## 4 The Cybersecurity Awareness Inventory (CAIN)
### Methods  
#### 4.2.1 Development of the Questionnaire  
The items of the CAIN were generated from the ISO/IEC 27032:2012 (Information Technology-Security Techniques-Guidelines for Cybersecurity). The document was carefully examined, and salient components were transformed into potential items. The potential items were constructed trying to cover all sections of the standard, starting with the most general definitions and ending with more specific aspects, such as those concerning stakeholders. An initial set of 116 potential items was evaluated by four judges (two authors and two experts not involved in this study), who rated all items on a scale from 1 (keep) to 3 (drop). The criteria for dropping were: lack of comprehensibility to the general public (e.g., \"Crossborder legal issues are not a problem in the investigation\"), lack of generality (the item was specific to organizational rather than personal issues: e.g., \"It is recommendable to share with other stakeholders the reports related to risks\"), and redundancy (the item's content was already addressed by other items: e.g., \"A computer can be remotely hacked\" was removed and \"Computers can be controlled remotely\" was kept). Raters assessed each item using a 1 to 3 score. Scores were then averaged, and items that needed attention were further checked in order to decide whether to keep or drop them. After these sessions, the set was reduced to a draft version of 51 items. A True/False response scale was implemented. That version was then administered to a small convenience sample to test the comprehensibility of the items. This phase led to a further reduction of the items to 46. The following is the description of the ISO/IEC 27032:2012 sections, along with the corresponding items that were generated and retained. It should be noted that sections do not represent dimensions or latent factors: they are only the product of a categorization leading to the table of contents of the ISO document. Terms and definitions. This section reports terms and definitions given in ISO/IEC 27000 (Information Security Management Systems Family of Standards) that apply for the purposes of the ISO/IEC DIS 27032 (items #1, #2, and #3). Some of these terms and definitions (and related examples reported in this section) provided a cue for generating items. _Overview._ This section provides an overview related to introductory aspects of ISO/IEC 27032, especially regarding how individuals manage their online identity (items #4, #5, #6, and #7). Some people are more careful about what they share online while others tend to upload online (e.g., on social networks) personal information that third parties can also appropriate. The items derived from this subsection refer specifically to the knowledge that both individuals and organizations have with respect to sharing their personal information and awareness of how their actions involve consequences of their own responsibility. _Assets in cyberspace._ ISO/IEC 27032 defines assets as \"anything of value to the individual and the organization that [...] is classified into personal and organizational assets\" (p. 15). This section specifically reports items that were generated from the information on personal assets (items #8, #9, #10, and #11). _Treats against the security of cyberspace._ This section includes items that address the threats that exist in cyberspace in relation to the previously mentioned assets (items #12, #13, #14, #15, #16, #17, #18, #19, #20, #21, #22, and #23). Threats are divided into two areas: threats to personal assets and threats to organizational assets. The former mainly relate to identity issues revolving around the leakage or theft of personal information, while the latter relate to those threats that organized cybercrime groups deployed to cause damage to organizations (e.g., stealing an organization's URL and reviewing data to another organization unrelated to the real one).