The cybersecurity of municipalities in the United States: an exploratory survey of policies and practices

Few empirical studies have examined the cybersecurity policies of cities in the United States. Issues that have yet to be addressed in the literature include whether cities (of various sizes) maintain cybersecurity plans and policies that are sufficient to protect their citizens’ data, a general lack of knowledge regarding cybersecurity policies, and practices on the part of cities that place at risk the security of public services and citizens’ privacy. Our research explored these issues by administering a survey to public officials working in U.S. cities. The survey instrument included questions pertaining to (1) the existence of a formal cybersecurity strategic plan and the utilisation of internet-based technologies in cities, (2) the support received by cities for their cybersecurity planning, (3) the types of cybersecurity policies being implemented in cities, and (4) the resources needed to conduct cybersecurity planning. We collected surveys from 168 officials employed in cities across the U.S. Our analysis of the results indicates that municipalities have formal cybersecurity policies but that they need to increase the integration of cybersecurity practices into their daily management processes by tracking their data, consulting outside security auditors, and increasing management training related to data security.