The cybersecurity of municipalities in the United States: an exploratory survey of policies and practices

Municipal Cybersecurity: More Work Needs to be Done

“…Rounding out the surveys, Hatcher et al (2020) conducted a survey of small-and medium-sized cities in the US. In contrast to Norris et al (2020), Hatcher et al (2020) found a majority of respondents (71%) had a formal cybersecurity policy. These included a focus on phishing education, incident reporting, password management, and security protocols.…”

“…The research to date has not clearly shown why or how different approaches to enhancing cybersecurity, at the level of local governmental entities, have produced better or worse results. Though the published literature and the marketing materials provided by private consultants are rife with lists of best practices (Funk et al 2019;Hatcher et al 2020;Norris et al 2019Norris et al , 2020State of Connecticut 2018), little has been done to make distinctions among different kinds of places and what works best in each situation. Multiple cities may be hit with cyberattacks concurrently (Allyn 2019), yet they may respond differently.…”

Cybersecurity in the Local Government Sector in Poland: More Work Needs to be Done

“…The majority of municipalities in Poland have an adequate information security organisation, and an information security system has been developed and implemented in most offices. Having a formally approved security policy in place is crucial, as stressed by (Hatcher et al, 2020). In addition, most municipalities carry out an internal information security audit every year.…”

“…Local government units are considered to be legal entities and are legally guaranteed independence of action. (Hatcher et al, 2020;Wolff & Lehr, 2018). The exchange of experience, joint development of systems, as well as the use of economies of scale are the most important aspects local governments should pay particular attention to when considering cooperation.…”

“…A survey conducted by Hatcher et al (2020) on a group of 168 civil servants working in different cities in the US found that most cities have prepared a document that outlines security policies, but do not keep records of cyber-attacks.…”