## 3 Survey Measures in Cybersecurity  
A variety of survey measures of cybersecurity awareness, habits, attitudes, and behaviors have already been proposed in the literature. However, they have several limitations. Some authors have created questionnaires that include a few items about security behaviors in order to correlate them with measures other than knowledge (e.g., personality measures [3]). Such tools do not focus on the relationship between cybersecurity awareness/knowledge and behaviors, but rather on how individual characteristics may influence the enactment of more or less secure behaviors.  
Another limitation of existing questionnaires is that of the theoretical background on which the questionnaire is based. Theoretical backgrounds are often diverse and sometimes the frameworks used are outdated, as in the case of the Parkerian Hexad Model developed in the 1990s, on which the questionnaire by [PERSON] and [PERSON] [8] is based. Theories taken from different fields and sometimes not even specific to the domain cybersecurity are often used. The OBBSQ questionnaire by [PERSON] and collaborators [18], for example, uses a theoretical model that is not related to behaviors or knowledge about cybersecurity. Rather, the model was intended to explain non-adherence to healthy behaviors in general (Health Belief Model). Although there is value in investigating whether models can generalize across domains, there are many distinctive aspects to cybersecurity knowledge and contexts that are key to understanding cybersecurity behavior. For example, in comparing physical security behaviors and cybersecurity behaviors, individuals may be more likely to routinely close their curtains than cover their webcams.  
Another major limitation is the lack of a clear definition of what aspects are intended to be investigated. In the case of the CS-S [8], for example, most of the proposed factors contain items related to secure and unsecure behaviors, with only one factor composed of items related to knowledge/awareness.  
Existing cybersecurity questionnaires have undoubtedly increased knowledge and promoted research in this field. They have also been administered to very large samples from organizational settings, e.g., [8, 18, 19]. However, there generally seems to be little consensus among these various surveys with respect to the underlying theory, the aspects to be investigated, and the most appropriate response scale to use.  
Given the limitations of the questionnaires reported above, we decided to adopt a more comprehensive, atheoretical, and updated solution for developing a specific measure of cybersecurity awareness: relying on the guidance provided by ISO/IEC 27032:2012 (Information Technology-Security Techniques-Guidelines for Cybersecurity).  
Using a standard reference (ISO/IEC 27032) for item structuring compensates for the limitations of some of the questionnaires just described. First, it is an international standard that provides for its application to different countries, although these may differ in technological readiness or technological advancement. By creating a framework and identifying a specific terminology, it allows those involved in cybersecurity to collaborate in solving cybersecurity problems, providing a shared vocabulary and shared knowledge that it is good for all to acquire if they intend to interface with such a complex and multidetermined topic.  
Second, the purpose of the ISO/IEC 27032 is to provide a guide to improve knowledge and address issues related to cybersecurity, offer an overview of the topic, identify the parties and roles involved in cybersecurity, and differentiate it from other types of security. The standard highlights these particularities and distinguishes cybersecurity from other security domains, such as: information security, network security, Internet security, and critical information infrastructure protection (CIIP).