# Local Government Cybersecurity Landscape: A Systematic Review and Conceptual Framework
## 5 Findings and Discussion
### The Framework: Key Components and Limitations in the Existing Literature
#### 5.2.4 Challenges and Recommendations  
(a) Resource and Infrastructure Issues: Researchers have identified resource limitations, particularly in terms of budgetary allocations, as a major obstacle to the advancement of cybersecurity within local governments [8; 47]. The irregular reporting of breaches and misconceptions that these smaller governmental entities are less vulnerable undermine cybersecurity prioritization in local governments [19]. The budget limitations in local governments have cascading effects, restricting experts' recruitment, infrastructure improvement, and the skill development of current employers [63; 117; 125]. Consolidating IT networks in local governments can reduce complexity and streamline cybersecurity measures [7; 77; 112]. The security landscape has evolved, necessitating changes in the authentication systems [92]. Implementing multifactor authentication and a 'zero trust' approach can reduce unauthorized access risk [12]. Despite the initial costs and transition challenges, this approach is highly recommended by researchers for long-term cybersecurity benefits, especially considering the rapid increase in IoT device usage and transformation into smart cities [85; 106]. Maintaining hardware and software inventories is also crucial for endpoint and application security [14; 90]. Al can be a valuable tool for local governments to protect their cybersecurity, as its machine-learning algorithms can identify complex attacks which conventional systems may fail to detect [3; 48; 126; 127]. However, research on AI's potential in detecting and preventing cyber-attacks in smart cities is limited due to its emerging nature [124]. Researchers have indicated that local governments have a shortage of specialized cybersecurity professionals due to budget constraints and improper knowledge of its significance among decision-makers [7; 63]. This shortfall limits the swift identification, response, and recovery from cyber-attacks. To address this issue, local governments can collaborate and partner with state or central governments and private sector companies to access affordable security solutions [9; 54; 128]. Researchers and experts in the field also recommend unconventional strategies like outsourcing cybersecurity to specialized contractors and cybersecurity insurance, and collecting community and expert feedback to develop targeted cybersecurity strategies [11; 15; 60]. Budget constraints also prevent local governments from investing in R&D for cybersecurity improvements [77]. However, R&D is vital for conducting thorough risk assessments, analyzing past cyber incidents, developing new security protocols, and staying informed about emerging threats [47; 78]. But R&D is usually expensive and can be a daunting task for smaller local governments. Cost-effective strategies such as partnerships with academic institutions and inter-governmental cybersecurity agencies, hosting hackathons, and small-scale pilot projects can be effective alternatives to R&D for local governments with limited financial resources [49; 64; 129]. (b) Policy and Regulatory Issues: Researchers frequently cited the lack of comprehensive cybersecurity policies as a critical gap in local governments' cybersecurity preparedness [77; 83; 128]. [PERSON], [PERSON], and [PERSON] [53] identified regulatory oversight and a lack of enforcement as crucial challenges for local governments. A lack of visibility and influence can lead to a disconnect between policy formulation and implementation, resulting in insufficient resource allocation and attention to cybersecurity matters [11; 18]. The lack of political and bureaucratic support also hinders the development and enforcement of effective cybersecurity measures [86]. To tackle these challenges, it is crucial to emphasize cybersecurity governance, establish a clear regulatory framework, and gain support from political, bureaucratic, and executive leaders [14; 53; 80].