Mapping the Landscape of State-Level Cybersecurity Planning: An Analysis of 50 U.S. States from 2015 to 2021

Abstract

The cybersecurity planning landscape across U.S. state governments is both critically important and surprisingly understudied. This article provides a systematic document-based comparative analysis of publicly available cybersecurity planning materials across all 50 U.S. states. It evaluates against a unified framework of eight best-practice themes: training, partnership, coordination and communication, developing awareness and culture, better equipment, leadership, funding, and national security. Using publicly accessible state cybersecurity planning documents collected as of December 2021, this study categorizes states into four archetypes (high, moderate, low, and minimal) based on the depth and comprehensiveness of their planning documents. The findings reveal striking structural heterogeneity across states, significant gaps in the coverage of critical themes, including leadership and funding, and a null relationship between political culture and the comprehensiveness of publicly available plans. The article concludes with policy implications for federal intergovernmental coordination and the future of national cybersecurity infrastructure.