# From Security Frameworks to Sustainable Municipal Cybersecurity Capabilities
## 2 Background and Literature
### Cybersecurity Frameworks  
Cybersecurity management frameworks, such as ISO 27002, the NIST Cybersecurity Framework, and the CIS Critical Security Controls, provide organizations with a structured approach to managing cybersecurity risks. The standards differ in their approach to management processes but typically contain a set of security controls either considered a baseline standard or to be selected using a risk-based approach. Typical topics are risk management, vulnerability management, continuity, incident response, and security awareness training.  
Organizations cite various reasons for adopting cybersecurity management frameworks, from internally motivated expectations of improved cybersecurity or more efficient management of cybersecurity processes to external motivations such as market reputation or governmental regulations [20]. For Norwegian municipalities, there are no direct requirements for the adoption of ISO 27001 or other frameworks. Still, there is a requirement (eForvaltningsforskriften SS15) to establish a quality management system for information security based on recognized standards, and the Norwegian Digitalization Agency recommend ISO 27001 as such a standard [21]. In parallel, the Norwegian National Security Authority publishes their NSM ICT Security Principles [22], a set of security recommendations built around a similar structure as the American NIST Cybersecurity Framework [23], and encourages their use among both private and public organizations. In addition to ISO 27001 and the NSM ICT Security Principles, Norwegian municipalities are all connected to the \"Norsk Helsenett\"--a national service provider for secure connectivity between health and care services and national e-health solutions. Connecting to this network presupposes a contract including requirements for adhering to Norwegian Code of Conduct for Information Security and Data Protection in the Health and Care Sector [24], a governance framework for security and privacy for healthcare organizations in Norway.  
While cybersecurity governance frameworks focus on defining organizational and technical control measures, and on stablishing a systematic approach to managing information security risks, frameworks such as ENISA's Cybersecurity Workforce Framework and the NIST NICE framework focus on the human aspect and aim to standardize and define the knowledge, skills, and competencies required for various cybersecurity roles. While the NIST NICE framework is a US-focused framework that categorizes cybersecurity work into seven categories, 33 specialty areas, and 52 work roles, several of which have a predominantly military focus (including \"force projection\"), the European ENISA framework takes a broader approach, focusing on the competencies needed across various cybersecurity domains. It aims to harmonize cybersecurity education and training across Europe and improve the overall cybersecurity posture of the EU, and defines a set of 12 work profiles with corresponding responsibilities, expected output, and related skills and knowledge requirements.  
While several frameworks are suggested or recommended by directorates and other national-level authorities, there are no formal requirements for their adoption, and no data are available on the rate or quality of framework adoption in Norwegian municipalities. Measuring the actual impact of adopting security frameworks is challenging, with some studies reporting mixed results based on factors such as company size [25], but stakeholders value the effect of adoption as a method to establish and maintain an effective information security management system and as a solid foundation for maintaining security [26].