A Framework for Exploring Cybersecurity Policy Options