The Order of the Factors DOES Alter the Product: Cyber Resilience Policies' Implementation Order

摘要

Cyber resilience can help companies today thrive despite the adverse cyber threat environment. This discipline adds to cybersecurity the mindset of preparing for the unexpected and prioritizing business continuity over simply protecting systems and assets. However, cyber resilience operationalization requires knowledge and investing into its multiple domains and policies. Moreover, the only aids companies have for the operationalization of cyber resilience are frameworks that list the domains and policies, but do not guide them on an effective order in which to implement them. These aids will often require companies to select the set of policies that suits them and decide the order of implementation on their own. This selection process will require resources for acquiring the required knowledge on top of the resources for the implementation of the policies. Since most companies have limited resources and to minimize the investment required for cyber resilience operationalization, this study proposes an implementation order for cyber resilience policies based on the current literature and the iterative evaluation by six experts. This implementation order could potentially help companies operationalize cyber resilience effectively and diminish the investment needed to do so.