A Framework to Achieve Cybersecurity Accountability of Critical Infrastructure Providers – A Design Science Research Approach

Today’s pervasive use of information systems (IS) not only comes with many opportunities but also with considerable risks especially in relation to cyberattacks, which become increasingly sophisticated and dangerous. Especially organizations providing critical infrastructures are at risk, which are held to account by governments to ensure sufficient protection. Governments request information to monitor cybersecurity levels of critical infra-structure providers over time, which are today subject to respective nation-wide legislation in developed economies. Following guidelines of design science research, this study offers a generic framework that supports continuous monitoring and benchmarking of an organization’s cybersecurity status. It is generic allowing application by different critical infrastructure providers and usage by government institutions to help achieve oversight of the nation-al cybersecurity status. Our design proposition is supported by an extensive review of academic literature, the consultation of relevant industry standards, and two main rounds of field interactions. The framework includes 15 major risk areas, and a collection of associated metrics and controls, which cover material and social mechanisms. We would like to note that our domain of study would require more design work that targets knowledge accumulation spanning academic research and industry practice.