{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,5]],"date-time":"2026-05-05T12:25:45Z","timestamp":1777983945756,"version":"3.51.4"},"reference-count":87,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100004837","name":"Ministerio de Ciencia e Innovaci?n","doi-asserted-by":"publisher","award":["MCIN\/AEI\/10.13039\/501100011033"],"award-info":[{"award-number":["MCIN\/AEI\/10.13039\/501100011033"]}],"id":[{"id":"10.13039\/501100004837","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100014181","name":"Junta de Extremadura","doi-asserted-by":"publisher","award":["GR21097"],"award-info":[{"award-number":["GR21097"]}],"id":[{"id":"10.13039\/501100014181","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2022]]},"DOI":"10.1109\/access.2022.3223440","type":"journal-article","created":{"date-parts":[[2022,11,18]],"date-time":"2022-11-18T15:42:34Z","timestamp":1668786154000},"page":"122454-122485","source":"Crossref","is-referenced-by-count":14,"title":["CyberTOMP: A Novel Systematic Framework to Manage Asset-Focused Cybersecurity From Tactical and Operational Levels"],"prefix":"10.1109","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7252-7034","authenticated-orcid":false,"given":"Manuel","family":"Dom\u00ednguez-Dorado","sequence":"first","affiliation":[{"name":"Department of Information Systems and Digital Toolkit, Public Business Entity Red.es., Madrid, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3910-876X","authenticated-orcid":false,"given":"Javier","family":"Carmona-Murillo","sequence":"additional","affiliation":[{"name":"Department of Computing and Telematics Engineering, Universidad de Extremadura, Cáceres, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6624-7618","authenticated-orcid":false,"given":"David","family":"Cort\u00e9s-Polo","sequence":"additional","affiliation":[{"name":"Department of Signal Theory and Communications and Telematics Systems and Computing, Rey Juan Carlos University, Madrid, M\u00f3stoles, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7587-5539","authenticated-orcid":false,"given":"Francisco J.","family":"Rodr\u00edguez-P\u00e9rez","sequence":"additional","affiliation":[{"name":"Department of Computing and Telematics Engineering, Universidad de Extremadura, Cáceres, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref13","article-title":"Cyber-security holism: A system of solutions for a distributed problem","author":"dean","year":"2013"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1007\/s40860-020-00115-0"},{"key":"ref12","first-page":"12","article-title":"The board’s role in managing cybersecurity risks","volume":"59","author":"rothrock","year":"2018","journal-title":"Mit Sloan Manag Rev"},{"key":"ref56","first-page":"369","article-title":"Evaluation of cybersecurity management controls and metrics of critical infrastructures: A literature review considering the NIST cybersecurity framework","author":"barbara","year":"2018","journal-title":"Proc Nordic Conf Secure IT Syst"},{"key":"ref15","doi-asserted-by":"crossref","first-page":"224","DOI":"10.69554\/NMCV5299","article-title":"Breaking down silos between business continuity and cyber security","volume":"12","author":"phillips","year":"2019","journal-title":"Journal of Business Continuity & Emergency Planning"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/s12652-020-02775-5"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1049\/iet-cps.2018.5079"},{"key":"ref58","first-page":"1","article-title":"Cybersecurity management for (industrial) Internet of Things-challenges and opportunities","volume":"8","author":"maximilian","year":"2018","journal-title":"Journal of Information Technology & Software Engineering"},{"key":"ref53","year":"2021","journal-title":"Adquisition and Sustainment CMMC 2 0 Spreadsheet and Mapping"},{"key":"ref52","year":"2021","journal-title":"Adquisition and sustainment Cybersecurity Maturity Model Certification (CMMC) Model Overview Version 2 0"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CCWC47524.2020.9031206"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.3846\/cibmee.2021.611"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3442445"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.9770\/jesi.2017.4.4(12)"},{"key":"ref17","article-title":"Cybersecurity, our digital anchor","author":"fovino","year":"2020"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.techfore.2021.120872"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCNT.2018.8493977"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.30630\/joiv.4.4.482"},{"key":"ref51","year":"2020","journal-title":"NIST Special Publication 800–53 Revision 5 Security and Privacy Controls for Information Systems and Organizations"},{"key":"ref50","year":"2022","journal-title":"SP 800 Series 2021"},{"key":"ref46","year":"2022","journal-title":"MITRE ATT&CK ? Enterprise Mitigations"},{"key":"ref45","year":"2021","journal-title":"Center for Internet Security CIS Community Defense Model Version 2 0"},{"key":"ref48","year":"2018","journal-title":"Framework for Improving Critical Infrastructure Cybersecurity Version 1 1"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2014.2305658"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.23919\/ConTEL52528.2021.9495982"},{"key":"ref86","author":"zimmermann","year":"2000","journal-title":"Gestión del Cambio Organizacional Caminos y Herramientas"},{"key":"ref41","author":"shamma","year":"2018","journal-title":"Implementing CIS Critical Security Controls for Organizations on a Low-Budget"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-021-06400-0"},{"key":"ref44","article-title":"Understanding the top 10 OWASP vulnerabilities","author":"bach-nutman","year":"2020","journal-title":"arXiv 2012 09960"},{"key":"ref43","year":"2021","journal-title":"OWASP TOP 10 Project"},{"key":"ref87","year":"2021","journal-title":"A Guide to the Project Management Body of Knowledge PMBOK Guide"},{"key":"ref49","year":"2019","journal-title":"Ciberseguridad marco NIST Un abordaje integral de la ciberseguridad"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.04.004"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.3138\/9781487531249"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/ISSA.2014.6950492"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1108\/09685229910255223"},{"key":"ref3","author":"whitman","year":"2013","journal-title":"Management of Information Security"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.15439\/2014F38"},{"key":"ref5","author":"whitman","year":"2021","journal-title":"Principles of Information Security"},{"key":"ref82","author":"jiang","year":"2021","journal-title":"Cybersecurity Domain Map Ver 3 0"},{"key":"ref81","year":"2021","journal-title":"Mappings Cybersecurity Framework and Privacy Framework to Rev 5"},{"key":"ref40","year":"2021","journal-title":"CIS Security Controls Version 8"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2021.100361"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1002\/asi.24311"},{"key":"ref80","year":"2021","journal-title":"CIS Critical Security Controls V8 Mapping to NIST CSF"},{"key":"ref35","year":"2021","journal-title":"Adecuación al ENS y Seguimiento del Progreso"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2017.11.098"},{"key":"ref34","year":"2011","journal-title":"Guía de Seguridad CCN-STIC-806 Esquema Nacional de Seguridad Plan de Adecuación"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1111\/risa.12891"},{"key":"ref37","article-title":"MITRE ATT&CK ?: Design and philosophy","author":"blake","year":"2020"},{"key":"ref36","year":"2022","journal-title":"MITRE ATT&CK ? 2021"},{"key":"ref31","year":"2020","journal-title":"IMC_01—Metodología de Evaluación de Indicadores Para Mejora de la Ciberresiliencia (IMC)"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1007\/s10669-013-9484-z"},{"key":"ref30","article-title":"Ciber-resiliencia. Aproximación a un marco de medición","author":"su\u00e1rez","year":"2014"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1287\/deca.2020.0418"},{"key":"ref33","year":"2022","journal-title":"Guías Esquema Nacional de Seguridad 2022"},{"key":"ref77","article-title":"An effects-centric approach to assessing cybersecurity risk","author":"harry","year":"2019"},{"key":"ref32","first-page":"61715","article-title":"Real decreto 311\/2022, de 3 de mayo, por el que SE regula el esquema nacional de seguridad","volume":"106","author":"espa\u00f1a","year":"2020","journal-title":"Bolet&#x00ED n Oficial del Estado"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1007\/s10586-019-03034-9"},{"key":"ref2","author":"fennelly","year":"2016","journal-title":"Effective Physical Security"},{"key":"ref1","first-page":"17","article-title":"IT security review: Privacy, protection, access control, assurance and system security","volume":"2","author":"sattarova","year":"2007","journal-title":"Int J Multimedia Ubiquitous Eng"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/s10270-021-00898-7"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/RWS50334.2020.9241271"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1080\/19393550903551843"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.23919\/CISTI52073.2021.9476324"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.3390\/app8060898"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.24251\/HICSS.2020.524"},{"key":"ref24","year":"2019","journal-title":"ITIL Foundation ITIL 4 Edition Glossary"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1080\/19361610.2011.604021"},{"key":"ref23","article-title":"ITIL 4 essentials, second edition","author":"agutter","year":"2020"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2013.77"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/EDUCON.2010.5492480"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1063\/1.4912775"},{"key":"ref69","doi-asserted-by":"crossref","first-page":"83","DOI":"10.69554\/AMDY8757","article-title":"The practical application of ISO 22301","volume":"8","author":"zawada","year":"2014","journal-title":"Journal of Business Continuity & Emergency Planning"},{"key":"ref20","author":"mi\u00f1ana","year":"2021","journal-title":"?‘Qué es Capability Maturity Model Integration? (CMMI)"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3465481.3470038"},{"key":"ref63","first-page":"1","article-title":"Architecting a cybersecurity management framework","volume":"17","author":"tisdale","year":"2016","journal-title":"Issues in Inform Syst"},{"key":"ref22","year":"2022","journal-title":"CMMI Adoption & Transition Guidance 2021"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1108\/TG-11-2019-0112"},{"key":"ref21","article-title":"Changes in CMMI 2.0 and how they can affect TMMi","author":"balla","year":"2020"},{"key":"ref65","article-title":"Critical infrastructure protection. Sector-specific agencies need better measure cybersecurity progress","year":"2015","journal-title":"United States Government Accountability Office Tech Rep"},{"key":"ref28","year":"2014","journal-title":"UNE-ISO\/IEC 27001 Tecnología de la Información Técnicas de Seguridad Sistema de Gestión de Seguridad de la Información (SGSI) Requisitos"},{"key":"ref27","author":"gillingham","year":"2021","journal-title":"An Introduction To Information Security Management in ITIL"},{"key":"ref29","year":"2015","journal-title":"UNE-ISO\/IEC 27002 Tecnología de la Información Técnicas de Seguridad Código de Prácticas Para Los Controles de Seguridad de la Información"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2968045"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.3390\/jcp1020012"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2934221"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/9668973\/09955533.pdf?arnumber=9955533","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,8]],"date-time":"2024-10-08T22:57:54Z","timestamp":1728428274000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9955533\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"references-count":87,"URL":"https:\/\/doi.org\/10.1109\/access.2022.3223440","relation":{"has-preprint":[{"id-type":"doi","id":"10.36227\/techrxiv.20448597","asserted-by":"object"},{"id-type":"doi","id":"10.36227\/techrxiv.20448597.v1","asserted-by":"object"},{"id-type":"doi","id":"10.36227\/techrxiv.20448597.v2","asserted-by":"object"}]},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]}}}