# The Cybersecurity Focus Area Maturity (CYSFAM) Model
## 8 Conclusions  
The research presented in this paper contributes to the domain of cybersecurity frameworks, particularly, cybersecurity self-assessment frameworks and maturity models. By surveying extensive literature, the domain-expert evaluations, and a case study in a large organization, a scientifically grounded cybersecurity focus area maturity model (CYSFAM) was developed which complements the information security focus area maturity model (ISFAM) [15]. By presenting the way CYSFAM complements ISFAM, we provide organisations with the broad view of an overarching security approach. The expert evaluations resulted in improvements that were incorporated within the cybersecurity capabilities. The case study showed the applicability of the model, and results helped the formulation of a company's cybersecurity improvement plan.  
The CYSFAM encompasses 11 focus areas (sub-domains) in the cybersecurity domain. These focus areas are grouped into two categories as Technical and Organizational to facilitate understanding and manageability. As CYSFAM is a maturity model, it has assessment and measurement components in it. The 144 assessment questions to assess the cybersecurity capabilities constitute a large part of the model and they are included in a separate report which is openly accessible. The visual presentation and accompanying description of the cybersecurity capabilities in the CYFAM can enable organisations to formulate their capability implementation plan. As CYSFAM was evaluated by cybersecurity experts and demonstrated in a case study company, it provides a solid foundation for organisations to start  
Figure 6: Federative Information Security Toolkit (FIST) integrating the ISFAM and CYSFAM—structured according to the ISO/IEC 27032 security domains. The letters (A–E) represent the capabilities; shaded areas show the maximum capability achieved for the corresponding focus area.  
their cybersecurity endeavours with. CYSFAM is characterized by being a focus area maturity model based mainly on standards. As the assessment questions are mostly derived from standards and frameworks, CYSFAM can inherently facilitate awareness of and adherence to standards. In addition, due to its high granularity, CYSFAM can provide tangible process improvement advice.  
To get the most benefit from the CYSFAM as an improvement instrument, including implementation guidelines per capability and personalized advice would be considered as a significant future research area. As we further elaborated in Section 7, maintainability of the model and adaptability of the model by SMEs are the most predominant areas for future research. Our ongoing research focuses on designing an adaptable cybersecurity maturity model considering the characteristics SMEs and their roles in the digital ecosystem.  
Conceptualization, M.S.; Formal analysis, B.Y.O. and S.v.L.; Funding acquisition, M.S.; Investigation, B.Y.O. and S.v.L.; Methodology, B.Y.O. and S.v.L.; Resources, M.S.; Software, S.v.L.; Supervision, M.S.; Validation, B.Y.O. and S.v.L.; Writing--original draft, B.Y.O. and S.v.L.; Writing--review and editing, B.Y.O. and M.S. All authors read and agreed to the published version of the manuscript.  
This work was made possible with funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No 740787 (SMESEC). During this research, [PERSON] was a full time PhD candidate supported by the SMESEC project. The opinions expressed and arguments employed herein do not necessarily reflect the official views of the funding body.  
The authors declare no conflict of interest. The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript, or in the decision to publish the results.