# From Security Frameworks to Sustainable Municipal Cybersecurity Capabilities
## 4 Results
### Cooperation Strategies  
Given the size and structure of municipalities, as well as the challenges in developing sufficiently sustainable capabilities, cooperation has emerged as a common theme and a potential strategy to address individual weaknesses. In the municipal context, cooperation is a multi-level strategy that can occur both internally within the organization and externally, operating on operational, tactical, and strategic levels. This cooperation may be both formal and informal, inter-organizational or peer-to-peer on an individual level--Table 2 shows some reported types of external cooperation. The cybersecurity domain is becoming more regulated, with new legal frameworks such as GDPR, NIS2, as well as smaller domain-specific national regulations. The municipalities have different approaches to the process of keeping up with changes to regulations. While some have support from internal legal resources, others draw on active participation in professional security associations and membership associations as a way to both be updated and participate in discussions and provide feedback on hearings of new legislation and regulations. A practice that has been adopted in some instances to compensate for the lack of sufficient skilled resources is developing shared risk assessments for common applications and ICT services. In these instances, projects with participants, either consultants or available resources from municipalities, are assembled in a shared project to develop generic risk assessments for municipalities. The stated intention is often to ease and speed up the adoption of new solutions. Sharing of risk assessments between municipalities has also been encouraged, but some contributors shared a concern that municipalities with insufficient resources and skills would be unable to adapt these risk assessments to their own technical and organizational security controls. This was perceived as a risk of \"ticking a checkbox\" for performing a risk assessment without actually assessing risk and potentially adapting their security controls based on the risk assessment. \begin{table}
\begin{tabular}{c c} \hline \hline
**Formal** & **Informal** \\ \hline IKSs, intercommunale selskaper (inter-municipal enterprises), or formalized inter-municipal cooperations & Membership organizations, particularly Foreningen \\ May provide whole or parts of several cybersecurity capabilities, and general ICT operations services and infrastructure. & Komumal Informasjonsikkerhet -KüNS, Forum for \\ \hline Utilization of shared services from KS or government (DigDir) & Mainly individual-level membership organizations for security and privacy. \\ Provides specific shared services, such as ID-Porten for authentication of citizens, electronic signature, citizen communication, etc. & CTF competitions \\ Municipalities are to a large extent free to choose to & Participation in CTF competitions, mainly \\ implement these or other services. & individual-level participation. \\ \hline Helse-og KommuncCERT & \\ \hline Managed security service providers & \\ Providing outsourced SOC services. & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: External cooperation in municipal cybersecurity. The municipalities also have several vendors in common that deliver ICT solutions in specialized areas like healthcare, water supply, and education. Supply chain and vendor cybersecurity management is seen as a challenge but also as an opportunity for cooperation--by sharing results or by running audits cooperatively, fewer resources would be used both on the supplier and customer side. However, such an arrangement would require some form of formal establishment of structures and financial support to keep the work going--the cooperation has so far been arranged through temporary structures.