Adoption of cybersecurity policies at the grassroots: 2022

In this paper, we examine the adoption of cybersecurity policies by local governments in the United States using data from four local government cybersecurity surveys that were conducted in 2016, 2018, 2020 and 2022. Among other things, we asked whether local governments had adopted formal cybersecurity plans and other policies, purchased cybersecurity insurance, offered or mandated cybersecurity training for staff, officials and on-site contractors, or taken one or more of seven specific actions to improve their cybersecurity, adopted one or more of three cybersecurity agreements with other organisations, applied for and/or had received external funding to improve their cybersecurity from the American Rescue Plan Act (ARPA) and/or the Infrastructure Investment and Jobs Act (IIJA) and last, we asked what the biggest challenges in cybersecurity that these governments believed that they faced. Our most significant finding is that local governments have not done an adequate job in adopting cybersecurity policies. Likewise, these governments lagged in taking specific actions to improve their cybersecurity. A few governments have entered into agreements with other entities to assist them in improving their cybersecurity or recovering from breaches. Finally, we made recommendations to help local governments improve their cybersecurity.