# From Security Frameworks to Sustainable Municipal Cybersecurity Capabilities
## 4 Results
### Results from Card-Sorting Activity--Forming Capabilities  
As a result of the modified Delphi card-sorting study, the contributors sorted the tasks into six capabilities, as shown in Figure 5--a screenshot from the tool developed for the modified Delphi study [12]. As illustrated in the figure, the majority of tasks were placed in two capabilities--_Secure Operations_ and _Goverance, Risk, and Compliance_. During the sorting, contributors identified the tasks under _Secure Operations_ as tasks normally managed by the municipality's standard IT operations, such as access management, backup and recovery procedures, monitoring capacity, and secure configuration of systems. The _Goverance, Risk, and Compliance_ capability consisted of tasks where many of the contributors have their main responsibilities, sometimes as a sole responsible or in cooperation with a few other resources. It contains tasks related to security governance, such as policy development and maintenance, strategic threat analysis, audit and review of compliance, and security awareness.  
_Security Operations_ was identified as a distinct capability, encompassing operational tasks related to detecting and responding to security incidents and managing the associated tools, notably SIEM (Security Incident and Event Management) detection rules, vulnerability scanning and reporting, and forensic analysis. As discussed in the chapter on structure, this capability varies in maturity and approach among municipalities; some have outsourced this capability, others maintain internal capabilities, while still others incorporate these tasks into their IT operations.  
The contributors also identified a set of tasks attributed to _System Ownership_--tasks related to system access management and review, managing supplier risk and compliance,and critical dependencies. These tasks were reported to be responsibilities of system owners in the functional areas (education, healthcare, municipal operations such as water and sewage, etc.). As will be discussed in the chapter on structure, while this responsibility is formally defined, contributors voiced concerns about the practical ability of the functional areas to perform these tasks, as well as the ability of central services, such as the security operations and governance capabilities, to support the functional areas in this.  
Only the larger municipalities are conducting internal software development--activities related to this were identified under the _Development_ capability--and contributors reported a limited maturity of this security capability, with resources mainly connected to the Governance, Risk, and Compliance (GRC) capability offering some support for secure development activities, mostly on an ad hoc basis. Finally, _Penetration Testing_ was identified as a separate activity and capability, primarily because this activity is mainly delivered by external specialized competence. Activities around advanced forensic analysis and critical incident management were also considered as possible candidates for external delivery by several contributors.  
In some cases, a task that could only be placed in one category led to a discussion on where to categorize the task--an example would be an activity such as \"Regularly review granted access approvals\", where the practical work of reviewing access rights is performed in the business units, but central IT is responsible for tools and processes to support the activity. In these cases, the task was generally placed where the process responsibility is placed. From the discussion, it was clear that many of these tasks were tasks that were or could be supported by technology that supports task distribution, for example identity and  
Figure 5: Identified capabilities.  
access management (IAM) tools that allows for central governance, but distributed task execution, of access management decisions.