Cybersecurity as an Integrated Subset of the Information Security System: the Systemic-Conjunctional Model of Information Security (SCMIS)

Introduction

Information protection did not begin with computers. Sensitive documents, communications, and knowledge already required control mechanisms long before the formation of current digital networks. The expansion of Information and Communication Technologies (ICT), however, changed the scale of the problem. Information began to be processed, stored, and transmitted by interconnected systems, expanding both the possibilities of use and the points of exposure to risks and threats. For organizations and states, protecting informational assets has become a task distributed among people, processes, physical structures, and technological resources.

This transformation gained greater relevance with the consolidation of the Information Age, particularly from the development and diffusion of computers throughout the 20th century. The increasing use of computerized systems to store, process, and transmit data caused the emergence of new risks, threats, and vulnerabilities, driving the development of specialized areas of protection. In this context, concepts such as computer security, network security, digital security, and, later, cybersecurity became part of the technical, scientific, and institutional vocabulary.

The progressive specialization of these areas has produced, in certain academic and organizational contexts, an apparent conceptual fragmentation. Cybersecurity has sometimes been presented as an autonomous field, dissociated from information security. This interpretation raises a problem of an epistemological and systemic nature: does cybersecurity constitute an independent system, or does it represent a specialized subsystem belonging to the more comprehensive information security system?

The delimitation between information security and cybersecurity remains the subject of discussion in the specialized literature. Von Solms and Van Niekerk (2013) observe that the growing dependence on cyberspace has broadened the traditional scope of concerns related to information security, contributing to the consolidation of cybersecurity as a specific field of action. This evolution, however, does not necessarily eliminate the existing conceptual relationships between the two domains. On the contrary, the emergence of new threats and technological environments can be interpreted as a process of differentiation and specialization of the mechanisms intended to protect informational assets.

This study starts from the premise that information security, regardless of the technology or medium used, constitutes a comprehensive system for protecting information. Its central object is not exclusively the computer, the network, or cyberspace, but information itself as an asset with value for individuals, organizations, and states.

The protection mechanisms must fundamentally seek to preserve the confidentiality, integrity, and availability of information, without prejudice to complementary properties such as authenticity, traceability, accountability, and non-repudiation. From this perspective, information security has a systemic and multidimensional nature, encompassing different protection domains related to the physical, human, documentary, organizational, and technological means in which information is produced, stored, processed, or transmitted.

Cybersecurity, in turn, focuses predominantly on the protection of assets, processes, and interactions within the cyber environment. Its specificity therefore stems from the operational domain in which risks and threats manifest themselves, and not from the existence of an object fundamentally distinct from that protected by information security.

To examine this relationship, this article adopts a qualitative approach, of a basic nature and exploratory-explanatory purpose, structured as theoretical-conceptual research. The study employs bibliographic and documentary methods, based on the analysis of specialized scientific literature and international technical standards related to information security and cybersecurity. The research seeks to identify the definitions, the objects of protection, the structuring principles, and the conceptual limits attributed to each domain.

The methodological path is developed in four stages. Initially, a structured narrative review of the literature is carried out, aimed at reconstructing the historical and conceptual evolution of information security and cybersecurity. To provide greater transparency to the source selection process, the bibliographic search was guided by explicit inclusion and exclusion criteria. The review is not systematic in nature and does not intend to exhaust the scientific production on the fields analyzed. Its function is theoretical-conceptual, oriented towards identifying definitions, objects of protection, and relationships between the examined domains.

The inclusion criteria prioritized peer-reviewed articles, scientific reference books, institutional documents, and technical standards directly related to the conceptual delimitation of the analyzed fields. Documents without identifiable authorship, merely opinionated texts, and publications that use the concepts of information security or cybersecurity without presenting a definition or theoretical foundation were excluded.

In the second stage, a documentary analysis of international technical standards and references is carried out, with special attention to the ISO/IEC 27000 family of standards and normative documents that establish concepts related to information security, risk management, and cybersecurity.

In the third stage, a comparative conceptual analysis is employed, organized from previously defined categories: object of protection, application environment, security principles, nature of threats, protected assets, and governance mechanisms. The definitions identified in the literature and normative documents were classified according to these categories, allowing us to verify the points of convergence, overlap, and specialization between information security and cybersecurity.

In the fourth stage, the results of the analysis were interpreted through a systemic and logical-conjunctistic approach, using Set Theory as a heuristic instrument for representing conceptual relationships. It is emphasized that Set Theory is not used as a mechanism for mathematically demonstrating the normative structure of information security, but as a logical-formal model intended to represent relationships of inclusion, intersection, and belonging between conceptual domains.

Considering the analytical categories adopted, the study tests the hypothesis that cybersecurity constitutes a specialized domain of the Information Security System, distinguished by the centrality of cyberspace as an environment of risk and action.

This hypothesis is examined through the relationships of belonging, functional autonomy, and interdependence between protection domains.

The contribution of this study is the formulation of SCMIS, a theoretical-explanatory architecture that represents the functional inclusion of cybersecurity and the interactions between specialized protection domains.

2. Evolution Of Information Security Systems

The history of security mechanisms demonstrates that the need to protect information accompanies the very evolution of political, military, and organizational structures. Anderson (2020) highlights that contemporary security problems have historical antecedents related to the protection of communications, secrets, and control mechanisms, demonstrating that security did not originate with computer systems. From this perspective, digitization has altered the means, scale, and speed of threats, but it did not create the fundamental object of protection: information and the processes associated with its use.

For centuries, states, military organizations, religious institutions, and economic structures have developed mechanisms designed to preserve knowledge, documents, and communications considered sensitive. The use of codes, ciphers, physical access controls, compartmentalization of knowledge, and document classification demonstrate that the need to protect information did not arise with cyberspace. What has changed over time are the media used to record, process, and transmit information and, consequently, the risks and mechanisms employed to protect it. Digitization did not replace the protected object: it expanded the risk environments and demanded specialized mechanisms to preserve information in new media and flows.

2.1 From secrecy protection to computer system security

Internationally, the systematic protection of information was initially associated with the concepts of secrecy, intelligence, cryptography, and communications security.

The scientific evolution of information theory and cryptography, especially from the first half of the 20th century, contributed to modifying this perspective. Shannon's studies (1948) established mathematical bases for understanding information as a quantity capable of transmission, processing, and measurement. Subsequently, he examined secrecy systems from a mathematical perspective, contributing to the consolidation of cryptography as a scientific field related to information protection.

The spread of computers in the 1950s and 1960s introduced a structural transformation. Information previously stored predominantly on physical media began to be processed by computer systems.

The concentration of large volumes of data in electronic environments has produced new vulnerabilities related to logical access, the sharing of computational resources, and the simultaneous use of systems by different users.

The concept of computer security emerged, initially focused on protecting computers and the information processed on them. The so-called Ware Report, produced in the context of the Defense Science Board Task Force on Computer Security, became a historical reference by systematizing problems related to the security of multi-user computer systems and proposing technical, physical, administrative, and procedural controls (WARE, 1970).

Even in the early stages of computer security, protection was not conceived exclusively as a technological issue. The problem simultaneously involved equipment, procedures, people, administrative controls, and the physical environment. The security of computer systems, therefore, emerged linked to a more comprehensive protection system.

The very terminological evolution observed in the references of the National Institute of Standards and Technology (NIST) demonstrates this progressive conceptual expansion. Computer security is defined as the set of measures and controls designed to ensure the confidentiality, integrity, and availability of information processed and stored by computers. In turn, information security has a broader scope, encompassing the protection of information and information systems against unauthorized access, use, disclosure, interruption, modification, or destruction (NIST, 2013).

Thus, a first systemic expansion is observed: protection ceases to be focused exclusively on the secrecy of the message and begins to consider the set of conditions necessary for the preservation of information. Confidentiality remains relevant, but is complemented by integrity and availability, forming the triad later consolidated as one of the conceptual foundations of information security.

2.2 The Consolidation of Information Security as a Management System

The expansion of computer networks, the spread of the internet, and the growing organizational dependence on digital systems, especially from the 1980s and 1990s onwards, significantly broadened the field of security.

Information began to circulate between systems, organizations, and territories, making an approach exclusively focused on the isolated protection of computer equipment insufficient.

In this context, the concept of information security was progressively consolidated, shifting its focus from equipment to information as an organizational asset. This transformation represents a relevant epistemological change: the computer is now understood as one of the environments in which information exists and is processed, but not as the sole object of protection.

The institutionalization of this perspective can be observed in the evolution of international security management standards. The ISO/IEC 27000 family consolidated a systemic approach based on risk management and the implementation of an Information Security Management System (ISMS).

The International Organization for Standardization (ISO) established, through ISO/IEC 27001, requirements for management systems aimed at preserving the confidentiality, integrity, and availability of information through risk management processes (ISO/IEC, 2022).

The relevance of this concept lies in the fact that information security is not limited to technological controls. The ISO/IEC 27001 approach itself encompasses people, processes, and technologies, reaching the organization as a whole and moving away from an interpretation exclusively linked to the information technology area.

In this context, the Information Security System can be understood as an integrated organizational structure, formed by policies, processes, human resources, technologies, physical controls, and governance mechanisms oriented towards the protection of informational assets. Thus, it is concluded that technological controls constitute components of this system, without exhausting its scope.

The evolution of the field can be understood, in this sense, as a cumulative movement, in which the transformation of informational environments stimulates new specializations without necessarily eliminating the mechanisms developed in previous stages.

2.3 The Emergence of Cyberspace and the Specialization of Cybersecurity

The global expansion of the internet, the interconnection of digital infrastructures, and the development of distributed systems have produced a new environment for interaction. Cyberspace has ceased to represent merely a network of computers and has become a complex domain in which individuals, organizations, companies, and states develop social, economic, political, military, and strategic activities.

Digital transformation has simultaneously expanded the possibilities for the use of information and the surfaces of exposure to threats. Cloud computing, smart devices, artificial intelligence, and the Internet of Things have become part of the contemporary informational environment, requiring the expansion of methods and instruments aimed at the security of the new digital domains (ALAM, 2022).

In this context, the concept of cybersecurity developed and gained functional autonomy. It came to concentrate knowledge, processes, and technologies related to threats originating from cyberspace. However, its historical emergence did not mean the disappearance or replacement of information security.

The very evolution of technical frameworks demonstrates the existence of continuity between the concepts. In the NIST glossary, information security remains defined in terms of protecting information and information systems and preserving confidentiality, integrity, and availability. Computer security, in turn, has historically been related to measures to protect information processed by computers, with its terminology progressively related to the domain of cybersecurity.

The observed evolution is cumulative: new informational environments introduce specific risks and induce security specializations without extinguishing previous mechanisms.

Baskerville's (1993) analysis of the evolution of information systems security methods supports this interpretation, relating security transformations to methodological and organizational changes that occurred in the development of the systems themselves.

From this perspective, cybersecurity can be examined as the result of a process of functional differentiation associated with the expansion of cyberspace, without this specialization itself determining the disappearance or loss of relevance of information security.

2.4 The evolution of information security in Brazil

The institutionalization Information security action has accompanied the computerization process of Public Administration and the growing integration of the country into global digital networks.

Initially, state concerns were associated with the protection of classified documents, government communications, and information related to the security and defense of the State.

However, the increased use of computerized systems by Public Administration made it necessary to formulate specific policies for the protection of information in a technological environment. A relevant milestone in this process was Decree nº 3.505, of June 13, 2000, which established the Information Security Policy in the bodies and entities of the Federal Public Administration. This normative instrument represented an advance in the institutional organization of information security by recognizing the need for coordination of actions aimed at protecting the information systems and assets of the Brazilian State.

The evolution of Brazilian regulations demonstrates that the concept of information security has progressively acquired greater scope. Decree nº 9.637, of December 26, 2018, established the National Information Security Policy (PNSI) and structured a perspective that integrated cybersecurity, cyber defense, physical security, and organizational data protection within the broader field of information security.

This normative framework is relevant to the hypothesis developed in this article, as it demonstrates that, in the Brazilian institutional order, cybersecurity has historically been treated in relation to a more comprehensive information security architecture.

In 2020, Decree nº 10.222 approved the first National Cybersecurity Strategy (E-Ciber), which established government guidelines aimed at Brazilian society, consolidating cybersecurity as a specific strategic area of ​​state action.

The creation of a specific strategy for the cyber environment did not, however, mean the extinction of the field of information security. On the contrary, it evidences a process of institutional specialization. The increasing complexity of threats originating from cyberspace has required the creation of specific policies, structures, and mechanisms, without eliminating the need to protect information existing in other environments.

This trajectory reached a new stage in 2025 with Decree nº 12.572, of August 4, 2025, which established a new National Information Security Policy and established governance of information security within the scope of the Federal Public Administration. The new framework revoked Decree nº 9.637/2018 and updated the Brazilian architecture in the face of the growing sophistication of threats and accelerated digital transformation.

At the same time, Decree nº 12.573, also of August 4, 2025, established the second National Cybersecurity Strategy (E-Ciber), structuring its own axes of protection and governance of the cyber environment and representing an evolution in relation to the first E-Ciber, of 2020.

The joint analysis of the two normative instruments allows us to identify a relevant institutional distinction. On the one hand, the Brazilian State maintains a National Information Security Policy, of a comprehensive nature; on the other hand, it establishes a National Cybersecurity Strategy, specifically oriented towards the cyber domain. This normative differentiation constitutes a relevant indication of the relationship between the set and the specialization proposed in this study.

The recent evolution of Brazilian governance further reinforces this systemic perspective. In 2026, government discussions related to the new strategic architecture began to consider a National Information Security Strategy and an Integrated Information Security System, with the articulation of policies, plans and governance structures.

The historical evolution examined shows a cumulative process of functional differentiation of information protection mechanisms. Both internationally and within the Brazilian regulatory framework, the increasing complexity of digital environments has fostered the specialization of cybersecurity without eliminating comprehensive information security systems. This difference in scope and domain will be examined in the following section through a comparison of selected normative and conceptual frameworks.

3. Conceptual Delimitation Between Information Security And Cybersecurity

The expansion of cyberspace and the growth of threats associated with digital technologies have contributed to the increasing use of the term cybersecurity in academic, governmental, and business environments. However, the dissemination of the concept has not been accompanied by complete terminological standardization. In certain references, information security and cybersecurity are used as closely related or partially overlapping expressions; in others, cybersecurity is defined by the protection of cyberspace, digital infrastructures, and the assets within it.

The distinction between the two concepts has been directly examined by the scientific literature. Taherdoost (2022) argues that information security focuses on protecting information against threats, regardless of the form or medium in which it is found, while cybersecurity is predominantly related to the protection of cyberspace and the assets within the cyber environment. In a complementary manner, von Solms and Van Niekerk (2013) identify the expansion of traditional security concerns in the face of increasing dependence on cyberspace. These approaches highlight a conceptual asymmetry between the fields: information security tends to be delimited by the protected object, while cybersecurity is strongly delimited by the domain in which risks, threats, and interactions manifest themselves. This asymmetry constitutes one of the analytical foundations of the hypothesis developed in this study.

This conceptual diversity constitutes a relevant problem for the systemic organization of the field of security. If the two concepts are considered equivalent, the simultaneous use of the expressions becomes partially redundant. On the other hand, if they represent completely independent fields, it becomes necessary to identify fundamentally distinct objects of protection. Between these two interpretations lies a third possibility: cybersecurity constitutes a specialized domain of protection, integrated into the more comprehensive information security system.

To examine this hypothesis, a comparative normative analysis of frameworks produced by the International Organization for Standardization and the International Electrotechnical Commission (ISO/IEC), the National Institute of Standards and Technology (NIST), and the Brazilian State is carried out. The comparison considers six analytical categories: central object of protection, application domain, security principles, nature of risks, scope of controls, and level of governance.

For the purposes of terminological precision, this study distinguishes between Information Security (IS) and Information Security System (ISS). The acronym IS designates the conceptual and functional field related to information protection, as used in the literature and in the normative frameworks analyzed. The acronym ISS designates the systemic architecture proposed in this study, understood as the organized totality of domains, mechanisms, processes, controls, and relationships functionally oriented towards information protection. Consequently, the conceptual comparison is established between IS and CS, while the inclusion relationship formulated by SCMIS is expressed by CS ⊂ ISS.

3.1 Information Security in the ISO/IEC 27000 Family

The ISO/IEC 27000 family is one of the main international benchmarks for information security management. It presents the fundamental concepts and principles related to Information Security Management Systems (ISMS), in addition to establishing common terminology for the standards that make up this family (ISO/IEC, 2018).

The conceptual architecture adopted by the ISO/IEC 27000 family gives centrality to information and the management of risks related to its protection. ISO/IEC 27001 establishes requirements for the implementation, maintenance, and continuous improvement of an Information Security Management System. Its applicability reaches organizations of different natures and sizes, demonstrating that information security is conceived as an organizational management problem and not exclusively as a technological issue (ISO/IEC, 2022).

The understanding of information security as an organizational phenomenon is supported by the scientific literature. Dhillon and Backhouse (2000) argue that information systems security management should go beyond predominantly technical approaches and consider the social and organizational dimensions related to information use. Similarly, Siponen and Willison (2009) highlight the need to critically examine information security management standards and their relationship to the organizational contexts in which they are applied. These studies reinforce the understanding of information security as a multidimensional problem of management, governance, and protection.

This characteristic is relevant to the present investigation insofar as an ISMS is not limited to the protection of computer networks or systems. Its structure involves policies, processes, responsibilities, people, technologies, and risk management mechanisms. The objective is to preserve the security properties of information through the application of a systematic management process.

Information can exist in different media and environments, and may be recorded in physical documents, stored in digital systems, transmitted through communication networks, incorporated into the knowledge of individuals, or integrated into organizational processes. Consequently, the system intended for its protection needs to have a scope compatible with this diversity.

From this perspective, information security presents a cross-cutting object of protection. The technological domain constitutes one of the dimensions in which information must be protected, but it does not represent the totality of the system.

This multidimensional nature is also identified in studies on human and organizational factors of security. Kraemer, Carayon, and Clem (2009) demonstrate that vulnerabilities can emerge from interactions between individuals, organizational structures, and technological systems.

Information security should therefore be analyzed because of the relationships established between different components, and not merely as an isolated property of a particular technological resource. This interpretation is compatible with the systemic approach adopted in this study.

3.2 Cybersecurity according to ISO/IEC 27032

The analysis of ISO/IEC 27032 allows for a more specific delimitation of the cyber domain. The standard was developed to provide guidance related to cybersecurity, considering the characteristics of cyberspace and the existing dependency relationships between different security areas.

A conceptually relevant aspect is that ISO/IEC 27032:2012 expressly recognizes the dependencies of cybersecurity on other security domains, particularly information security, network security, internet security, and the protection of critical information infrastructures (ISO/IEC, 2012).

Although superseded by the 2023 edition, ISO/IEC 27032:2012 is examined in this study as a historical-conceptual document, as it explicitly outlines dependency relationships between cybersecurity and other security domains. The 2023 edition is used as the current technical reference for analyzing the relationships between cybersecurity, Internet security, web security, and network security.

This formulation weakens the interpretation of cybersecurity as an isolated system. It recognizes the dependency relationships with pre-existing security domains, and its normative framework highlights an architecture characterized by interdependence.

It is emphasized that the specificity of cybersecurity stems mainly from the environment in which the analyzed phenomena manifest themselves: cyberspace. In it, different actors interact through systems, networks, applications, services, and digital infrastructures. The absence of a single authority over the entirety of this space and the existence of multiple stakeholders increase the complexity of governance and protection.

Thus, while information security is primarily organized around the protected object, information, cybersecurity presents a strong delimitation related to the domain of action, cyberspace.

This difference allows us to synthesize the following conceptual distinction:

SI: is linked to the protection of information regardless of the environment or medium in which it is found; and

SC: is predominantly focused on the protection of activities, assets, and interactions within the cyber domain.

The distinction between object and domain constitutes one of the foundations of the hypothesis developed in this article. The existence of a specialized operating environment does not necessarily imply the constitution of a superior or completely independent system. On the contrary, it may represent the specialization of protection functions in the face of the characteristics of a given environment.

3.3 The NIST Perspective

Analyzing the National Institute of Standards and Technology's frameworks offers a second perspective for conceptual delimitation.

The very concept of an information system employed by NIST encompasses an organized set of informational resources intended for the collection, processing, maintenance, use, sharing, dissemination, or disposal of information. This definition can encompass specialized systems, including industrial control systems and other specific technological environments.

Cybersecurity, in turn, appears in NIST frameworks associated with the ability to protect or defend the use of cyberspace against cyberattacks. The conceptual centrality, therefore, shifts to the cyber environment and the risks related to actions developed in this domain.

This differentiation can be summarized as follows:

Information Security: focused on the protection of information and information systems; and

Cybersecurity: specialized protection in cyberspace, particularly against cyber threats and attacks.

This distinction does not eliminate areas of overlap, insofar as a cyberattack can compromise the confidentiality, integrity, or availability of information. Similarly, an information security vulnerability can be exploited through an action conducted in cyberspace.

Consequently:

SC ∩ SI ≠ ∅

However, the mere existence of an intersection is not sufficient to define the nature of the relationship. To determine whether there is only overlap or effective conceptual inclusion, it becomes necessary to analyze the scope of the respective objects of protection.

Information security extends to information existing outside of cyberspace. For example, a classified printed document, sensitive verbal information, or strategic knowledge stored exclusively in an individual's memory constitute informational assets that can be protected, although they are not necessarily embedded in a cyber environment.

Conversely, the main assets protected by cybersecurity—data, systems, networks, applications, and digital infrastructures—are linked to the production, processing, storage, or transmission of information.

This asymmetry in scope constitutes a central element of the proposed systemic relationship.

3.4 The Brazilian normative architecture

The evolution of Brazilian regulations offers a particularly relevant field for the analysis of the relationship between information security and cybersecurity.

Decree nº 12.572, of August 4, 2025, established the National Information Security Policy (PNSI) and established the governance of information security within the scope of the Federal Public Administration (BRAZIL, 2025a).

The policy presents information security from a comprehensive perspective and establishes objectives related to data protection, the security of information held by the public authorities, and the proper management and protection of sensitive knowledge and information subject to access restrictions.

On the same day, Decree nº 12.573, of August 4, 2025, established the National Cybersecurity Strategy (BRAZIL, 2025b).

The coexistence of the two instruments presents relevant conceptual significance. The Brazilian State did not replace the National Information Security Policy with an exclusively cybersecurity policy. On the contrary, it maintained a comprehensive information security policy and, in parallel, established a strategy specifically aimed at the domain of cybersecurity.

In systemic terms, two levels of organization are observed:

A comprehensive systemic level, materialized by the National Information Security Policy; and

A specialized strategic level, represented by the National Cybersecurity Strategy.

This institutional differentiation constitutes normative evidence favourable to the existence of distinct levels of scope. The PNSI establishes an architecture related to information security and its governance. The E-Ciber, in turn, directs specific efforts towards strengthening national cybersecurity, the resilience of organizations, the protection of the cyber environment, and the articulation between different actors.

Therefore, these are not necessarily competing structures, insofar as normative analysis allows them to be interpreted as complementary instruments, endowed with different scopes and purposes.

The very evolution of Brazilian institutions reinforces this perspective. In 2026, within the scope of the Information Security Management Committee, discussions were presented regarding a new strategic architecture and an Integrated Information Security System, in line with the PNSI established in 2025.

3.5 The Systemic Inclusion Relationship

Based on comparative normative analysis, it is proposed to distinguish three possible theoretical relationships between information security and cybersecurity.

The first hypothesis would be conceptual equivalence:

SC = IS

This hypothesis would imply considering the two concepts synonymous. However, the existence of protected information outside the cyber environment demonstrates that the field of information security has a greater scope than the exclusively digital domain.

The second hypothesis would be conceptual independence:

SC ∩ IS = ∅

This possibility also finds no support. The analyzed references demonstrate a wide overlap between the principles, assets, controls, and risks addressed by the two fields.

A third possibility remains: although cybersecurity and information security constitute distinguishable concepts in terms of scope and predominant domain of action, the protection functions developed in the cyber field can be understood as integral parts of a more comprehensive systemic architecture for information protection.

This possibility requires distinguishing Information Security (IS), as a conceptual field of information protection, from the Information Security System (ISS), understood in this study as the organized totality of domains, mechanisms, processes, and controls functionally oriented towards information protection.

Based on this distinction, the following relationship is proposed:

CS ⊂ ISS

For the purposes of the logical-set representation adopted in this study, the symbol ⊂ indicates a proper subset relationship.

The proposed inclusion relationship is based on the difference in conceptual scope identified in the literature. Taherdoost (2022) distinguishes information security and cybersecurity based on their respective protection focuses, while von Solms and Van Niekerk (2013) demonstrate that the emergence of cybersecurity stems from the expansion of security concerns in the face of increasing dependence on cyberspace. However, these studies do not formalize the relationship between the fields through an explicit system and subsystem architecture.

The Systemic-Conjunctural Model of Information Security (SCMIS) seeks to fill this gap by interpreting the specialization of cybersecurity according to the criterion of the predominant domain of action, preserving information and informational assets as elements of systemic convergence.

Formally:

∀x (x ∈ SC → x ∈ SSI)

The expression means that, for every element x, if that element belongs to the domain of cybersecurity, then it has a functional relationship with the information protection system.

The proposition does not mean that all information security activities are cybersecurity:

∃y (y ∈ SSI ∧ y ∉ SC)

There are elements belonging to the Information Security System that do not belong to the domain of cybersecurity. The physical protection of a non-digital document archive, the compartmentalization of sensitive verbal information, and certain personnel security procedures are examples of this relationship.

Consequently:

SC ⊂ SSI

Cybersecurity can be represented as a proper subset of the Information Security System.

3.6 The theoretical proposition

Based on the triangulation between the ISO/IEC, NIST and Brazilian normative architecture frameworks, the first theoretical proposition of this study is formulated:

P1: Cybersecurity constitutes a proper, specialized and integrated subset of the Information Security System, delimited by the cyber domain and intended for the protection of the assets, processes and informational interactions within it.

P1 differs from predominantly descriptive approaches by establishing an explicit ontological relationship between the two fields. While previous literature identifies differences in scope, object, or environment between information security and cybersecurity (VON SOLMS; VAN NIEKERK, 2013; CRAIGEN; DIAKUN-THIBAULT; PURSE, 2014; TAHERDOOST, 2022), the SCMIS proposes interpreting these differences through a systemic relationship of inclusion and functional specialization.

The theoretical contribution, therefore, lies not only in stating that the concepts are distinct, but in proposing a relational architecture designed to explain the nature of this distinction.

The proposition finds support in the difference in scope observed between the fields. Information security accompanies the informational asset in different media and environments, while the cybersecurity frameworks examined focus on the particularities of cyberspace.

The Brazilian normative architecture adds an institutional element to this distinction by maintaining comprehensive information security instruments alongside a strategy specifically oriented towards cybersecurity. The evidence is not identical in nature, but it converges on a functional differentiation between a broader field of protection and a specialized domain.

In taken together, the analyzed frameworks support a functional differentiation: the technical and operational autonomy of cybersecurity is compatible with its integration into the broader information protection system.

This functional autonomy, therefore, does not equate to systemic independence, a premise that underlies SCMIS.

This relationship forms the basis for the construction of a Systemic-Conjunctural Model of Information Security.

4. Systemic-Conjunctional Model Of Information Security (SCMIS)

The references examined in the previous sections point to a difficulty in classification. Cybersecurity has its own structures, techniques, and institutions, but it continues to share assets, risks, and purposes related to information protection with other security fields. The difference in scope identified between the concepts therefore requires a representation capable of simultaneously recognizing the specialization and the links between the domains.

The evolution of information supports and environments has produced progressive specializations of protection, preserving functional links with the common purpose of protecting information.

Based on this observation, this study proposes the Systemic-Conjunctional Model of Information Security (SCMIS), conceived as a theoretical-analytical framework intended to represent the relationships of inclusion, specialization, interdependence, and intersection existing between the different domains of information security.

The model starts from a fundamental premise: information constitutes the central and permanent object of protection, while the different environments, supports, and forms of processing determine the specialization of security mechanisms.

The proposed approach is based on the systemic conception according to which a system is constituted by interrelated elements that form an organized totality. For von Bertalanffy (1968), systems cannot be adequately understood only by the isolated analysis of their parts, since the relationships established between the components contribute to the constitution and functioning of the whole.

In a complementary way, Boulding (1956) argues that General Systems Theory offers a framework capable of identifying common structures, relationships, and patterns among different fields of knowledge.

The systemic perspective also presupposes that the behavior of a totality cannot be fully explained by the simple decomposition of its components. Meadows (2008) highlights that the relationships, flows, and interaction structures between the elements constitute fundamental characteristics of systems. Checkland (1981), in turn, demonstrates the usefulness of systems thinking for the analysis of complex problems characterized by the coexistence of multiple components and relationships. Applied to information security, this perspective allows shifting the analysis from isolated protection mechanisms to the relationships that exist between people, processes, technologies, structures, and informational assets.

In the organizational field, information security presents characteristics compatible with this perspective. People, processes, technologies, physical structures, norms, and governance mechanisms do not act in a completely independent manner. A vulnerability originating in a particular component can produce effects on the others, demonstrating the existence of functional interdependence.

4.1 The Fundamental Premise of SCMIS

The Systemic-Conjunctural Model of Information Security starts from the definition of a comprehensive reference set called the Information Security System (ISS).

Formally:

ISS = {x | x represents a mechanism, process, control, protection asset, or functional structure oriented towards the protection of information or informational assets}

In this definition, the criterion for belonging to the set does not derive exclusively from the technology employed. An element belongs to the ISS when its functional purpose is related to the protection of information, the reduction of risks affecting informational assets, or the preservation of security properties associated with information.

Thus:

x ∈ ISS ⇔ PI ∈ F(x)

where:

F(x) = set of functional purposes associated with element x; and

PI = purpose of information protection.

The expression establishes that an element is considered part of the Information Security System when information protection is integrated into the set of functional purposes associated with that element.

This definition allows us to overcome a purely technological interpretation of information security. Physical access control to a facility that stores sensitive documents, for example, is part of the information security system insofar as its purpose is to prevent unauthorized access to the information assets existing in that environment.

Similarly, an awareness program aimed at reducing social engineering attacks is part of the system because it acts on the human factor associated with information protection.

The functional criterion of belonging is, therefore, the first foundation of SCMIS.

4.2 The Set-Based Structure of the Information Security System

For analytical purposes, it is proposed that the Information Security System be represented by a comprehensive set composed of specialized subsets.

Thus:

SSI = SF ∪ SP ∪ SD ∪ ST ∪ SC ∪ SG

where:

SF: Physical Security;

SP: Personnel Security;

SD: Document Security;

ST: Technological Security;

SC: Cybersecurity; and

SG: Governance and Process Security.

The proposed division follows the predominant nature of the risks and protection functions. Facilities and material supports are situated in the field of physical security; the risks associated with those who produce, access, or safeguard information justify the size of the personnel. Documents require their own controls, just as the resources employed in processing and storage demand technological mechanisms. Cyberspace adds a domain characterized by networks, interconnected systems, and digital interactions. Policies, responsibilities, and decision-making processes cut across these fields and integrate the governance dimension. The boundaries between the subsets are analytical: in practice, their functions often overlap.

The fundamental element of the model is not found in the number of subsets, but in the existence of a functional relationship between each specialized domain and the higher information protection system.

Formally:

𝒮 = {SF, SP, SD, ST, SC, SG}

∀Sᵢ ∈ 𝒮, Sᵢ ⊂ SSI

SSI = ⋃Sᵢ, for Sᵢ ∈ 𝒮

R ⊆ 𝒮 × 𝒮

This means that every specialized subset belonging to the SSI has, directly or indirectly, a function related to information protection.

Physical Security protects facilities, environments, and media where informational assets are located;

Personnel Security addresses risks associated with individuals who produce, access, process, or safeguard information;

Document Security protects information recorded in documents and other media;

Technological Security encompasses mechanisms aimed at protecting the technological resources used in the processing and storage of information;

Cybersecurity focuses on the risks, threats, assets, and interactions existing in cyberspace; and

Governance and Process Security establishes policies, responsibilities, decision-making structures, and management mechanisms designed to coordinate the operation of the system.

Each subset has its own specialization. However, they all share a superior systemic purpose: the protection of informational assets.

SCMIS uses two successive analytical criteria. The functional criterion determines belonging to the SSI; the predominant domain criterion guides the classification of the element into specialized subsets.

Formally:

PI ∈ F(x) ⇒ x ∈ SSI

and:

x ∈ SSI ∧ Dₚ(x)=Dᵢ ⇒ x ∈ Sᵢ

4.3 The Principle of Domain Specialization

Based on the historical analysis carried out in this study, the Principle of Domain Specialization (PDS) is proposed.

The principle establishes that:

As an environment for the production, processing, storage, or transmission of information acquires its own complexity and produces specific risks, the Information Security System tends to develop specialized protection mechanisms aimed at that domain.

Formally:

C(D) ↑ ∧ ER(D) ↑ → E(Sᵢ)

where:

C(D): Complexity of the informational domain;

ER(D): Specificity of the domain risks;

E(Sᵢ): Emergence or specialization of a security subsystem.

The operator → is used in the PDS as a heuristic representation of a specialization trend and not as a necessary logical implication or deterministic causal relationship.

The formation of specialized security areas can be observed throughout the evolution of informational environments. The first computer systems introduced problems inherent to automated processing; their interconnection increased exposure to vulnerabilities and demanded mechanisms aimed at protecting networks. With the expansion of the internet and, subsequently, with the consolidation of cyberspace as an economic, social, and strategic environment, the repertoire of threats became more diverse and technically complex.

The institutionalization of cybersecurity must be understood in this context. The emergence of specific structures, knowledge, and practices does not necessarily require a break with previously existing protection mechanisms. Rather, it may indicate a functional response of the system to the complexity acquired by a given domain.

It is from this perspective that SCMIS interprets cybersecurity as an expression of the Domain Specialization Principle. Its emergence stems from the particularities of cyberspace and the risks produced therein, circumstances that justify the development of specialized mechanisms without presupposing independence from the broader information protection system.

4.4 Cybersecurity as its own subset

The inclusion relationship formulated and conceptually sustained in section 3.5 constitutes the structural foundation of SCMIS. In the model, SC ⊂ SSI expresses a difference in scope between the domains considered: cybersecurity focuses predominantly on the cyber domain, while the Information Security System also encompasses non-cyber assets, processes, and environments.

This relationship does not establish a hierarchy of importance or complexity. A specialized domain can develop high technical sophistication, operational autonomy, and its own institutional structures without thereby expanding the scope of its protection object.

The protection of classified physical documents, the control of environments intended for the custody of files, and the compartmentalization of sensitive verbal information illustrate this difference in scope. These are activities functionally integrated into the Information Security System, although they do not necessarily constitute cybersecurity activities.

Formally:

SC ≠ SSI

SC ⊂ SSI

In SCMIS, conceptual scope and operational complexity are distinct dimensions: the high sophistication of cybersecurity does not alter the extent of its domain of action. Taherdoost (2022) observes that information security encompasses information regardless of its form, while cybersecurity maintains a more direct relationship with the cyber environment.

In SCMIS, the internal sophistication of a subsystem does not determine its systemic position. Cybersecurity can exhibit a high degree of technical and institutional development and, simultaneously, maintain its functional link to the comprehensive information protection system.

4.5 The Principle of Relative Functional Autonomy

In recent decades, cybersecurity has developed its own institutional and technical apparatus. National strategies, specialized government agencies, operations centers, incident response teams, and specific doctrines demonstrate the degree of maturity achieved by the field.

The existence of these structures raises a relevant question for SCMIS: to what extent does the autonomy acquired by a specialized domain alter its relationship with the system to which it is functionally linked?

General Systems Theory allows us to distinguish specialization from systemic disruption. Components of complex systems can develop their own capabilities to respond to specific functions and still maintain essential relationships with the whole in which they participate (BERTALANFFY, 1968; BOULDING, 1956). Applied to the problem analyzed, this interpretation allows us to understand the institutionalization of cybersecurity as an expression of functional maturity.

The Principle of Relative Functional Autonomy (PAFR) stems from this distinction. A subsystem can expand to leverage its knowledge, structures, and mechanisms of operation without the increase in its autonomy automatically determining systemic independence.

Formally:

AF(Sᵢ) ↑ ⇏ Sᵢ ⊄ SSI

where:

AF(Sᵢ): Functional autonomy of the specialized subsystem.

The increase in the functional autonomy of a given subsystem does not imply its exclusion from the Information Security System.

Applied to cybersecurity:

AF(SC) ↑ ⇏ SC ⊄ SSI

The existence of national cybersecurity structures, cyber defense commands, security operations centers, incident response teams, and specific strategies in isolation does not constitute sufficient evidence of systemic independence.

On the contrary, such structures may represent the maturity achieved by a subsystem in the face of the complexity of the domain in which it operates.

4.6 The Principle of Informational Interdependence

The subsets of the SSI should not be represented as isolated structures. The reality of security incidents demonstrates that a threat can simultaneously traverse different domains.

The propagation of an incident across different domains allows us to observe this interdependence. Consider a social engineering action aimed at exploiting a human vulnerability. The improper acquisition of credentials can open access to technological resources; if this access occurs through cyberspace, the incident reaches the cyber domain and may subsequently result in the exposure of sensitive documents or information.

The incident path can be represented, in a simplified way, by the following chain:

SP → ST → SC → SD

The representation shows that the origin of a vulnerability and the domain in which its consequences manifest do not need to coincide. The risk moves through the relationships between people, technologies, cyber environments, and documentary assets. It is from this dynamic that the Principle of Informational Interdependence (PII) derives. This shift in effects between domains underlies the principle:

The vulnerability existing in a subset of the Information Security System can produce direct or indirect effects on the other subsets that share assets, processes, or information flows.

Formally:

∃Sᵢ,Sⱼ ∈ 𝒮, i ≠ j : (Sᵢ,Sⱼ) ∈ R

where:

V(Sᵢ): Vulnerability existing in subset i; and

E(Sⱼ): Effect produced in subset j.

Consequently, the relationships between the subsets constitute structural characteristics of the system and can, in certain situations, coexist with areas of functional intersection.

(SF,SC) ∈ R

(SP,SC) ∈ R

(ST,SC) ∈ R

(SG,SC) ∈ R

When mechanisms, assets, or functions simultaneously belong to more than one analytical domain, intersections can still occur Sᵢ ∩ Sⱼ ≠ ∅

This interdependence reinforces the need for integrated governance of information security.

4.7 The Architecture of the Systemic-Conjunctural Model

The SCMIS can be represented in three analytical levels.

Level I (Central Object): At the core of the system is the information, understood as an asset that has value and needs protection;

Level II (Information Security System): The ISS constitutes the comprehensive architecture of governance, risk management, and protection aimed at preserving informational assets; and

Level III (Specialized Subsets): Within the ISS are the different specialized security domains: SF, SP, SD, ST, SC, and SG.

The subsets exhibit areas of intersection and multidirectional relationships.

The relational architecture of SCMIS can be formally represented by the structure:

SCMIS = (SSI, 𝒮, R)

where:

SSI: Represents the comprehensive set of elements functionally oriented towards information protection;

𝒮 = {SF, SP, SD, ST, SC, SG}: Family of specialized subsets of the Information Security System; and

R ⊆ 𝒮 × 𝒮: Set of interdependencies existing between these subsets.

Additionally:

∀Sᵢ ∈ 𝒮, Sᵢ ⊂ SSI

and

SSI = ⋃Sᵢ, for Sᵢ ∈ 𝒮

Thus, SCMIS results not only from the identification of the specialized subsets that make up the SSI, but also from the representation of the relationships established between them.

4.8 Theoretical Propositions of SCMIS

The analysis developed allows us to formulate three central theoretical propositions.

P1 (Proposition of Cybernetic Inclusion): Cybersecurity constitutes a proper subset of the Information Security System, since its protection functions are related to informational assets and processes embedded in cyberspace, while the Information Security System reaches non-cybernetic informational environments.

Formally:

SC ⊂ SSI

P2 (Proposition of Functional Specialization): The emergence and institutionalization of cybersecurity stem from the increasing complexity of the cyber domain and the specificity of the risks existing within it, characterizing a process of functional specialization of the Information Security System.

Formally:

C(DC) ↑ ∧ ER(DC) ↑ → E(SC)

where DC represents the cyber domain.

P3 (Proposition of Systemic Interdependence): Cybersecurity maintains functionally interdependent relationships with the other subsets of the Information Security System, since vulnerabilities and effects can propagate between distinct domains.

Formally:

∃Sᵢ ∈ 𝒮, Sᵢ ≠ SC: (SC, Sᵢ) ∈ R ∨ (Sᵢ, SC) ∈ R

The expression indicates that there is at least one distinct specialized subset of cybersecurity that maintains a functional relationship with SC, either through the propagation of effects originating in the cyber domain, or through the production of effects on that domain.

5. Discussion And Examination of The Theoretical-Conceptual Consistency Of The Systemic-Conjunctional Model Of Information Security

The proposition of a theoretical model requires more than the formulation of categories and logical-formal relationships. Its consistency depends on the ability to explain observable phenomena, establish coherence between the concepts used, and present compatibility or explanatory capacity in the face of existing scientific and normative knowledge. In this sense, this section discusses and examines the internal theoretical-conceptual consistency of the Systemic-Conjunctive Model of Information Security (SCMIS).

The consistency examination procedure considers three criteria: internal coherence, understood as the absence of logical contradictions between the premises and propositions of the model; external compatibility, related to the correspondence between the model and the scientific and normative references analyzed; and explanatory capacity, understood as the SCMIS's ability to interpret the specialization and interdependence of the different domains of information protection. 5.1 The SCMIS considering General Systems Theory

The first theoretical basis for examining the consistency of the SCMIS lies in General Systems Theory (GST). The systemic perspective developed by von Bertalanffy breaks with the strictly reductionist interpretation of complex phenomena by emphasizing the existence of relationships between the component elements of a system. For von Bertalanffy (1968), a system can be understood as a set of elements in interrelation with each other and with the environment.

The centrality attributed to relationships has a direct correspondence with the structure proposed by the SCMIS. The Information Security System is not defined solely by the isolated existence of physical, technological, human, or cybernetic controls. Its systemic nature stems from the relationships established between these components and the functional convergence around a common objective: the protection of information.

Considering:

SSI = ⋃Sᵢ, for Sᵢ ∈ 𝒮,

the union of specialized subsets allows representing the functional scope of the Information Security System. However, this set-based representation, in isolation, does not explicitly show the relationships between the different protection domains.

For this reason, the SCMIS incorporates a relational dimension and can be represented by the structure:

SCMIS = (SSI, 𝒮, R)

where 𝒮 represents the family of specialized subsets and: R ⊆ 𝒮 × 𝒮.

The interdependence relationships can be represented by ordered pairs:

(Sᵢ, Sⱼ) ∈ R, with i ≠ j

The introduction of the relationship R brings the SCMIS closer to the systemic perspective. The system is not analyzed exclusively by the presence of its components, but also by the functional relationships and the flows of effects existing between them.

This interpretation finds correspondence in the thinking of Boulding (1956), for whom GST sought to develop theoretical constructs capable of discussing general observable relationships in the empirical world. The purpose was not to eliminate specialized theories, but to establish a structure for communication and understanding of the relationships existing between different levels and fields of knowledge.

Applied to information security, this reasoning allows us to understand that the existence of specialized areas — such as physical security, network security, or cybersecurity — does not preclude the identification of a superior systemic architecture. The scientific or operational specialization of a given component does not necessarily eliminate the relationships it maintains with the system in which it is embedded.

SCMIS, therefore, presents structural compatibility with General Systems Theory, insofar as it:

a) recognizes the existence of specialized components;

b) establishes a common systemic purpose;

c) considers the interdependencies between the components; and

d) admits the influence of the environment on the evolution and specialization of the system.

The last element is of particular importance. Cyberspace can be interpreted as a relevant transformation of the informational environment. The growth of digital networks, interconnected systems, and physical infrastructures that make up cyberspace has increased the complexity of the environment in which information is produced, processed, and transmitted.

From the SCMIS perspective, this environmental change has produced an internal differentiation of the protection system, favoring the specialization of cybersecurity.

Thus:

ΔA → ΔC(SSI) → E(SC)

where:

ΔA: Transformation of the informational environment;

ΔC(SSI): Increased complexity of the protection system;

E(SC): Specialization in cybersecurity.

5.2 Examination of the Cyber ​​Inclusion Proposition

The conceptual support of P1 requires verifying two relationships. On the one hand, the functions associated with cybersecurity must maintain a link with the protection of information or information assets.

On the one hand, information security must encompass situations that do not depend on cyberspace. These conditions are represented, respectively, by the expressions:

∀x (x ∈ SC → x ∈ SSI)

∃y (y ∈ SSI ∧ y ∉ SC)

The second relationship finds direct support in the breadth attributed to information security by the examined frameworks. ISO/IEC 27001 structures security management around the risks incident on information and does not restrict its protection to the cyber environment. Information recorded on paper illustrates this scope. The unauthorized removal of a classified physical document can compromise its confidentiality without computers, networks, or actions in cyberspace participating in the incident.

Therefore, there are elements of information security located outside of SC. The inverse relationship deserves a separate examination. In the NIST frameworks analyzed, cybersecurity appears associated with protection and defense against risks and attacks related to the use of cyberspace. The data, systems, networks, and activities within this domain are directly related to informational processes, although subject to their own technical conditions.

The comparison reveals an asymmetry of scope. The SSI reaches both cyber and non-cyber environments; SC focuses its activity on the cyber domain. Within the limits of the selected frameworks, this difference provides conceptual support for the inclusion relationship proposed in P1.

5.3 Examination of the Functional Specialization Proposition

The second proposition establishes that:

P2: Cybersecurity results from a process of functional specialization of the Information Security System caused by the increasing complexity of the cyber domain.

The historical analysis developed in item 2 demonstrated that information protection predates the existence of cyberspace. Document classification mechanisms, access control, cryptography, and secrecy protection existed before the widespread use of computers.

The development of computer systems produced specific risks related to the automated processing of information. Subsequently, the interconnection of computers expanded the surface area of ​​exposure and produced new dependency relationships.

International normative evolution accompanies this specialization process. The ISO/IEC 27000 family maintains an architecture aimed at the comprehensive management of information security. Within the same field of international standardization, specific frameworks have been developed for different environments and security problems.

ISO/IEC 27032:2023, for example, presents guidelines related to Internet security and explains the existing relationships between Internet security, web security, network security, and cybersecurity (ISO/IEC, 2023).

The existence of specialized standards has not eliminated ISO/IEC 27001. On the contrary, the standards coexist within a broader architecture of security management and specialization.

This structure corresponds to the Domain Specialization Principle:

C(D) ↑ ∧ ER(D) ↑ → E(Sᵢ)

The increase in the complexity and specificity of the risks of a given domain favors the development of specialized security mechanisms.

In the case of cyberspace:

C(DC) ↑ ∧ ER(DC) ↑ → E(SC)

The development of cybersecurity can, therefore, be interpreted as an adaptive response of the information protection system to the transformations of the technological environment. The coexistence between specialized cybersecurity structures and comprehensive information security management systems is compatible with the functional differentiation foreseen in P2; however, its generalization requires validation in other institutional contexts.

Thus, P2 finds historical and normative correspondence in the examined frameworks, without this compatibility constituting universal empirical validation.

5.4 Examination of the Systemic Interdependence Proposition

The third proposition establishes that:

P3: Cybersecurity maintains functional interdependencies with the other subsets of the Information Security System, since vulnerabilities and effects can propagate between distinct domains.

Formally:

∃Sᵢ ∈ 𝒮, Sᵢ ≠ SC : (SC,Sᵢ) ∈ R ∨ (Sᵢ,SC) ∈ R

ISO/IEC 27032:2012 is used in this study as a historical and conceptual reference, and not as a current standard. Its relevance lies in the explicit recognition, at this stage of the evolution of international standardization, of the dependency relationships between cybersecurity and other specialized security domains.

Similarly, unauthorized physical access to equipment can allow the installation of malicious devices or code intended to subsequently compromise a network.

Thus:

SF → ST → SC

Conversely, a cyberattack against an industrial control system can produce physical effects:

SC → ST → SF

The multidomain propagation of incidents finds correspondence in the literature on human and organizational security factors. Kraemer, Carayon, and Clem (2009) demonstrate that vulnerabilities can emerge from interactions between human, organizational, and technological factors, producing compromise pathways that go beyond isolated components. Dhillon and Backhouse (2000) similarly argue that the security of information systems cannot be adequately understood through exclusively technical approaches. From the SCMIS perspective, these interactions can be interpreted as manifestations of relationships between specialized subsets, offering a conceptual foundation for the Transversality of Informational Risk.

The relationships demonstrate the existence of multidirectional risk flows. Thus, the concept of Information Risk Transversality (IRT) is proposed, defined as:

the ability of a risk, threat, or vulnerability originating in each subset of the Information Security System to produce effects in one or more distinct subsets through the relationships existing between assets, people, processes, and technologies.

Formally, Information Risk Transversality can be represented by the relation:

V(Sᵢ) → E(Sⱼ), i ≠ j

where V(Sᵢ) represents a vulnerability, threat, or risk condition originating in subset Sᵢ, and E(Sⱼ) represents the effect produced in a distinct subset Sⱼ.

In SCMIS, the propagation of effects between distinct subsets constitutes a dynamic manifestation of the relationships represented by R. Thus, when V(Sᵢ) → E(Sⱼ), with i ≠ j, the trajectory of the effect shows a relationship (Sᵢ,Sⱼ) ∈ R.

The relationship expresses the possibility of multidomain propagation of security effects. In this theoretical-conceptual formulation, the expression has a relational and not probabilistic nature. Subsequent empirical studies could develop metrics aimed at estimating the intensity, frequency, or probability of this propagation.

The expression represents the possibility of an effect manifesting itself in the subset Sⱼ because of an existing vulnerability in the subset Sᵢ.

The Transversality of Informational Risk expands the Principle of Informational Interdependence and offers a potentially measurable conceptual variable in future research.

P3, therefore, shows compatibility with normative frameworks and the ability to explain the multidomain propagation of security incidents.

5.5 The SCMIS Comparison with the ISO/IEC 27000 Architecture

The ISO/IEC 27000 family constitutes a particularly relevant reference for the discussion of SCMIS because it organizes information security through a risk-based management framework.

ISO/IEC 27001 defines requirements for the establishment, implementation, maintenance, and continuous improvement of an Information Security Management System. The standard preserves the confidentiality, integrity, and availability of information through the application of a risk management process (ISO/IEC, 2022).

SCMIS does not intend to replace or reproduce the ISMS.

This differentiation is necessary because management standards and theoretical models have distinct epistemological purposes. Siponen and Willison (2009) warn of problems arising from the uncritical use of information security management standards as substitutes for theoretical foundations. Humphreys (2008), in turn, demonstrates the relevance of security standards for governance, compliance, and risk management. The SCMIS recognizes the normative importance of the ISO/IEC 27000 family but uses its architecture as a source of conceptual comparison, and not as the sole basis for the model's validity.

There is a difference in nature between the two models:

ISMS: Normative-managerial model; and

SCMIS: Theoretical-explanatory model.

The ISMS predominantly answers the question: How should an organization manage information security?

The SCMIS CSI seeks to answer: How do the different specialized security domains conceptually relate within the information protection system?

This differentiation is fundamental to defining the model's contribution.

SCMIS operates at an ontological and relational level. Its object consists of the structure of the relationships between the comprehensive system and its specialized domains.

In this sense, the model presents a complementary character to the normative frameworks.

The ISO/IEC 27000 family demonstrates the existence of a comprehensive information security management architecture. SCMIS proposes a theoretical framework to interpret the location and relationships of the different specialized domains within this architecture.

This complementarity can be represented as:

ISO/IEC 27000 Family: Normative framework for information security management;

SCMIS: Theoretical-conceptual architecture of relationships between information protection domains.

The compatibility between the two frameworks strengthens the external validity of the model, without establishing an equivalence relationship between them.

5.6 The SCMIS Comparison with the NIST Perspective

NIST's frameworks present high conceptual and operational diversity. The Computer Security Resource Center glossary aggregates definitions from different standards, guidelines, and technical publications, which is why the same term may have definitions associated with different source documents.

This characteristic requires methodological caution. It is not appropriate to select an isolated definition and present it as the sole and absolute epistemological position of NIST.

However, a comparative analysis of the definitions allows us to identify two recurring axes.

The first relates to the protection of information and information systems.

The second focuses on the risks, attacks, and activities carried out in cyberspace.

This differentiation is compatible with the object-domain structure proposed by SCMIS.

In the model:

SSI: Centrality on the protected object; and

SC: Specialization by domain of action.

Information constitutes the element of convergence, with cyberspace being the environment of specialization.

Thus:

SC = {x ∈ SSI | DC ∈ D(x)}

where:

D(x) = set of domains functionally relevant to the action of element x; and

DC: Cyber ​​domain.

This formulation represents cybersecurity as the set of elements of the Information Security System whose predominant action occurs in the cyber domain.

However, the term predominant is necessary. A cyber control can have physical, human, or organizational effects. Similarly, controls originating in other domains can influence cybersecurity.

Consequently, the boundaries between the subsets of the SCMIS should be interpreted as functionally permeable boundaries.

5.7 The confrontation of the model with the Brazilian normative architecture

The coexistence of the National Information Security Policy, established by Decree nº 12,572/2025, and the National Cybersecurity Strategy, established by Decree nº 12,573/2025, offers an element of institutional confrontation with the SCMIS. While the first organizes a comprehensive architecture for information governance and protection, the second focuses on the specifics of the cyber domain. Without constituting formal proof of the SC ⊂ SSI relationship, this normative differentiation is compatible with the distinction between a comprehensive system and a specialized domain proposed by the model.

In the Brazilian case, the coexistence of the PNSI and the E-Ciber functions as convergent evidence, not as universal proof: a comprehensive information policy coexists with a strategy specialized in the cyber domain.

Thus, the Brazilian architecture is not used as isolated proof of the relationship:

SC ⊂ SSI

but as one of the integral sources of the theoretical-conceptual triangulation process.

Within the limits of the theoretical-conceptual examination, P1 is compatible with the asymmetry of scope between IS and SC; P2, with the historical process of specialization; and P3, with the observed interdependence between human, physical, technological, and cybernetic factors.

P1 presents support arising from the asymmetry of scope between information protection and specialized protection of the cyber domain;

P2 finds correspondence in the historical and normative process of specialization of security mechanisms; and

P3 presents high systemic consistency, since the interdependence between human, physical, technological, and cybernetic factors can be observed both in security frameworks and in the dynamics of incidents.

5.8 The limits of the theoretical-conceptual examination

The results obtained must be interpreted within the limits of the methodological design adopted. The validation carried out focused on the internal coherence of SCMIS and its compatibility with the selected scientific, technical, and normative frameworks. There was no structured consultation with experts or empirical application of the model in specific organizations or incidents at this stage. The scope of the conclusions is, therefore, predominantly theoretical and conceptual.

The taxonomy itself {SF, SP, SD, ST, SC, SG} remains open to evaluation. Its function is to analytically organize different protection domains, but the configuration and boundaries of these subsets may vary between institutional environments. Future applications of SCMIS may reveal the need for aggregation, subdivision, or redefinition of certain categories.

There is also an inherent difficulty in the functional criterion of belonging:

x ∈ SSI ⇔ PI ∈ F(x)

Security controls rarely have a single purpose. An access control mechanism, for example, can simultaneously protect people, facilities, systems, and information. The overlapping zones do not invalidate the model but require caution in classifying the elements and reinforce the relational nature of the proposed architecture.

The formulation SC ⊂ SSI should be understood within these limits. This is a theoretical-conceptual proposition built from the analyzed references, and not a mathematical theorem. The set-theoretic language plays a logical-representational role: it makes explicit relationships of belonging, inclusion, and intersection that, in the literature examined, often appear in a dispersed or implicit manner.

Empirical validation, therefore, constitutes a later stage in the development of SCMIS. Structured consultations with experts, comparative studies, and organizational applications can test both propositions P1, P2, and P3, as well as the adequacy of the taxonomy and the functional criterion of belonging.

5.9 Synthesis of the Consistency Examination

The theoretical and normative comparison did not reveal any direct incompatibility capable of rejecting SCMIS on a conceptual level. The examined frameworks reiterate the difference in scope between information security and cybersecurity and recognize dependency relationships between protection domains.

The analysis of P3 also revealed a consequence that deserves its own investigation: risks and vulnerabilities can cross the functional boundaries of subsets and produce effects in domains distinct from the one in which they originated. This dynamic was called Information Risk Transversality (IRT).

The findings do not establish a universal classification between information security and cybersecurity. However, they indicate that the interpretation of cybersecurity as a functionally specialized and systemically integrated subset presents sufficient coherence to be subjected to subsequent empirical tests and external evaluations.

6. Final Considerations

The distinction between information security and cybersecurity cannot be resolved solely by comparing terminologies. The problem involves identifying the protected object, the environments in which risks manifest themselves, and the functions performed by security mechanisms. It was from these three dimensions that it became possible to examine the relationship between the two fields.

The historical trajectory of information protection reveals a movement of adaptation to changes in the means of production, storage, and circulation of information. Computers, networks, and digital infrastructures have introduced their own vulnerabilities and required specialized responses.

The consolidation of cybersecurity is part of this process. Its technical and institutional autonomy stems from the complexity acquired by cyberspace, without necessarily resulting in a rupture with the broader purpose of information protection.

The scientific and normative frameworks examined present differences in terminology and scope but converge on one relevant aspect: information security reaches assets and environments that go beyond the cyber domain. Physical documents, sensitive knowledge, organizational processes, and human factors remain subject to informational risks even when they do not directly depend on digital networks or systems. Cybersecurity, in turn, develops its specialization around the characteristics of cyberspace and the threats that manifest themselves within it.

The Systemic-Conjunctural Model of Information Security was built to represent this asymmetry. The SC ⊂ SSI relationship synthesizes a proposition of functional belonging, without establishing a hierarchy of importance or degree of complexity between the fields.

The autonomy of cybersecurity is recognized by the model because of specialization, while its integration stems from the permanence of links with the assets, processes, and information flows protected by the comprehensive system.

The analysis of the relationships between the subsets revealed an additional consequence. Security incidents rarely respect rigid functional boundaries. A human vulnerability can allow the compromise of credentials, reach connected systems, and result in the exposure of information; conversely, an action conducted in cyberspace can produce physical, organizational, or documentary effects. The Transversality of Informational Risk seeks to describe this capacity for propagation between domains and constitutes one of the open questions posed by the model.

The SCMIS should be understood as a developing theoretical-conceptual architecture. Its current formulation organizes relationships of belonging, specialization, and interdependence identified in the analyzed references, but it still needs to be confronted with other institutional contexts and external evaluation. Applying the model to concrete incidents and its assessment by experts will allow us to verify the stability of the formulated propositions and the analytical usefulness of the adopted taxonomy.

The main implication of the study lies in shifting the focus from classification to relationship. More than deciding where information security ends and cybersecurity begins, it is important to understand how different protection mechanisms specialize and remain connected in the face of risks that cross people, technologies, processes, and environments. It is in this relational space that the SCMIS intends to contribute to the contemporary debate on the architecture of information protection.