# Local Government Cybersecurity Landscape: A Systematic Review and Conceptual Framework
## 5 Findings and Discussion
### The Framework: Key Components and Limitations in the Existing Literature
#### 5.2.3 Assessment Frameworks and Standards  
The existing literature on cybersecurity for local governments predominantly cites only a few frameworks and standards, including NIST, ISO/IEC 27001:2013, COBIT5, ISA 62443-2-1:2009, and ISA 62443-3-3:2013 [12; 25; 36; 55; 114]. NIST is known for its comprehensive cybersecurity guidelines, while ISO/IEC 27001:2013 provides the requirements for ISMS. COBIT5 is a governance framework for enterprise IT, emphasizing regulatory compliance, risk management, and aligning IT strategy with organizational goals. ISA 62443-2-1:2009 and ISA 62443-3-3:2013 focus on the security of Industrial Automation and Control Systems, providing a systematic approach to reducing cybersecurity risks in industrial operational environments. Although these frameworks and standards are useful, the current literature shows a lack of comprehensive coverage of cybersecurity frameworks and tools. It is worth noting that the updated NIST framework, NIST CSF 2.0 (Draft), which represents a substantial advancement over its predecessor [115], is not mentioned in the existing literature in this research domain. The framework now includes a sixth function, the govern function, which covers how an organization can make and execute its own internal decisions to support its cybersecurity strategy [116]. The draft provides improved guidance for implementation, focusing on situation-specific profiles and providing examples for subcategories. According to the NIST website, the final version is set to be released in early 2024 [115]. The Centre for Internet Security (CIS) Controls is a framework that provides a collection of practical measures for protecting against cyberthreats, offering a structured approach to enhancing an organization's cybersecurity position [114; 117]. The General Data Protection Regulation (GDPR), while being primarily a regulatory standard for the European Union, establishes a model for data protection and privacy that can be used as a reference for local governments worldwide [118]. The Cybersecurity Maturity Model Certification (CMMC) is an emerging framework designed to strengthen cybersecurity measures in the defense industrial base [89; 119]. Although originally designed for defense contractors, local governments can use the principles and practices of CMMC to enhance their defense measures [120; 121]. Local governments may also consider frameworks such as the IT Infrastructure Library (ITIL), which emphasizes the synchronization of IT services with business requirements [89; 122; 123]. In addition to the aforementioned frameworks and standards, various countries and organizations have prepared their own frameworks and standards. Examples include the New Zealand Information Security Manual (NZISM) and the New York Department of Financial Services Cybersecurity Regulation, the Standard Nasional Indonesia (SNI), China's National Standard, Australia's Essential Eight, and the USA General Service Administration's Federal Risk and Authorization Management Program (FedRAMP) [124]. The NZISM is the government cybersecurity standard in New Zealand, providing guidelines for agencies to protect their digital information and assets. It covers access control and incident management, focusing on sensitive government data, and is issued by the Government Communications Security Bureau of New Zealand. The SNI is Indonesia's national cybersecurity standard, aimed at ensuring the quality and safety of products and services, including IT and cybersecurity. It provides guidelines and best practices for Indonesian organizations to ensure robust and effective cybersecurity measures against regional and global threats. The National Standard of the People's Republic of China (GB/T 22239-2019) is the national cybersecurity framework, encompassing regulations on data protection, Internet services, and network infrastructure [124]. These standards are crucial in shaping the implementation of cybersecurity by organizations operating within China's borders, given its unique regulatory environment.