# From Security Frameworks to Sustainable Municipal Cybersecurity Capabilities
## 2 Background and Literature
### Introducing Socio-Technical Cybersecurity Capabilities  
Cybersecurity frameworks provide a why and how to implement cybersecurity requirements and practices but lack organizational adaptation and a practical focus on organizational capacity and ability to execute these practices, especially in resource-constrained organizations such as municipalities. Enterprise Architecture (EA) can provide an approach to bridging this gap between theory and practice. EA, fundamentally concerned with the design and management of an organization's structure and operations, particularly the strategic alignment of IT with business objectives [38], offers a capability-centric approach. Enterprise architecture is typically arranged around a baseline architecture (today), a target architecture (where the business wants to be), and a sequencing plan for moving from the baseline to the target architecture [39]. EA methodologies employ business capability maps [40] as a tool for strategic planning, change management, and prioritization, designed to optimize fragmented processes and enhance organizational agility [38; 39]. The concept of \"capabilities\", though debated in definition [41], is described in the Enterprise Architecture standard TOGAF [8] as \"a particular ability or capacity that a business may possess or exchange to achieve a specific purpose or outcome.\" While business capabilities focus on what the organization does, rather than how, the capability is, in the TOGAF methodology, realized through the integrated deployment of people, processes, information, and resources (such as technology as well as physical and intangible assets). As such, the EA understanding of capabilities integrates well with the socio-technical approach of the Leavitt diamond model by emphasizing the importance of the alignment and mutual reinforcement of technological, strategic, and human for organizational task/process performance. By framing cybersecurity through the lens of socio-technical capabilities, it allows moving beyond a purely framework-driven or technology-centric approach, towards a more holistic understanding of organizational cybersecurity capacity. This shift in perspective--from viewing cybersecurity as adherence to frameworks to building demonstrable capabilities--allows for moving beyond simply assessing compliance and instead focusing on understanding and developing the inherent organizational capacity to perform necessary cybersecurity tasks effectively and sustainably. This capability-based approach, grounded in EA principles and the socio-technical insights of Leavitt's diamond, offers a more robust and practically relevant approach to analyzing the current state of municipal cybersecurity. It also provides a strategic foundation for discussing necessary changes in how these capabilities are developed--whether internally or through ecosystem integrations like managed services, inter-municipal cooperation, or national-level resources [42; 43]. Building on the Leavitt diamond model we define _sustainable socio-technical cybersecurity capabilities_ as \"a sustainable capacity of coordinated technological and human resources in an organizational structure arranged to perform cybersecurity tasks in order to defend the organization against cybersecurity attacks and incidents\". By sustainable we imply the ability to adapt to changes in personnel, technology, and the threat landscape, ensuring the municipality's ongoing capacity to address cybersecurity challenges. While existing research emphasizes the importance of cybersecurity frameworks and standards, there is limited empirical research on how these frameworks are translated into operational capabilities within resource-constrained organizations, particularly municipalities.