# Cyber Resilience Progression Model
## 3 Results
### Information Security  
Information security is the cyber resilience domain that involves measures and procedures to maintain confidentiality, integrity, and availability of the company's assets and information [24]. Information security policies and the number of experts who placed them in each starting maturity level are shown in Table 20. As shown in the table, the starting maturities for IS1, IS2, and IS3 are defined by a consensus on levels 1, 2, and 1, respectively. IS1 and IS3 have a defined consensus because of the confidence interval criterion, and IS2 has a consensus because the mode is equal to the mean starting maturity. \begin{table}
\begin{tabular}{c c c c c} \hline
**Policy**\(\backslash\)**Progression** & **1** & **2** & **3** & **4** & **5** \\ \hline \multirow{4}{*}{AT1} & & There is a general & & & Each employee has \\  & & cyber resilience & & & training plans \\  & & training plan for all the & & & training plans \\  & & employees in the & & to different profiles & according to their \\  & & company. & & needs and gaps in \\ \hline \multirow{4}{*}{AT2} & & The company & & The company \\  & & evaluates the gaps & & periodically \\  & & in the personnel & & evaluates the gaps in \\  & & abilities to perform & & the personnel’s \\  & & their cyber & & knowledge and \\  & & resilience tasks in & & abilities in order to \\  & & order to define the & & keep the plans \\  & & training plans. & & updated. \\ \hline \multirow{4}{*}{AT3} & & All the personnel & & \\  & & receives technical & & All the personnel \\  & & The technical & & training needed & receives technical \\  & & personnel receives & & according to their \\  & & general technical & & profile and general & their specific \\  & & training. & tasks performed by & (personal) needs and \\  & & & employees from & gaps in their abilities. \\ \hline \multirow{4}{*}{AT4} & & There are & & There are & \\  & undocumented & There are occasional & & periodical (with a \\  & and/or & awareness & & defined period), & \\  & unfollowed & communications for & & documented and & awareness training \\  & cyber resilience & basic cyber resilience & & planned awareness & courses or \\  & rules for & measures in which all & & training sessions or & communications for \\  & everyone & the employees can & & communications in & the employees such \\  & related to their & & participate. & the company. & as spam exercises, \\  & awareness. & & & training sessions, etc. \\ \hline \end{tabular}
\end{table} 
Table 19: Awareness and training policies’ progression model. In the case of the information security domain there was also clear consensus on the progression type for these policies. As shown in Table 21, most experts considered these policies to have mostly a technological progression. Considering the experts' consensus on the starting maturity levels and progression types for information security policies, Table 22 presents a progression model for this domain. \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline \begin{tabular}{c} **Policy** \\ **Code** \\ \end{tabular}  & **1** & **2** & **3** & **4** & **5** & **Mean** & **Mode** & **Sub-Mode** & **LCI** & **UCI** & **Consensus** \\ \hline \multicolumn{10}{c}{Implement measures to protect confidentiality (e.g., access control measures, network segmentation, cryptographic techniques for data and communications, etc.)} \\  
On the other hand, regarding progression types, there was no consensus on either of the policies as shown in Table 24. As shown in the table the experts were quite divided on the types of progressions for these policies. In the DPM1 policy, most experts considered that there was a mix of a technological and expansion progressions, this means that it starts with the monitorization of certain assets and expands to the rest progressively while also improving the technological solutions used to monitor the assets as maturity increases (which reflects its technological nature).