Digitalization Capabilities for Sustainable Cyber Resilience: A Conceptual Framework

Abstract

Digital transformation is currently an essential condition for companies to operate in most markets, since it provides a whole new set of competitive skills and strategic tools. On the other hand, the same digitalization puts companies in the face of a whole new series of threats coming from the cyber space. The foundation of business sustainability, which is the maintenance of competitiveness while securing business, is no longer a “plus” feature or a captivating sentence but a true and consistent need for all organizations. This article provides a literature analysis on approaches and models for cyber resilience, digitalization capabilities, and a conceptual framework showing how digitalization capabilities drive cyber resilience. Digitalization capabilities are involved in the plan/prepare phase and in the adaptation phase of the cyber resilience process. In particular, online informational capabilities can drive both these phases. Other capabilities such as the employment of heterogeneous resources and the promotion of continuous learning drive the plan/prepare phase, while the scanning of the evolution of the digital environment and a timely reconfiguration of resources drive the adaptation phase.

1. Introduction

The concept of survival and business sustainability has assumed an increasingly relevant role in recent years for organizations. The key is to design an organizational system aimed at enhancing so-called organizational resilience [1]. Currently, firms are required to face competition in the market while ensuring the sustainability of their operations from economic, environmental, and social points of view. Ensuring the sustainability of the environment and society can no longer be an option alongside business strategy and competitiveness (i.e., the sustainability of business).

The latest research developments show that one of the most promising answers to these pressing needs lies in the multifaceted possibilities offered by the digitalization of business [2]. Indeed, the growing level of digitalization is dramatically impacting the strategy and operations of today’s organizations. It is evident how, in many sectors, digital interaction with customers is allowing organizations to provide a richer user experience [3].

Nevertheless, the complexity of the digitalized cyber environment causes cyber attacks to increase in frequency. Digitalization creates many opportunities but also a more complex cyber space, therefore making companies more exposed to cyber threats [4]. Hence, so-called cyber resilience, i.e., the ability of an organization to plan and prepare for, respond to, recover from, and adapt to a cyber attack, is growing in importance.

Cyber security management has become vital for organizations. Investments in cyber security and digitalization generate numerous advantages, but there is a tradeoff between the benefit deriving from these investments and their economic sustainability for companies [5]. In particular, small and medium-sized enterprises must consider how much and how to invest in these areas, considering their limited resources [6].

Digitalization capabilities are those organization capabilities that allow seizing numerous opportunities by combining digital assets and business resources, and by leveraging digital networks, to innovate products, services, and processes. These capabilities are considered important drivers of sustained competitive advantage through organizational learning, customer value creation, and innovation management [7].

To the best of our knowledge, there are very few contributions to the emerging topic of digitalization capabilities and their relationship with cyber resilience. This paper analyzes how digitalization capabilities drive cyber resilience. It provides a literature analysis on approaches and models for cyber resilience, digitalization capabilities, and the interactions between them. Finally, recent contributions on cyber resilience management [8] and digitalization capabilities [7] allowed us to formulate a conceptual framework. The framework clarifies the specific digitalization capabilities that concur to drive cyber resilience and in which phases.

This paper is structured as follows: the first section contains the introduction, the Section 2 summarizes approaches and models for cyber resilience, the Section 3 presents the research methodology, the Section 4 summarizes the literature on digitalization capabilities, the Section 5 contains the conceptual framework, and the sixth and last section contains the discussion and conclusions.

2. Approaches and Models for Cyber Resilience

In recent years, numerous studies have been proposed to guide organizations in being cyber resilient. The Cyber Resiliency Engineering Framework, proposed by [9] in the MITRE technical report, provides cyber resiliency goals, objectives, and practices. The cyber resiliency goals relate to adverse events and are Anticipate, Withstand, Recover, and Evolve. The last goal consists in changing missions/business functions and/or supporting cyber capabilities to minimize adverse impacts from actual or predicted adversary attacks.

A model for strategic and tactical resiliency against threats to ubiquitous systems (STRATUS) was developed by [10]. This model adopts an ontological point of view that takes into account different elements, which include, for instance, vulnerability and reliability levels for hardware and software resources and the role of physical and/or network proximity in determining levels of vulnerability.

Linkov et al. [11] designed a resilient matrix framework based on a four-stage life cycle model, divided into Plan/Prepare, Absorb, Recover, and Adapt phases. These phases are jointly considered in the matrix with the four domains of the Network-Centric Operations doctrine, which are: physical, information, cognitive, and social [12]. From the intersection of phases and domains, resilience metrics were derived and further considered into a second study authored by [13], who integrated and better detailed these metrics with quantitative and qualitative measures emerging from the literature.

Further, cyber resilience models have begun to increasingly take into account the dynamic nature of cyber threats, highlighting the relevance of preparation and recovery phases, for what concerns known and unknown threats as well. The framework developed by [14] goes exactly in this direction, showing how risk-based standards can move beyond risk assessment to create systems that are more resilient to dynamic threats. In this context, the ability of an organization to understand the surrounding environment and learn/absorb knowledge from it becomes an essential element of cyber resilience, with the aim of building specific capabilities to exploit opportunities and manage threats more effectively [15]. Therefore, it is becoming essential to build cyber resilience with the characteristics of dynamic capabilities in mind, fostering both a reactive and a proactive capacity.

Jensen et al. [16] outlines actions to undertake to realize cyber resilience for the efficient functioning of the maritime industry: informational campaigns directed at companies showing the cyber risks they face; pressure from customers who are made increasingly aware of the risk they face in cases the companies lack cyber defenses; and, finally, “cyber premiums” on insurance policies that reflect the degree to which companies adhere to voluntary guidelines.

Di Mase et al. [17], in their cyber physical systems security framework (CPSS), suggest ten areas that enable a complete analysis concerning the “health status” of cyber security systems. These areas include data and information security (to ensure information sharing and reporting), as well as physical security and control of physical accesses, anticounterfeit measures, forensics and prognostics analyses, and recovery plans. Similarly, the model detailed by [18] takes into account the quality and integrity of data, the need for physical and virtual control, and the importance of ensuring continuity through security and safety.

Objective, intention, approach, architecture, and scope are the five aspects of cyber resilience identified by [19]. According to them, the objective consists in ensuring business delivery, so they recommend keeping business goals intact, rather than IT systems, during adverse cyber events. The intention should be “safe-to-fail”, meaning that resilient systems should be designed to be able to fail in a controlled way, rather than being designed to solely protect against failure. The approach should “build security from within”, which means that resilience should be incorporated into organizations and IT systems, rather than added as separate functions or teams. The architecture should contain multilayered protection, meaning that a resilient architecture contains several layers, each capable of protection and recovery, rather than having a single layer of protection. Finally, the scope should be holistic and consider the entire network of organizations.

The Cyber Resilience Recovery Model (CRRM) was developed by [20] with the aim of contrasting zero-day malware attacks. To do so, the authors provide insights into the strengths and weaknesses of current recovery processes while presenting cyber security solutions that rely on, for instance, awareness training and isolation of “infected” machines.

Annarelli et al. [8], conducting a multiple case study analysis, proposes the managerial cyber resilience framework and the context-based managerial cyber resilience framework. The frameworks guide organizations in the implementation of the right managerial actions and investment to implement to enhance cyber resilience. According to the literature review on cyber resilience conducted by [21], the most important category is pre-event knowledge management, followed by security, velocity, ability, and adapt.

Annarelli et al. [22], through a qualitative study on the managerial practices for cyber resilience, shed light on the effectiveness and the way practices are implemented in the Italian context.

An ambidextrous approach to cyber security has been outlined by [23], adopting a balanced scorecard, multistage approach under a 7Ps stage-gate model (Patient, Persistent, Persevering, Proactive, Predictive, Preventive, and Preemptive) to enhance cyber resilience.

According to [24], measuring cyber resilience is in its infancy. Decisions on converting knowledge and intuition regarding the recovery and adaptation of cyber systems in response to threats into management decisions and policy will rely on a growing volume of increasingly diverse measurements.

A recent contribution is that of [25], who discuss the extent to which cyber physical systems contribute to the resilience of sociotechnical systems.

As clearly emerges from the analysis of cyber security literature, there is a lack of contributions investigating and highlighting the relationship between cyber resilience and digitalization capabilities. Nevertheless, elements and characteristics of digitalization capabilities can be retrieved in the above-cited contributions. Therefore, we performed a literature analysis, focusing on the stream of research of digitalization capabilities, to better understand if there is any evidence in academic production supporting this relationship.

3. Research Procedure

To investigate the relationship between digitalization capabilities and cyber resilience, we conducted a literature analysis.

We considered the digitalization capabilities reviewed by [7] and also included new pertinent contributions by replicating the search using the following search-string on Scopus: “(capabilit* OR abilit* OR capacit* OR process* OR routine*) AND (organization* OR firm* OR compan* OR enterprise*” and “digital*)”. To conduct the search, we opted for the Scopus online database because, compared to other sources, and as evidenced by [26], it is particularly good for works published after 1995, and it has a wide range of subjects and journals. For the definition of inclusion/exclusion criteria, we followed the recommendations and criteria already adopted by [7].

Among the digitalization capabilities identified (and summarized in Section 4), we considered those having a relationship with cyber resilience, then organized logically their interplay in a conceptual framework presented in Section 5.

4. Digitalization Capabilities

Companies need to develop capabilities oriented at managing digital ecosystem partnerships by the integration of their physical, financial, and information flows with their supply chain partners [27]; they also need to develop digital innovation capabilities for the process of searching for and redeeming capabilities in digital ecosystems [28].

Firms should also seize their own digitalization capabilities, considering the deployment of IT as drivers of digital competitiveness [29]. Rather than studying in detail their nature, other contributions studied how digitalization capabilities should be embraced by the employment of heterogeneous resources that enable digital solutions, looking at different stages of business processes [28,30].

Digitalization capabilities are of significant importance in information exchange and also digitalization capabilities to automate tasks [31,32]. It is important to reconfigure firms’ digital resources and routines. The timely reconfiguration of resources appears to be a key capability, especially for what concerns securing digital innovation efforts.

Wheeler. [33], moving from the concept of digital integration capabilities, conceptualized the dynamic capability of net enablement, which in turn allows processing and managing multiple and concurrent innovations at a given point in time. This is closely related to the work of [3], who formalized the importance of the scanning evolution of the digital environment in seeking opportunities for digital innovation. This is a key aspect, particularly for its link with improvisational capabilities, discussed in the same paper. According to the authors, “the malleability of digital technologies affords a higher degree of improvisation than their analog counterparts” (p. 65). The same topic and its relevance were studied more in detail by [34,35]. Improvisational capabilities can be defined as “the ability to spontaneously reconfigure existing resources to build new operational capabilities to address urgent, unpredictable, and novel environmental situations” [34]. Similarly, Ref [36] stressed the importance of adaptive capabilities in the context of digital marketing.

Finally, Ref [37] provided guidance on digital technology adoption in practice, helping scholars and managers to understand the potential impact of digital technologies on supply chains.

Among the digitalization capabilities reviewed by [7], those involved in the cyber resilience process considering the above-mentioned contributions are:

• Employing heterogeneous resources [30];
• Improvisational capabilities [34,35];
• Online informational capabilities [27,38];
• Promoting continuous learning [3];
• Scanning evolution of digital environment [3];
• Timely reconfiguration of resources [33].

These digitalization capabilities have been included in the conceptual framework described in detail in the next section.

5. Digitalization Capabilities and Cyber Resilience

According to [15], the combined use of dynamic capabilities, which include ordinary-defensive, dynamic-resilience, and extraordinary capabilities, leads to increasing levels of maturity in the area of computer (cyber) resilience. Recently, [23] recalled these aspects by highlighting the need for an adaptive process of dynamic intangible organizational assets, resources, and capabilities across a performance frontier to enhance cyber resilience.

To contribute theoretically and practically in this research direction, we want to analytically show that each digitalization capability drives cyber resilience consequences.

Considering the identified digitalization capabilities [7,30,34,38] and the cyber resilience phases by [11] lately organized in managerial practices in the managerial cyber resilience framework proposed by [8], we found an interesting common ground between digitalization capabilities and cyber resilience practices.

Among all the approaches and models for cyber resilience summarized in Section 2, we chose the managerial cyber resilience framework for its focus on managerial practices. Moreover, it recalls concepts, such as planning and preparing through competencies, adaptation to the context, and learning by the experience, typical of digitalization capabilities.

In

Table 1. Digitalization capabilities driving cyber resilience.

Digitalization Capabilities		Cyber Resilience Practice	Cyber Resilience Phase
Employing heterogeneous resources	Employing heterogeneous distributed resources to use digital solutions to different extents and in different stages of the business processes. There can be a distinction between digital capabilities to exchange and process information and digital capabilities to automate tasks [30]	Prevention; Training	Plan/Prepare
Improvisational capabilities	Ability to spontaneously reconfigure existing resources to build new operational capabilities to address urgent, unpredictable, and novel environmental situations, through IT-enabled capability, i.e., the effective use of digital IT systems [34]	Update	Adapt
	Capabilities that enable spontaneous change, are best suited for extremely turbulent environments, characterized by sudden changes in demand and unexpected technological breakthroughs [35]
Online informational capabilities	The ability of a firm to exchange strategic and tactical information through the integration of IT resources and processes [27,38]	Prevention; Review	Plan/Prepare; Adapt
Promoting continuous learning	Firms should promote continuous learning of the unique properties of digital technologies, by acquiring new skills both internally and externally while establishing new digital roles [3]	Training	Plan/Prepare
Scanning evolution of digital environment	To identify opportunities, firms need to scan their digital environment to foresee and understand key changes [3]	Context	Adapt
Timely reconfiguration of resources	Net enablement capability as a dynamic capability to turn timely the business innovations enabled by digital networks into customer value [33]	Context	Adapt

, each digitalization capability is presented with its definition, together with the cyber resilience phase and practice it belongs to.

Employing heterogeneous resources means employing heterogeneous distributed resources to use digital solutions to different extents and in different stages of business processes [32,39]. For instance, the digital capabilities needed to exchange and process information and those used to automate tasks can be very different [30]. The plan/prepare phase, and in particular the prevention and training category, best matches this capability. In fact, investments in heterogeneous human resources and activities of recruiting and retention are essential, and it has been highlighted that a key security challenge for organizations is the lack of communication, collaboration, and sharing between IT teams and teams belonging to other functions [40].

Improvisational capabilities, i.e., the ability to spontaneously reconfigure existing resources to build new operational capabilities to address urgent, unpredictable, and novel environmental situations [34], suited for extremely turbulent environments [35], is included in the phase called Adapt. In this case, the adaptation relates to the Update practice since, even if automatically, it implies the reconfiguration/updating of the digital environment and related cyber security actions.

The literature shows that improvisation is inevitable during crises. In some cases, employees will not have built up a routine for the situation before them, or their routine simply does not work [41].

Online informational capabilities, which, according to [38], consists in the ability of a firm to exchange strategic and tactical information through the integration of IT resources and processes, can contribute to the practices called Prevention and Review, respectively, included in the Plan/Prepare and Adapt phases. In fact, it is essential to organize data protection for instance by the use of cryptography and to review the effectiveness of the secure transferring of knowledge, especially if it is tacit, nonproprietary, and technological [42].

The digitalization capability named Scanning evolution of digital environment, which, according to [3], consists in the ability to identify opportunities, since firms need to scan their digital environment to foresee and understand key changes, is significantly important in the Adapt phase and in particular in the adaptation to the Context. The digital environment can imply new competitive opportunities but also new threats and vulnerabilities. It is therefore essential to evaluate this tradeoff between smartness and resilience and smartness and economic sustainability, since the same investments and level of digitalization can be sustainable and reasonable for a particular organization but not for another [43].

Timely reconfiguration of resources, i.e., the net enablement capability as a dynamic capability to timely transform the business innovations enabled by digital networks into customer value [33], similarly to the previous phase, consists in the Adapt phase and in particular the adaptation to the Context. Being aware of the cyber security consequences of this enablement is vital. The key is building cyber security into the business value chain and enabling new technological operating platforms that combine many innovations [4].

As emerges from the definitions provided in Table 1, digitalization capabilities are not totally mutually exclusive or totally mutually inclusive and present similar traits, e.g., improvisational capabilities with employing heterogeneous resources and/or online informational capabilities. This suggests the existence of potential synergies among the simultaneous adoption and development of more capabilities at once.

In Figure 1, the digitalization capabilities driving the Cyber Resilience Framework are provided.

In this framework, digitalization capabilities are reported according to the phase in which we recognized they are involved according to the literature.

In fact, employing heterogeneous resources and promoting continuous learning have been recognized as drivers in the Plan/Prepare phase, online informational capabilities has been associated with both the Plan/Prepare and Adapt phases, while scanning the evolution of digital environment and timely reconfiguration of resources relate to the Adapt phase.

The practices recognized are also specified in correspondence with each capability: from the practice of prevention and training in which the employing of heterogeneous resources plays a crucial role, to that of the adaptations to the context for which the timely reconfiguration of resources is essential.

6. Discussion and Conclusions

According to what was reported in the previous section, we conceptualize the following insights:

• Employing heterogeneous resources is a driver of prevention and training practices that belongs to the plan/prepare phase of the managerial cyber resilience process.
• Promoting continuous learning is a driver of the practice of training, belonging to the plan/prepare phase of the managerial cyber resilience process.
• Online informational capabilities are drivers of prevention and review practices, respectively belonging to the Plan/Prepare and Adapt phases of the managerial cyber resilience process.
• Improvisational capabilities are drivers of the Update practice, which belongs to the Adapt phase of the managerial cyber resilience process.
• Scanning the evolution of the digital environment and Timely reconfiguration of resources are drivers of the adaptation to the context that belongs to the Adapt phase of the managerial cyber resilience process.

These insights might be confirmed empirically through future studies of quantitative and qualitative nature.

Moreover, we can state that the study of digitalization capabilities should not be limited to competitiveness and strategic insights but rather encompass a much larger perspective to fully understand their potential. As a matter of fact, digitalization capabilities inherit several characteristics from organizational and dynamic capabilities, considering that they allow sensing and seizing opportunities and threats while allowing a reconfiguration of resources and routines in the context of digital transformation [7,44]. On the other hand, the vast universe of digitalization is causing companies to constantly face more serious threats in the cyber world, hence the importance, in the last years, of the concept of cyber resilience. Maintaining competitiveness while at the same time ensuring safety and security is no longer an option, a feature for highly competitive markets, nor a “catchphrase”. Through this work, our aim was to show that there is a strong link between these needs and that digitalization capabilities might be the answer for both scholars and practitioners. Maintaining a set of heterogeneous and diversified resources, while being able to reconfigure the allocation of said resources when needed, can be both a key strategic and a resilient move. What might change is the purpose and way of employment, but the maintenance and timely exploitation of these resources rely on the same set of capabilities, therefore being an invariant. The same thinking can be replicated for improvisational capabilities, the promotion of continuous learning, and all the other capabilities detailed in the previous sections, which can foster cyber resilience and business strategies at the same time. Furthermore, this study only considered this benefit as acting in one way, but a deeper study of cyber resilience practices might uncover a new set of digitalization capabilities as well. There is a clear and strong need for practitioners and researchers to focus more on the multibeneficial relationship between digitalization capabilities and cyber resilience, since this might represent a key turning point in mastering once and for all the digital transformation of business.