# A Country Risk Assessment from the Perspective of Cybersecurity in Local Entities
## 1 Introduction
Entities with limited budgets are particularly vulnerable to risks [21]. The primary recommendations are capacity building and leadership in establishing shared protection strategies [22]. This is based on a survey of CISOs from a cohort of 14 local governments in the United States. In the current globalized environment, where threats transcend geographical boundaries, the establishment of a unified legislative framework is crucial for ensuring interoperability and a common level of protection. In Europe, the EU Cybersecurity Regulation [23] established a high level of cybersecurity, cyber resilience and trust and created the European Union Agency for Cybersecurity--ENISA and a cybersecurity certification framework for products and services [24]. This is a mandatory and directly applicable regulation in the Member States. The NIS2 Directive 2022/2555 [25] requires Member States to develop and implement national cybersecurity strategies, identify relevant competent authorities, establish crisis management authorities and single points of contact on cybersecurity, and correspond with security incident response teams (CSIRTs) and sanction regimes at the directive level (C-Level). This is a mandatory requirement, but the initiative must be transposed into national legislation. Article 5 of the Directive indicates that it is at the discretion of the Member States to determine whether to apply it to Local Public Administration entities (municipalities and town councils) or to educational establishments engaged in critical research activities. It may appear contradictory that the Directive excludes all local public entities. The number of local authorities is, in fact, two orders of magnitude larger than that of the remainder of public bodies. This will result in a differentiated approach to the implementation of protection measures, with local, regional and state public entities progressing at varying speeds. Given that local entities represent the weakest link in the NIS2, it is essential to conduct at least a state-level assessment to obtain an accurate understanding of the current situation at the national level. The implementation of security frameworks enables organizations to prioritize resilience actions in the event of an incident (Table 1). The CIS security framework developed by the Center for Internet Security [26], the NIST-800-53 standard set by the National Institute of Standards and Technology [27], the PCI-DSS standard set by the credit card payment industry [28] and the ISO/IEC 27001 standard for \"Information Security, Cybersecurity and Privacy Protection\" [29] represent some of the most well-known and widely adopted cybersecurity standards in existence today. All these frameworks permit the establishment of a variety of security and privacy controls, thereby enabling the degree of cybersecurity maturity to be determined and comparisons to be made with other sectors. Even conceptual frameworks have been developed with the intention of simplifying the complexity of cybersecurity in a local government context by organizing and facilitating the key components [15]. However, implementation is not straightforward and requires significant effort initially, particularly due to technological and organizational challenges or the competitive pressure within the sector [30]. It can be observed that there is a considerable number of entities that will not be monitored by the NIS2 Directive, and that unified cybersecurity criteria will not be established. The utilization of a cybersecurity framework facilitates the identification of the security posture and the implementation of controls for continuous improvement; however, the practical implementation of such a framework in all local public entities is challenging. The aim of this study was to analyze the security of the Internet-exposed services of all municipalities in a country, using a simplified and scalable security framework called _CIORank_[31].