## 5 Analysis of the Results  
The data set, which was used during the process of methodological mapping, has undergone a restructuring process aimed at optimizing its suitability for subsequent analytical endeavors. Figure 17 shows the distribution of the coverage across various legislation for cybersecurity. The term \"coverage\" is employed to convey the extent to which each requirement is addressed, utilizing a scale that ranges from '0' to '3', where '0' signifies no coverage, '1' denotes partial coverage, '2' indicates combined coverage, and '3' represents full coverage. Figure 17 shows the distribution of coverage across various legislation for cybersecurity, using a qualitative score from 0 to 3, where 0 signifies no coverage, 1 denotes partial coverage, 2 indicates combined coverage, and 3 represents full coverage. Taking the average of a qualitative score is a common practice in research, particularly in the field of cybersecurity. This is because it can be difficult to quantify the effectiveness of cybersecurity legislation, and qualitative scores provide a way to compare different pieces of legislation on a common scale. When taking the average of a qualitative score, it is important to consider the following:  
* The reliability of the scoring system. The scoring system should be well-defined and consistently applied. * The number of items being scored. The average will be more representative if there are a large number of items being scored. * The variability of the scores. If the scores are highly variable, the average may not be a good measure of central tendency. In the case of Figure 17, the qualitative score is based on a well-defined scoring system and is applied to a large number of items (i.e., the different requirements in each piece of legislation). Additionally, the scores are not highly variable, as most pieces of legislation have a coverage score of one or two. Therefore, it is reasonable to take the average of the qualitative scores in Figure 17. The summary statistics provide a comprehensive overview of the results:  
* NIS 2 is the most common standard, appearing 334 times in the compliance framework of the Security Baseline;  
Figure 17: Distribution of coverage across different standards, directives, and regulations. * The coverage has values ranging from 0 to 3, with an average of approximately 1.31. This suggests that the average requirement is partly covered in the Security Baseline;
* NIS 2 article 21 appeared most frequently (128 times) in coverage of the requirements;
* NIS 2 standard has a high frequency of full coverage (3) and also a considerable number of requirements that are not covered at all (0);
* The ISO/IEC 27001:2022 standard has a significant number of fully covered requirements (3) and very few that are not covered (0);
* Certain compliance levels, such as 'RP1.1', 'RP1.2', and 'MC1.1', have a considerable number of requirements that are fully covered (3), while others, such as 'MC1.3' and 'MC1.2', have a significant number of requirements that are not covered at all (0). The average coverage for each of the analyzed security legislation is as follows: GDPR-2.11; ISO/IEC 27001:2022--1.98; ISO/IEC 27001:2013--1.60; CIS--1.29; CER--0.96; and NIS 2--0.56. This suggests that, on average, the GDPR standard has the highest coverage, while the NIS 2 standard has the lowest coverage. When looking at the average coverage for each compliance level, a wide range of values can be seen. Some compliance levels, such as 'TA1.1' and 'AM1.1', have high average coverages, while others, such as 'CR3.2' and 'TA2.2', have an average coverage of 0, indicating that they do not meet any of the requirements. These insights can be useful for identifying which standards and compliance levels are best at meeting the requirements and where improvements may be needed. Figure 18 presents the list of the Security Baseline requirements according to their coverage.