancing fast, making the cyber threat scenario more volatile and facing it even harder. For instance, Industry 4.0 introduces the challenge of connecting OT technologies into IT-like networks, which has been studied because of the complexity that this adds when trying to protect networks and systems [7; 8]. The aggressive cyber threat scenario combined with the rapid changes in technology has made the task of creating protected and fail-safe systems (the objective of traditional cybersecurity [9]) an unrealistic way of protecting a company from cyber incidents. In this sense, several experts and entities [10; 11; 12] have agreed that cybersecurity requires a broader approach that they have called cyber resilience. Cyber resilience is defined as the \"ability of a process, business, organization, or nation to anticipate, withstand, recover, and evolve in order to improve their capabilities in face of adverse conditions, stress, or attacks to the cyber resources it needs to function\" [13]. Some authors also include the ability to detect in this definition [12; 14]. This concept, contrary to traditional cybersecurity, intends to make companies and their systems safe-to-fail [9]. This apparently slight change in the pointof view converts cybersecurity in a much more robust strategy that is prepared to respond, recover and adapt from incidents, which traditionally has not been in the priorities of cybersecurity [15; 16]. Thus, cyber resilience can also make companies more robust against the changing cyber threat scenario, with more robust and adaptable ways to face cyber threats [11]. Although implementing a cyber resilience point of view can be a solution for companies to face the current evolution of technology and the aggressive cyber threat scenario, cyber resilience can prove to be hard to operationalize. This difficulty stems from its comprised of several domains (governance, business continuity, information security, etc.) with hundreds of policies within them [14; 17; 18] and intricate relationships between these domains and policies [19]. Thus, the problem considered in this article is that cyber resilience operationalization is difficult but needed by companies in the current cyber scenario. The current literature tries to ease the process of operationalizing cyber resilience through frameworks, self-assessment questionnaires, standards and maturity models [13; 14; 18; 20; 21; 22; 23; 24; 25]. A current literature review identified over 200 cyber resilience assessment frameworks [26]. However, these frameworks often include very detailed lists of policies and actions without means for prioritization of these actions or strategies on how to implement each action in the company. Most frameworks can serve as examples of enumeration of policies and domains that companies should implement in order to operationalize cyber resilience [12; 14; 17; 27]. For instance, one of the most popular cybersecurity frameworks is the National Institute of Standards and Technology's (NIST's), which lists over 100 policies (called subcategories) in over 30 domains (called categories) to achieve cyber resilience. The document in which these policies are defined explicitly says that they should be selected by the company according to a previous profiling [14], but the framework has no means, instructions or resources on how to do this profiling and how to select and prioritize these policies once the profiling is done.