## 5 Empirical Validation: A Case Study
### Actionable Insights and Framework Validation  
This case study demonstrates that the P-R-A-L framework moves beyond a simple vulnerability checklist to provide a holistic, quantitative assessment that identifies both strengths and critical, systemic weaknesses. The dimensional scores pinpointed a severe imbalance, with strong proactive defenses (P and R) but a critically weak reactive posture (A). A good assessment tool should uncover precisely these kinds of critical, non-obvious  
\begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Dimension** & **Key Indicator** & **Measurement Tool/Method** & **Finding (Raw Data)** & **Score** \\ \hline \multirow{4}{*}{P: Prevention} & Asset Identification & Document Review, Retina & 10 critical services & 90/100 \\  & API Security & Log Analysis, Manual Review & Incomplete logging for some & \\  & & & APIs & \\  & Supply Chain Security & Component Scan (e.g., Black & Outdated third-party & \\  & & Duck) & components found & \\ \hline \multirow{2}{*}{R: Resistance} & Attack Surface Mgmt & Port Scan (Nmap), Spiderfoot & 10 of 113 ports exposed (9\%) & 91/100 \\  & Log Integrity & Review of Cloud Config & 5\% of security logs incomplete & \\ \hline \multirow{4}{*}{A: Recovery} & Incident Response Process & Document Review, Interviews & No defined IR process & 66/100 \\  & Damage Isolation & Architectural Review & No effective module isolation & \\  & Backup & System Config Review & No redundancy or backup & \\ \cline{1-1} \cline{2-5}  & Attack Traceability & Simulation (Nemesis) & Lacked comprehensive & 85/100 \\ \cline{1-1}  & System Adaptability & OS Version Check & Relies on end-of-life CentOS & \\ \hline \hline \end{tabular}
\end{table}
Table 1: Detailed resilience assessment results from the case study.  
Figure 2: Case study resilience profile. The radar chart illustrates the quantitative assessment scores for the system under test across the four resilience dimensions: Preventive Capacity (P = 90), Destruction Resistance (R = 91), Adaptive Recovery (A = 66), and Learning Evolution (L = 85). The asymmetrical shape highlights the system’s imbalanced resilience, with strong proactive defenses but a critical deficiency in its ability to recover from incidents.  
imbalances. The framework worked as intended by diagnosing a severe weakness that might be overlooked by traditional assessments focused only on preventive controls.  
The framework generated specific, prioritized recommendations directly tied to the findings. The most urgent recommendation was to address the critical deficiency in the Adaptive Recovery (A) dimension by establishing formal incident response procedures, implementing robust module isolation, and deploying automated, heterogeneous backup and recovery mechanisms. For the other dimensions, the framework recommended implementing a patch management process for third-party components (P), ensuring comprehensive and consistent log aggregation (R), and developing an automated defense framework and a clear migration strategy for the unsupported operating system (L).  
In conclusion, this case study validates the practical utility of the RC model and P-R-A-L framework in a real-world critical infrastructure scenario. The framework successfully quantified the system's resilience posture and delivered specific, data-driven insights to guide targeted strategic improvements. As demonstrated, the framework's ability to identify non-obvious systemic weaknesses like a poor reactive posture, despite strong defenses, provides insights that would be difficult to identify using traditional risk assessment methods.