Local Government Cybersecurity Analysis: From Policy Review to Policy Framework Formulation

1. Introduction and Background

The smart city movement, which significantly enhances urban digital capabilities, also increases our cities' vulnerability to cybersecurity threats (D’Amico et al., 2020; Repette et al., 2021; Micozzi & Yigitcanlar, 2022; Son et al., 2023). In the age of smart cities and digital transformation, local governments (LGs) face increasing cybersecurity threats due to storing and managing a vast amount of sensitive information, including residents’ data and critical infrastructure details (Ahmadi-Assalemi et al., 2020; Toh, 2020; Frandell & Feeney, 2022). The frequency and severity of cyber-attacks on LGs have increased in recent years (Chaudhuri & Bozkus Kahyaoglu, 2023). A nation-wide survey in the USA by Norris et al. (2019) revealed that 27.7% of their LGs are victims of hourly or more frequent cyber-attacks, while 19.4% are targeted at least once daily.

Another study by Norris & Mateczun (2022) encompassing three counties and 11 cities in the USA showed that LGs of these regions experienced cyber-attacks on a ‘constant’ or ‘near-constant’ basis. Specifically, 57.1% of the surveyed LGs reported constant targeting, while 28.6% reported hourly targeting. Moreover, many LGs across the world are embracing smart city initiatives and increasing the use of Internet-of-Things (IoT) devices, which further escalates their threat landscape to cyber-attacks (Ma, 2021). Insufficient cybersecurity measures in LGs can lead to significant consequences, including the exposure of sensitive information, potential reputational damage, high costs for fixing security breaches, and impaired capacity to effectively address routine and emergency service needs (Tariq et al., 2021; Sharma & Mukhopadhyay, 2022).

The cybersecurity of LGs primarily emphasises technical safeguards such as firewalls, encryption, and anti-malware tools (Sarker et al., 2021). While technical defences are critical to shielding digital infrastructure from cyber-attacks, having policies is equally important (Savaş & Karataş, 2022; Siudak, 2022). Cybersecurity policies offer a set of guidelines for employees and contractors and enhance the effectiveness of technical measures (Caruson et al., 2012; Hatcher et al., 2020; AlDaajeh et al., 2022). However, many LGs across the world do not have cybersecurity policies, which is a significant concern due to the increasing rate and ever-evolving nature of cyber-attacks (Hatcher et al., 2020; Frandell & Feeney, 2022; Preis & Susskind, 2022).

An earlier contribution in this field by Caruson et al. (2012) found that only 48% of the LGs had formal cybersecurity policies or standards in Florida’s 67 counties. During a focus group discussion in 2018, IT professionals from the LGs in Maryland identified the lack of policy and its implementation as one of the principal challenges, along with insufficient funding and staffing for effective cybersecurity measures (Norris et al., 2018). In another study, Norris et al. (2019) found that 60% of the LGs in the USA lack cybersecurity policies. The Office of the Auditor General in Western Australia conducted a study on the cybersecurity issues of 15 LGs in that region and found only three with updated cybersecurity policies, nine with outdated or inadequate policies, and the rest without policies (Morrissey et al., 2021).

There is a noticeable lack of academic research on cybersecurity policies. Several studies have identified the lack of cybersecurity policies in LGs as a significant problem in protecting their digital assets and critical infrastructure (Caruson et al., 2012; MacManus et al., 2013; Norris et al., 2018; Chaudhary et al., 2023). However, Hatcher et al. (2020) authored the only article that explicitly investigated both cybersecurity policies and practices.

Hatcher et al. (2020) approached 2,436 LGs in the USA through an online survey but received only 7% responses. The survey aimed to examine the presence of cybersecurity policies in LGs, the use of internet-based technologies, the level of support received for cybersecurity planning, the specific types of cybersecurity policies implemented, and the resources needed for planning. Surprisingly, they found more than two-thirds of LGs with formal cybersecurity policies, but they identified multiple flaws in their practices. These include failure to document and take lessons from previous cyber-attacks, the lack of sufficient training and the absence of reviewing and updating training procedures, the absence of engaging experts in reviewing cybersecurity policies and practices, inadequate protection mechanisms for data, and the absence of appropriate protocols for accessing sensitive information.

Based on the gaps in practices, Hatcher et al. (2020) primarily emphasised putting more efforts into securing data, reviewing policies and practice strategies by external auditors and professionals, and allocating an adequate budget to effectively implement cybersecurity policies. They also cited respondents regarding the components of municipal cybersecurity policies, highlighting the necessity for additional research and the creation of a structured policy framework to assist LGs in crafting effective cybersecurity practices. However, a review and evaluation of the LGs’ cybersecurity policies are critical prior to formulating a guiding policy framework, as it will help understand gaps in existing policy statements and contents. This is still a grey area in the academic field.

With this backdrop in mind, we designed this study, aiming to develop a cybersecurity policy framework using insights from LGs’ evaluation of existing cybersecurity policy documents in different countries. For the empirical analysis, we used 38 cybersecurity policy documents of LGs in five different countries and evaluated them against the six Functions and underlying 22 Categories of the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework (CSF) 2.0.

The NIST CSF is a cybersecurity assessment framework designed to assess the cybersecurity posture of organisations against predefined criteria, providing a systematic methodology to identify strengths, weaknesses, and areas for improvement in controls, practices, and processes. A cybersecurity policy framework, on the other hand, can offer structured guidelines for LGs on what to include in cybersecurity policies. Cybersecurity policies do not typically include technical measures, but they outline the principles of cybersecurity governance and offer a structured approach to security measures for preventing and responding to cyber-attacks. Considering the importance of cybersecurity policies for any organisation, including LGs, and the absence of a cybersecurity policy framework, we designed this study. To achieve the aim of this study, we address the following research questions:

• How effectively do the cybersecurity policy documents of LGs align with the Functions and Categories of the NIST CSF 2.0?
• What are the key components that should be included in a cybersecurity policy document by LGs to ensure its effectiveness and comprehensiveness?

We conducted a qualitative and quantitative content analysis of the policy documents and stock-take insights to develop the policy framework, intending to inform cybersecurity policymakers, LG officials, and researchers in the field about the content and gaps in the existing policy documents, as well as the essential components required to be considered in cybersecurity policy for an effective security measure. Section 2 of this paper, following this introduction section, outlines the NIST CSF 2.0. Section 3 presents the methodology; Section 4 includes the results of the analysis, followed by the discussion and conclusion of this study in Section 5 and 6, respectively.

2. The NIST CSF 2.0

In February 2024, the NIST of the Department of Commerce in the USA released CSF 2.0, an updated version of CSF 1.1 from April 2018 (NIST, 2024a). The framework is a widely recognised assessment tool for all types of organisations’ cybersecurity to strengthen their digital defences (Wolff & Lehr, 2018; Taherdoost, 2022). The CSF consists of three components: Organisational Profiles, Tiers, and CSF Core (NIST, 2024b). The Organisational Profiles describe an organisation’s current or desired cybersecurity posture in relation to the outcomes of the CSF Core (NIST, 2023). The CSF Tiers are used to categorise the level of an organisation’s cybersecurity risk governance and management practices in Organisational Profiles (NIST, 2024a).

The CSF Core is a structured taxonomy of cybersecurity objectives that help organisations manage risks effectively (NIST, 2024b). It consists of a hierarchy of Functions, Categories, and Subcategories, each specifying a target outcome. Central to the NIST CSF are the six Functions—Govern, Identify, Protect, Detect, Respond, and Recover. These Functions are universally applicable, allowing any organisation regardless of their type and size, to tailor strategies to meet their unique risk profiles, technological environments, and goals (Toussaint et al., 2024). The Functions are further classified into 22 Categories, representing collective cybersecurity outcomes (NIST, 2024b). These Categories consist of 108 Subcategories, providing detailed descriptions of technical and managerial activities supporting each Category. In this study, we evaluated the policy documents of LGs against 22 Categories of six Core Functions. Table 1 presents all these Categories that were used as the evaluation criteria in this study.

3. Methodology

3.1. Policy Documents

To address the first research question, our initial plan was to assess the policy documents of the top 100 digital cities under the assumption that they would possess structured cybersecurity policies. However, we found less than ten cybersecurity policy documents available online for those cities. This unavailability of policy documents in the online portal and their website should not be misunderstood as a lack of cybersecurity policies without empirical evidence; rather, it suggests that such policies may exist but are not readily available in the public domain.

In response to this challenge, we shifted to a more targeted approach by conducting an advanced keyword search in Google Search Engine to explore the cybersecurity policy documents of LGs in G20 member countries, focusing on English-language documents only. This strategy yielded relevant policy documents from LGs in Australia, Canada, England, India, and the USA, demonstrating the effectiveness of our approach. To broaden our scope, we expanded our search to include countries such as the Netherlands, Ireland, Scotland, Bangladesh, the UAE, and Saudi Arabia, anticipating the presence of cybersecurity policies in English. However, we did not find one available in the public domain. As a result, we excluded them from our study.

To locate policy documents, we employed an advanced search query in the following format: “site: (government domain) “keyword” filetype: (type of file)”. We substituted the term “government domain” with the appropriate domain for each country, such as “.in” for India and “.au” for Australia, to limit our search exclusively to websites belonging to government entities. Otherwise, we encountered a substantial volume of search results that were predominantly unrelated to our research. In “keyword”, we used “cybersecurity policy” and “cyber security policy”.

Lastly, we specified the filetype as “pdf” to search for policy documents in Portable Document Format (PDF), which is a commonly used format used to upload policies online. For example, to find policy documents in Australian LGs, we employed two search syntaxes: (a) site:gov.au “cybersecurity policy” filetype:pdf, and (b) site:gov.au “cyber security policy” filetype:pdf. The first search yielded 279 results, while the second search yielded 4,420 results. We applied similar strategies to other countries, except for the USA. Since the USA has two public domains, namely “.gov” and “.us”, we repeated the process twice.

Figure 1 displays the search count and the number of policy documents identified by each search query. We conducted the search during the first week of December 2023. We discovered a total of 38 cybersecurity policy documents, distributed as follows: 12 in Australia, two in Canada, seven in England, six in India, and 11 in the USA. Table 2 presents notable attributes of the LGs that possess the cybersecurity policy documents identified in this study.

3.2. Research Strategy

This study used the content analysis method to evaluate cybersecurity policy documents. We defined the Functions of NIST CSF as codes and Categories as sub-codes (Table 3) and used NVivo 14.23.2 (46) software to classify and conduct analysis. The evaluation process encompasses the identification of recurring themes, patterns, and gaps. We employed this systematic approach to gain insights from the existing policy documents, which later helped us develop the cybersecurity policy framework.

4. Results and Analysis

4.1. Quantitative Content Analysis

We assessed LGs’ cybersecurity policy documents using quantitative content analysis tools in NVivo Software. Initially, we generated word clouds to visually emphasise the most frequently cited words within the policy documents, with the largest size representing those that were mentioned most frequently. Figure 2 displays the frequency of words in cybersecurity policy documents, while Figure 3 shows the frequency of words in the coded data specifically. We examined the number of cited policy documents for each code and sub-code, as well as the frequency of sub-codes within the policy documents. Of the six codes, 37 policy documents addressed Govern, while 16 policy documents addressed Recover. Table 4 shows that the sub-codes under Protect Function were cited most frequently (n=222), followed by the sub-codes under Govern (n=220), while the sub-codes under Recover were cited the least (n=22).

Figure 4 displays a hierarchical chart generated in NVivo software showing all the codes and sub-codes from the aggregated cybersecurity policy document data. Each rectangular section corresponds to a specific code frequency. The chart shows that the most prevalent codes in the analysis of policy documents were Protect and Govern, while the least prevalent codes were Recover and Detect. The hierarchy chart shows the prominence of sub-codes, with Identify, Management, Authentication, and Access Control under the Protect code and Roles, Responsibilities, and Authorities under the Govern code being the most prominent. On the other hand, Incident Recovery Communication under the Recover code and Incident Analysis under the Respond code are the least prominent sub-codes.

4.2. Qualitative Content Analysis

Following the quantitative analysis, this study conducted a qualitative content analysis to identify recurring themes and patterns in the policy documents for each of the Categories of NIST CSF Functions. We developed a concept map (Figure 5) to effectively communicate these themes and emphasis of each Categories in the policies, which ultimately indicate the areas of strength or weakness in current cybersecurity practices at the LG level. The following sections present details of the qualitative content analysis.

4.2.1. ‘Govern’ with Focus on Organisational Risk and Responsibility

The Govern Function includes six Categories as presented in Table 4. Among the 38 policy documents that we reviewed, 37 addressed Govern. However, none of them encompassed all six Categories under this Function. Most of the policies (n=27) included statements on organisational context and the roles of personnel, emphasising LGs’ goals, vision, cybersecurity targets, standards, and responsibilities of officials, departments, and dedicated committees. For example, the RBWM’s policy highlighted the importance of executing desired actions as suggested in the policies:

“The aim ... to ensure that the correct processes and procedures, roles and responsibilities are in place and followed for any council cyber threat or incident while we continue our normal business operations” (RBWM, 2020, p. 4).

Articulating risk management strategies involves establishing and communicating the organisation’s priorities, constraints, and assumptions to support operational risk decisions (Öğüt et al., 2011). Only 22 policy documents covered this Category, addressing statements mostly related cyber risks, risk management guidelines, and cyber governance. A similar number of policy documents (n=21) addressed statements on communication and enforcement of policies, emphasising the need for procedures and guidelines, standards, and national and state-level policy alignment. The study also revealed that supply chain risk management, and oversight have been rarely cited (n=4, and n=0, respectively) in the policies. In four documents that included statements for supply chain risk management, mostly focused on the roles and responsibilities of third parties and service providers who support LGs in operating software and maintaining hardware.

4.2.2. ‘Identify’ with Focus on Asset and Risk Management

Our study found a total of 29 cybersecurity policy documents that addressed at least one of the three underlying Categories. Among them, 25 policy documents adequately covered asset management, addressing endpoint or hardware security, software security, security of personal and organisational service accounts, and network protection. For instance, Beaverton’s policy focused on keeping inventory of hardware and software as follow:

“...must take an inventory of all approved hardware and software on City networks and systems; one inventory for hardware and one for software” (Beaverton, 2021, p. 4).

Impact analysis of cyber-attacks, vulnerability assessment, risk registration, and use of assessment frameworks have been highlighted to address Risk Assessment Category in the policies. This Category has been covered by only 14 policies. Improvement is another Category under Identify Function and has been address only in a few policies (n=9). Regular audits, continuous assessments, feedback loops, performance metrics, and process refinements have been emphasised in the policies to address this Category.

4.2.3. ‘Protect’ with Focus on Access Control, and Raising Awareness

We found 32 policies addressing one or more among five Categories of this Function. Identity verification, password policy, and access monitoring have been heavily emphasised in the policy documents (n=29) to address identity management and access control. Some policy documents have also included statements on the access revocation of employees as soon as they leave LGs, such as Portland’s policy:

“System administrator passwords will be terminated immediately if the employee who has access to such passwords is terminated, fired, investigated, or otherwise leaves employment” (Portland, 2023, p. 3).

The policy documents (n=24) have frequently addressed the Awareness and Training Category, with emphasis on training employees, running awareness campaigns, and promoting cyber-hygiene. The Technology Infrastructure Resilience Category has been mentioned in a few policies (n=5), emphasising continuous operation and following standards. Data Security and Platform Security are two crucial Categories of Protect Function, particularly critical for LGs. Data and platform security are very important aspect of organisational cybersecurity. However, we found only 18 policy documents that addressed Data Security and 15 that cited Platform Security. Endpoint security, patch management, network segmentation, and application security are covered under Platform Security Category, whereas data classification, encryption, Data Loss Prevention, and storing and backing up data have been highlighted under the Data Security Category in the policy documents.

4.2.4. ‘Detect’ with Focus on Continuous Monitoring

A total of 19 cybersecurity policy documents encompassed statements on this Function. All of them included statements about ongoing surveillance to identify anomalies and breaches. However, only seven of them addressed adverse event analysis, which is the other Category of this Function, focusing statements on scanning for irregularities, analysis of cyber-attack consequences, and monitoring activities. To address continuous monitoring, the policies mentioned anomaly detection, real-time monitoring, keeping log records, intrusion detection, and network traffic monitoring. For instance, the policy document of the City of Madras addressed:

“All organization servers and workstations will utilize Microsoft Windows Defender with Windows Advanced Threat Protection (ATP) to protect systems from malware and viruses. Real-time scanning will be enabled on all systems and weekly malware scans will be performed” (Madras, 2020, p. 13).

4.2.5. ‘Respond’ with Focus on Incident Management

We found 30 cybersecurity policy documents covering this Function in varying degrees of adherence to the four Categories under this Function. Of those, 27 addressed incident management, with an emphasis on incident scanning, logs, rapid response, and notification systems. The policy document of Norwich stated:

“... develop and implement appropriate activities to take action regarding a detected cybersecurity event, Response processes and procedures are executed and maintained, to ensure adequate response and recovery actions” (Norwich, 2020, p. 2).

Other Categories under Respond have been cited in a significantly low number of policies, with the Incident Analysis (n=2) focusing on impact analysis, root-cause analysis, and attack vector analysis; the Incident Response, Reporting, and Communication (n=9) emphasising real-time notification, incident reporting, incident communication, and briefings; and the Incident Mitigation (n=2) focusing on regular drills and coordination between departments.

4.2.6. ‘Recover’ with Focus on Incident Recovery Plan Execution

We only identified 16 policy documents addressing this Function. All of them included statements on incident recovery plan execution, which included statements for service restoration, disaster recovery, and system backup. Woodburn and Lebanon included statements on Incident Recovery Communication, which is the other Category under Recover. The statements emphasised stakeholders’ communication, international communication, and internal coordination. For instance, Woodburn’s cybersecurity policy stated:

“External communications should only be handled by designated individuals at the direction of the City Administrator. Recovery activities are communicated to internal stakeholders, executives, and management teams” (Woodburn, 2021, p. 12).

5. Findings and Discussion

5.1. Insights from Cybersecurity Policies of LGs

Our study revealed concerning gaps since none of the policies addressed each Categories of NIST CSF. In fact, 24 of the 38 policies covered less than half of total Categories. Figure 6 shows the coverage of Functions and Categories by policy documents.

In Australia, only three LGs (Sutherland, NSW, and Rous) addressed more than 10 Categories (n=11, n=12, and n=12, respectively). State Governments such as Tasmania and Western Australia (WA), presumably with more resources than local councils, addressed only 3 and 7 Categories, respectively. None of Australia’s cybersecurity policies addressed supply chain risk management, except for WA. This gap is particularly concerning given the rapid increase in digital device usage and LGs’ adoption of smart city initiatives (Verhulsdonck et al., 2023; Yigitcanlar et al., 2023a, 2023b). In the process of digital advancement, LGs tend to rely more on an intricate web of suppliers (Popescul & Radu, 2016; David et al., 2023). Inadequate measures to proper management of these suppliers make them vulnerable to increased cybersecurity threats (Boyson, 2014; Vitunskaite et al., 2019).

An important, perhaps most critical, asset of LGs, which often makes them an attractive and frequent target for cyber-attacks, is the storage of a wide range of sensitive data, including individual-centric data, public safety and governance data, infrastructure and utility data, and community and environment data (MacManus et al., 2013; Ali et al., 2020; Sadik et al., 2020). LGs typically prioritise securing this data and platforms, which include software and hardware for storage and communication (Caruson et al., 2012; Ullah et al., 2021). Most of the policies in Australia did not mention clear statements in these two Categories. Even NSW’s policy, which is among the top two that covered the greatest number of Categories, failed to comprehensively mention statements on data and platform security.

Risk assessment involves understanding risks to LG’s assets and employees (Kalinin et al., 2021), an important Category that has been overlooked in most of the policies in Australia, except for Sutherland and New South Wales, revealing a potential gap in risk assessment practices in LGs. This lack can hinder effective cybersecurity threat mitigation and response (Fielder et al., 2018; Goel et al., 2020). One of the strengths identified in most of the cybersecurity policies in Australia, which is often missing in the policies of other countries, is the presence of Improvement in most of the policies. This Category involves identifying enhancements to organisational cybersecurity risk management processes, procedures, and activities to keep up with evolving threats (Srinivas et al., 2019; Hatcher et al., 2020).

Vancouver and Greenview in Canada addressed 11 and 12 Categories, respectively, in their policies. These two policies effectively mentioned employer responsibilities, asset management, risk assessment, access control, data and platform security, and continuous monitoring for cyber-attacks. However, both policies failed to address incident mitigation, recovery plan execution, and communication, which are crucial to restoring assets and operations affected by cybersecurity incidents (Hamdani et al., 2021; Ma, 2021). None of the LG’s policies in Canada mentioned technology infrastructure resilience, indicating a significant gap in maintaining continuous operations or defending against the increasing sophistication of cyberthreats (AlDaajeh et al., 2022).

In England, except for the policy documents of London, other LGs addressed less than 10 Categories each. The cybersecurity policies of Enfield and Crediton are among the least comprehensive ones, covering only four Categories each, ignoring important statements on training and awareness, data and platform security, and monitoring activities to detect and respond. Even though London’s cybersecurity policy is one of the most comprehensive policies that we reviewed, it still failed to include crucial details on incident analysis, reporting, and mitigation, along with most other LGs in England. The incident analysis entails activities such as investigation to facilitate efficient response and recovery efforts (Sun et al., 2019; Patterson et al., 2023), whereas the incident mitigation involves activities to prevent the expansion of a cyber-attack (Habibzadeh et al., 2019; Ali et al., 2020). The policy documents of London, Northwest Leicestershire, the RBWM, and Aylesford in England emphasised training and awareness, understanding the need to equip personnel with the necessary knowledge and skills. This is particularly significant as human factors are often considered a vital weak point in cyber defences (Javed et al., 2022; Nuñez et al., 2023).

Among Indian LGs, Odisha has successfully addressed 15 Categories. However, like other policies in India, Odisha’s cybersecurity policy inadequately addressed the Detect Function. This Function refers to the process of identifying and analysing potential cybersecurity threats, which serves as a foundation for the efficient implementation of incident response and recovery activities (Ahmadi-Assalemi et al., 2020; NIST, 2024a). None of the policy documents of Indian LGs mentioned incident recovery communication, which involves informing internal and external stakeholders, such as communities, about the incident to update them about the restoration process and maintain organisational integrity and public trust. Another important Function that has not been addressed in most of the cybersecurity policies in India is the Protect Function. Critical topics such as asset management, including data, software, hardware, services, people, facilities, and systems, risk assessment, and improvement, have been largely absent in most of the cybersecurity policies of LGs in India.

In the USA, six of the 11 policy documents addressed less than 10 Categories of NIST CSF. Some cities such as Albuquerque, San Francisco, and Portland addressed only one, three, and five Categories, respectively, which is particularly concerning. Articulating risk management strategies in the policies is crucial, as it involves establishing and communicating the organisation’s priorities, constraints, risk tolerance, and assumptions to support operational risk decisions (Öğüt et al., 2011). But the policy documents of Albuquerque, San Francisco, Portland, Scappoose, Madras, Beaverton, and Woodburn failed to mention this. Statements on supply chain risk management are also absent in all the policies in the USA, except for New York. The USA’s policy documents showed strength in addressing Protect Function, which refers to security measures created to prevent or minimise cybersecurity threats by securing assets (Ibrahim et al., 2018; Möller, 2023). As indicated in Figure 6, most of the LGs in the USA addressed access control, awareness and training procedures, data security, and platform security adequately.

5.2. Key Contributing Factors to Existing Gaps in the Cybersecurity Policies

The study revealed a significant gap in encompassing NIST CSF Functions and Categories in the policies as discussed above. We identified and argued for several potential factors behind these gaps in the policies. A key contributing factor could be that LGs may follow country specific cybersecurity guidelines or frameworks such as the Essential Eight in Australia (Syafrizal et al., 2020; Grobler et al., 2021). To verify this, we calculated the number of NIST CSF Categories addressed by each policy document, as shown in Figure 7.

We found that there is no significant difference in NIST CSF Function and Category coverage between cybersecurity policy documents in the USA and in other countries. In fact, policy documents in Australia, Canada, England, India, and the USA addressed about four to five Functions on average. On the other hand, the policy documents of Australia, England, India, and the USA covered about seven to nine Categories on average. Canada’s policy documents addressed more Categories (n=11) on average than other countries. However, these numbers of Category coverage are significantly lower than the total number of Categories (n=22) in the NIST CSF. Despite differences in terminologies or categorical emphasis between national frameworks, the fundamental objective and thematic elements of cybersecurity are consistent across most frameworks. So, while some LGs may align with their national framework or strategy, we still found a similar coverage of NIST CSF Functions and Categories among LGs from different countries.

The use of NIST CSF 2.0 as the evaluation benchmark, which was recently released in February 2024, could also contribute to the disparities in cybersecurity policy documents, as all the policy documents used in the study were published prior to 2024. So, we further examined the Functions and Categories of previous NIST CSF versions. The current version introduces a sixth Function—Govern, recognising its importance and influence across all other Functions. This new Function is an extension of the Governance Category under Identify Function in the previous versions. The Govern Function comprises two Categories from previous versions and four new Categories. Despite these changes, 18 Categories out of 22 in the latest NIST CSF remained consistent with the previous versions. Surprisingly, our study found that three of the four recently added Categories (Organisational Context, Roles, Responsibilities, and Authorities, and Policy) have been addressed relatively higher (n=27, n=27, and n=21, respectively) than many other Categories. Overall, the update in versions mostly involved reclassification and combining certain Categorise together to enhance their applicability and simplicity. Therefore, this consistency between versions allowed us to conduct a valid and relevant evaluation of the cybersecurity policy documents against the Functions and Categories of NIST CSF 2.0 and present an overview of the gaps in existing policy documents.

Several studies identified limited financial resources and expertise and a lack of proper knowledge of the LGs’ officials about the significance of cybersecurity as major challenges to effective cybersecurity measures (Ibrahim et al., 2018; Norris et al., 2021; Norris & Mateczun, 2022). LGs, particularly smaller LGs, face these challenges more often (Hatcher et al., 2020). Furthermore, many LGs underestimate their digital infrastructure with a lower risk profile, overlooking the fact that all LGs, regardless of their size, are attractive targets because they store critical citizen and governance data (Bauer & van Eeten, 2009; Li et al., 2019). Our findings also indicate the same, as we found that the policy documents of the top 10 smaller LGs in terms of population addressed a lower number (n=8) of Categories on average than the top 10 larger LGs (n=10) even though they covered a similar number of Functions on average (n=4) as presented in Figure 8.

However, the average number of Categories covered either by smaller or larger LGs is not even close to the total number of 22 Categories. These statistics indicate that regardless of the size of LGs, cybersecurity policy documents still lack critical details, and we acknowledge the absence of a well-defined and acceptable cybersecurity policy framework as a vital cause. Several researchers have also emphasised the importance of cybersecurity policy and a structured policy framework (Harknett & Stever, 2011; Hatcher et al., 2020; Wu et al., 2020; Ariffin & Ahmad, 2021; Grobler et al., 2021; Mishra et al., 2022) as the inconsistencies in the policy documents not only hinder best practices but also significantly expose LGs to cyber-attacks. Therefore, this study advocates for and develops a cybersecurity policy framework to guide LGs through the complex process of establishing effective cybersecurity strategies without missing any critical details.

5.3. Cybersecurity Policy Framework for LGs

Our proposed cybersecurity policy Framework encompasses seven key components and 38 sub-items, as illustrated in Figure 9. Document Introduction is the first key component that includes introductory information, such as organisation name, approvers’ details, approval date and upcoming review date. The second key component —Organisational Context comprises sub-items that present organisational background, including organisational overview, purposes, scope, definition or explanation of the vital terms, policy alignment with state, national, or regional policy or agreement, and periodic or emergency policy amendment procedures. Cybersecurity administrative structure, roles and responsibilities of departments, employees, and contractors, regulatory compliances, disciplinary actions in case of policy violation, and public communication in case of a breach are all included under Cybersecurity Governance, which is the third key component of our policy framework.

Asset Identification is the fourth key component of our framework dedicated to identifying and categorising LGs’ assets, including the types of data, inventories of software, applications, and digital devices. The fourth key component also includes a Sub-item—periodic inventory review process—highlighting the importance of having a structured inventory review process, considering the constantly evolving nature of technology and cyberthreats. The fifth key component —Assessment and Management emphasises identifying potential risks and implementing appropriate measures to mitigate them. The component includes sub-items such as risk assessment and prioritisation, authentication and access control mechanisms, and clear guidelines on the core cybersecurity concepts, including data security, internet security, web security, network security, application security, and endpoint security. Given the rise of remote workers, we have also included a sub-item under this component that highlights the security protocols and practices necessary to secure their access to LGs’ networks. LGs have significantly increased their use of IoT devices in recent years, as have adoption of smart city initiatives. This prompted us to add a sub-item—Smart City Security—to our framework, which is only applicable for LGs that act as the administrators of smart cities. Audits and Compliance Check is the last sub-item under the fifth Key Component, emphasising the importance of assessing vulnerabilities regularly and keeping practices updated.

Detection and Response is the sixth key component of our policy framework, which includes Sub-items for continuous and real-time monitoring to detect cyber-attacks. A structured incident response plan, with procedures to report and alert within departments, detailing a clear step-by-step process for swift and coordinated actions during a cyber incident, is crucial for immediate action against cyber-attacks. Sequential instructions on disaster recovery and restoration after a cyber-attack should also be included in the LGs’ cybersecurity policy to minimise operational disruptions, and hence, we included this as a Sub-item in our policy framework. Training and Awareness is the last and final key component of our policy framework, recognising the importance of training and awareness for employees, contractors, and anyone who interacts with LGs. Particularly for employees, establishing a culture of cyber-hygiene in their day-to-day activities can significantly benefit LGs by reducing potential weak links for breaches. Overall, the policy framework covers a wide range of considerations—from governance and asset management to response planning and community awareness—and provides a blueprint for LGs to develop cybersecurity policies and

6. Conclusion

This study revealed concerning gaps in the existing cybersecurity policies of LGs, irrespective of their size and location. We investigated and discussed various potential contributing factors to these gaps, and we acknowledged the absence of a unifying and guiding framework as a principal cause. Therefore, we developed a cybersecurity policy framework for LGs, offering a structured approach to cover all essential aspects and guiding them to formulate effective policy documents.

Our proposed policy framework shares certain overlapping and similarities of topics with NIST CSF. However, while NIST CSF act as an assessment tool of the cybersecurity posture of any or-ganisation, our policy framework serves as a guiding tool for LGs to formulate effective cyberse-curity policies without missing critical details. Most of the sub-items under the seven key compo-nents of our cybersecurity policy framework are broadly applicable in various organisational con-texts, but its true uniqueness and value lie in its tailored approach to address specific aspects of LG operations. Among them is the emphasis on data security. Unlike many organisations, LGs store and manage a diverse range of sensitive data, including residents’ personal information, urban infra-structural data, governance data, spatial data, and so on. Public trust and safety. Given the sensitivity and breadth of this data, it necessitates a nuanced approach to data security, one that goes beyond standard practices to address the specificities of public sector information management.