# Cyber Resilience Progression Model
## 2 Methodology
### Interviews' Design and Execution  
In order to obtain a progression model from the experts' point of view, the interviews were designed to be a systematic construction of a progression model. To achieve this, all the experts were given a simplified version of the domains and policies (e.g., \"make an inventory of assets\" instead of \"Make an inventory that lists and classifies the company's assets and identifies the critical assets\"). These simplifications were made to avoid biasing the perspective of the expert by adding advanced characteristics of the policy within the way of writing it. The table with the domains and simplified policies was given to the experts in a document that served as the interviews' script. This document also contained the definitions for \"cyber resilience\" and \"progression model\" as well as the objectives of the interviews, the expected results and the following two-step methodology:  
Step1: Establish a starting point for each cyber resilience policy. In this step, they were also asked to keep in mind dependencies among these policies and their own experience in order to place these policies on a starting point from a scale of 1-5. Where one is the least advanced, least mature of companies and five the most advanced maturity level. The scale was selected based on other maturity models in the literature, which vary from three to six maturity levels [18; 21; 31]. Step 2: Describe how these policies progress over the next steps of the scale. For instance, if a policy starts at level three, how the policy manifests in a company at level three, then level four, and finally level five. In these steps the scale was defined without names for each maturity level to avoid biasing through the usage of names (e.g., if level 5 is called \"Optimizing\" as in the Capability Maturity Model Integration (CMMI) [40], the actions described in level five would be limited to optimization actions). Other maturity models in the literature also avoid the usage of names for their maturity levels [18; 21]. With this information, the experts were interviewed one by one and the 11 interviews were recorded to ensure the correct transcription of the interviews. The transcriptions were also sent to each expert in order to double check that their ideas were captured accurately and avoid incorrect recording of data and/or a biased interpretation of what the experts responded. A graphical overview of how the resulting progression model from each expert is shown in Figure 1. This is also similar to the final result of this article after the analysis of the interviews described in the following subsection. Figure 1: Graphical overview of resulting progression models. During the interviews, the experts commonly asked the following questions:  
* If they could start a policy at level five and, therefore, have no evolution. This was allowed as it was considered an interesting statement on the complexity of a policy. * If policies could stay the same through various levels (or skip them, which was equivalent) and evolve when the level of maturity was higher (for example, stay the same from 1-3 and change in 4 and 5). This kind of evolution was also allowed since it would allow a realistic view of the progression of a policy. * If they should try to depict reality or define the best possible scenario. In this case, they were asked to do their best to be realistic but in case they believed a policy is not applied in their context to try to place the policy in an ideal starting point considering the companies' capacities at that maturity level. To avoid fatigue during the interviews and thus bias due to this fatigue, the interviews were limited as much as possible to one hour and 30 min. The average duration of the interviews was 1 h and 20 min. This was possible because the experts were given the scripts previously and the transcription of their ideas was made after the interview, which permitted the experts to speak freely and without delays.