# From Security Frameworks to Sustainable Municipal Cybersecurity Capabilities
## 2 Background and Literature
### Socio-Technical Approach to Cybersecurity  
A socio-technical systems approach entails viewing a system as a complex integration of technological and social systems, and any design or redesign needs to address both perspectives in order to succeed [27; 28]. Advocates of a socio-technical perspective haveargued that a techno-centric approach to cybersecurity neglects or understates the importance of the social and human aspects, leading to an imbalance that leaves organizations open to risk [29; 30]. In 1965, [PERSON] [9] introduced the diamond model of socio-technical change management, viewing organizations as complex systems characterized by four key variables: tasks, structure, actors, and technology. The model (Figure 1) is illustrated as a diamond with the four aspects at each corner connected by arrows, illustrating the mutual impact of changes in one variable on all others. The model is commonly used to demonstrate how changes, such as introducing a new technological solution, will affect, and be affected by, task performance, organizational structure, and how actors interact and respond based on their personal characteristics such as attitudes, skills, and knowledge.  
Weaknesses in aspects of the socio-technical dimensions of cybersecurity can have serious consequences for local governments--some examples are:  
* Structural issues include a lack of prioritization and sufficient resources to perform the necessary cybersecurity activities and a lack of internal coordination [31], so critical functional areas of local government, such as healthcare or water supply, are not adequately supported by vulnerability scanning or security monitoring activities;
* Issues related to people and the human aspects, such as insufficient training, either on cybersecurity issues such as threats and vulnerabilities related to all aspects of local government technology or on the tools and technologies necessary to perform cybersecurity work [32], such as vulnerability scanning, network and endpoint security, and security monitoring tools leading to lack of use or errors in detecting security issues;
* Technological issues, such as limitations in functionality and coverage, for example, for specialized security issues in local government areas such as medical technology in municipal healthcare or SCADA systems (supervisory control and data acquisition), in water supply, or the lack of integration between security technologies leading to tool overload for security analysts, or cybersecurity tooling with complicated and unsuitable user interfaces leading to lack of adoption of security technology [33];
* Doing the wrong tasks or performing them with insufficient quality can lead to vulnerabilities not being correctly removed, security alerts being wrongly prioritized, and security incidents not being investigated with sufficient rigor to identify the root causes of security incidents.  
Figure 1: [PERSON]’s diamond model—adapted from [9].  
Addressing cybersecurity in complex organizations, such as municipalities, will require considering all of these four dimensions and their mutual interdependency. For example, it is well established that the introduction of technology alone is insufficient to drive value without actual usage [34], and that actual technology adoption is dependent on the skills and education of the workforce [35]. Likewise, individual task performance depends on the \"fit\" or suitability of the technology [36], and the introduction of technology have a significant effect on organizational structure, roles, and responsibilities [37].