# Cyber Resilience Progression Model
## 3 Results
### Asset Management  
Asset management is the cyber resilience domain that involves the management of devices, systems, software, services, and facilities that enable the organization to achieve business purposes [14].  
Asset management contains five main policies [24]. These policies and their starting maturity levels are shown in Table 8. As shown in the table, there is consensus on most of these policies. In policies AM1, AM2, and AM4 the mean is equal to the mode and, therefore, there is consensus. For policy AM5, there was consensus because there was no sub-mode and the mode was contained in the confidence intervals.  
For policy AM3 on the other hand no consensus was reached because neither the mode nor the sub-mode were equal to the mean starting maturity level. The reason for the non-consensus in AM3 is that some experts considered that companies should start implementing a change control policy in a basic form and related to the next policy (AM4) from a starting maturity of level 2. Conversely, others considered that a change control policy would require the implementation of a stable situation through a standardized base configuration of assets (AM2); therefore, these experts suggested that AM3 should be implemented at a starting maturity of 4.  
Regarding the progression types of asset management policies, as shown in Table 9, there is only a consensus on AM1 having a specificity progression and AM4 having a proactivity progression. On the other hand, for configuration definitions and change control policies (AM2 and AM3) some experts consider there is a mix between formalization (documentation and systematization) and technology (increase in the complexity or number of technological solutions) but proactivity (perceiving and actively pursuing the benefits of performing these tasks) was also considered a common type of progression. In the case of AM3, some experts also argued that it could have a progression where it started for certain assets and expanded to the rest of the assets (expansion).  
Finally, for AM5 experts argued that the progression of the dependency management was mostly in formalization and proactivity, meaning that dependency management was more systematic and standardized, and that companies saw more value and changed attitude towards it as their maturity increased. However, other experts had different opinions, most of the divergent opinions tended towards specificity, which referred in this case to finding assets' components and parts' dependencies. Therefore, no consensus on this policy's progression type was found.  
Using the mode criteria for the starting maturity and the progression types where there is no consensus, the defined consensus and progressions given by the experts, a progression model was constructed and is presented in Table 10.  
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Policy**} & **Policy** & **Code** & **1** & **2** & **3** & **4** & **5** & **Mean** & **Mode** & **Sub-Mode** & **LCI** & **UCI** & **Consensus** \\ \hline Make an inventory that lists and classifies the company’s assets and identifies the critical assets. & AM1 & 0 & 5 & 0 & 0 & 0 & 1 & 1 & 2 & 0 & 3 & 1 \\ \hline Create and document a baseline configuration for the company’s assets. & AM2 & 1 & 4 & 5 & 1 & 0 & 3 & 3 & 1 & 1 & 4 & 3 \\ \hline Create a policy to manage the changes in the assets’ configurations. & AM3 & 1 & 4 & 2 & 3 & 1 & 3 & 2 & 4 & 2 & 4 & No consensus \\ \hline Create a policy to periodically maintain the company’s assets. & AM4 & 4 & 5 & 1 & 0 & 1 & 2 & 2 & 1 & 1 & 3 & 2 \\ \hline Identify and document the internal and external dependencies of the company’s assets. & AM5 & 1 & 3 & 2 & 1 & 3 & 2 & N/A & 2 & 4 & 2 \\ \hline \hline \end{tabular} The background highlights the maximum frequency for each policy.  
\end{table}
Table 8: Asset management policies’ starting maturity.