# Cyber Resilience Progression Model
## 3 Results
### Incident Analysis  
Incident analysis is the cyber resilience domain that involves the procedures and policies to make detailed investigations to obtain as much information as possible from suffered incidents with the objective of learning from those incidents and improving protection methods to prevent future incidents [14; 24]. The incident analysis policies' starting maturities were strongly agreed upon as shown in Table 14. In this case, IA1 was considered to start at level 2; IA2 and IA4 were considered to start at level 3, and IA3 was considered to start at level 5. On the other hand, as shown in Table 15, only IA1 and IA3 had more than 50% of the experts considering that their progression type was the same as the mode. In these policies formalization and no progression were selected as their main progressions. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline
**Policy** & **Code** & **1** & **2** & **3** & **4** & **5** & **Mean** & **Mode** & **Sub-Mode** & **LCI** & **UCI** & **Consensus** \\ \hline Assess and document the damages suffered after an incident. & IA1 & 1 & 6 & 3 & 0 & 1 & 2 & 2 & N/A & 1 & 4 & 2 \\ \hline Analyze the suffered incidents to find as much information as possible: causes, methods, objectives, point of entry, etc. & IA2 & 2 & 2 & 2 & 0 & 3 & 3 & N/A & 2 & 4 & 3 \\ \hline Evaluate the company’s response and response selection to the incident. & IA3 & 0 & 1 & 2 & 2 & 6 & 4 & 5 & N/A & 3 & 6 & 5 \\ \hline Identify lessons learned from the previous incidents and implement measures to improve future responses, response selections, and risk management. & IA4 & 0 & 1 & 6 & 2 & 2 & 3 & 3 & N/A & 1 & 3 & 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Incident analysis policies’ starting maturity. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline
**Policy** & **Progression** & **1** & **2** & **3** & **4** & **5** & **Mean** & **Mode** & **Sub-Mode** & **LCI** & **UCI** & **Consensus** \\ \hline \multirow{4}{*}{TVM1} & \multirow{4}{*}{TVM1} & Threats and vulnerabilities are identified intuitively and according to the experience of the personnel. & \multirow{4}{*}{IA1} & Threats and vulnerabilities associated to the company’s assets that has been put together & \multirow{4}{*}{4} & \multirow{4}{*}{5} & \multirow{4}{*}{N/A} & \multirow{4}{*}{6} & \multirow{4}{*}{5} \\  & & & & & & & & & & & \\ \cline{1-1}  & & & & & & & & & & & \\ \cline{1-1}  & & & & & & & & & & & \\ \cline{1-1}  & & & & & & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Threat and vulnerability management policies’ progression model. In the cases of IA2 and IA4, no consensus was reached for their progression type. Many experts considered IA2 to have a specificity progression, but others considered that this policy could have a formalization or proactivity progression as well. The specificity progression in this policy refers to more specific and detailed analyses of incidents when they happen (better forensics). A formalization progression in IA2 would mean more systematic and standardized approaches to the forensic analysis and finally a proactivity progression would mean that the company learns to perceive the benefits of the analysis and thus has a proactive attitude towards inquiring causes, methods, points of entry, etc., of incidents. For policy IA4, many experts described a formalization progression, but more than half of the experts considered that the policy could progress by increasing proactivity or not progress at all once it has been implemented. Based on the majority of the experts' opinions on the starting maturity and progression types for each of the incident analysis policies, a progression model was constructed and it is presented in Table 16.