CYBERSECURITY IN MUNICIPAL ADMINISTRATIONS – RISKS, VULNERABILITIES AND OPPORTUNITIES FOR INCREASING RESILIENCE: CYBERSECURITY IN MUNICIPAL ADMINISTRATIONS – RISKS, VULNERABILITIES AND OPPORTUNITIES FOR INCREASING RESILIENCE

Iliana Simeonova

doi:10.46687/jsar.v31i1.497

Authors

Iliana Simeonova Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: i.simeonova@shu.bg

DOI:

https://doi.org/10.46687/jsar.v31i1.497

Keywords:

Cybersecurity, Municipal administration, Cyber risks, Cyber threats, Vulnerabilities, Cyber resilience, Information security, Risk management, Human factor, Model 5K

Abstract

This paper examines cybersecurity in municipal administrations as a key component of administrative security and sustainable functioning of public services. The main cyber threats, vulnerabilities and factors affecting the level of protection of information resources are analyzed. Emphasis is placed on the management and assessment of cyber risk, the protection of critical information assets and the role of the human factor. An author's Model 5K for municipal cyber resilience has been developed, combining identification, assessment, protection, monitoring and resilience. The proposed approaches are aimed at incident prevention, effective response and restoration of municipal information systems and services.

Author Biography

Iliana Simeonova, Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: i.simeonova@shu.bg

Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: i.simeonova@shu.bg

References

Cybersecurity Act. Promulgated SG No. 94 of 13.11.2018, with subsequent amendments and supplements.

Law on Amendment and Supplement to the Cybersecurity Act. State Gazette, No. 17 of 13.02.2026.

Electronic Government Act. Promulgated SG No. 46 of 12.06.2007, with subsequent amendments and supplements.

Personal Data Protection Act. Promulgated SG No. 1 of 04.01.2002, with subsequent amendments and supplements.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR).

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS2 Directive).

European Union Agency for Cybersecurity (ENISA). ENISA Threat Landscape 2025. European Union Agency for Cybersecurity, 2025.

European Union Agency for Cybersecurity (ENISA). ENISA Sectorial Threat Landscape: Public Administration 2024. European Union Agency for Cybersecurity, 2025. The report analyses 586 publicly reported cyber incidents in public administration in 2024 and identifies public administration as one of the most heavily attacked sectors in the EU.

European Union Agency for Cybersecurity (ENISA). NIS360 2024. European Union Agency for Cybersecurity, 2024.

European Union Agency for Cybersecurity (ENISA). Cybersecurity Guidelines for SMEs. European Union Agency for Cybersecurity.

Schmidt, J. M., Mahula, S., & Crompvoets, J. (2025). Lessons Learned for Local Cybersecurity: Practical Implications of a Public Sector Cyberattack for Small and Medium-Sized Municipalities. Conference on Digital Government Research. DOI: 10.59490/dgo.2025.994. The study is particularly relevant to this topic, as it examines the practical consequences of a ransomware attack against an IT provider serving more than 70 municipalities and highlights the importance of network segmentation, monitoring and two-factor authentication.

Andress, J. (2019). The Basics of Information Security: Understanding the Fundamentals of InfoSec in Theory and Practice. 3rd ed. Syngress.

Whitman, M. E., & Mattord, H. J. (2021). Principles of Information Security. 7th ed. Cengage.

Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice. 4th ed. Pearson.

Krebs, R. (2021). Cybersecurity: A Practical Approach. Wiley.

International Organization for Standardization (ISO). (2022). ISO/IEC 27001:2022 – Information security, cybersecurity and privacy protection – Information security management systems – Requirements.

International Organization for Standardization (ISO). (2022). ISO/IEC 27002:2022 – Information security, cybersecurity and privacy protection – Information security controls.

National Institute of Standards and Technology (NIST). (2018). Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1. Gaithersburg: NIST.

National Institute of Standards and Technology (NIST). (2024). The NIST Cybersecurity Framework (CSF) 2.0. Gaithersburg: National Institute of Standards and Technology.

Tasinov, T. Y., Toncheva, S. K. Anticipatory Technological Preparation and Digital Health Competencies in Nursing and Midwifery Education. In: Conference Proceedings, XIX National Forum of Health Care Specialists and Poster Session for Students „Fair Access to Quality Health Care“, Shumen, 24–25 October 2025, pp. 97–103.

CYBERSECURITY IN MUNICIPAL ADMINISTRATIONS – RISKS, VULNERABILITIES AND OPPORTUNITIES FOR INCREASING RESILIENCE