ISSN: 2226-3624
Open access
The accelerating reliance on digital infrastructure has escalated the urgency for robust cyber risk management within public sector entities, particularly local authorities. These organizations face systemic vulnerabilities, including fragmented security policies, outdated frameworks, inadequate employee training, and a lack of executive commitment. The absence of globally recognized standards, such as ISO/IEC 27001, further compromises their ability to safeguard critical information assets. As digital threats grow in frequency and sophistication, a systematic, comprehensive approach to enterprise risk management is imperative. This study investigates how core organizational factors—specifically cybersecurity policies, continuous training, and leadership commitment—influence cyber risk occurrence and mitigation within Malaysian local authorities. Utilizing a quantitative research design, data was gathered via a structured online questionnaire from 149 respondents, selected through stratified random sampling to ensure balanced representation from operational staff and senior management. The empirical findings reveal that all three organizational factors are significantly correlated with cyber risk mitigation. Crucially, regression analysis identified cybersecurity training as the single most powerful predictor of risk reduction, highlighting human capital development as the cornerstone of digital resilience. Ultimately, this research underscores the necessity of a proactive, holistic cybersecurity strategy, offering vital insights for policymakers and practitioners to fortify public sector governance.
Aliane, N., & Zakariya, A. (2023). Enhancing cyber security resilience in the industrial sector: A comprehensive framework for third-party risk management. International Journal of Cyber Criminology, 17(2), 262–283. https://doi.org/10.5281/zenodo.4766716.
Allens. (2017). Spotlight: Cyber breach at Target. Allens. https://www.allens.com.au/insights-news/insights/2017/09/spotlight-cyber-breach-at-target/
Alshaikh, M. (2020). Developing cybersecurity culture to influence employee compliance behavior. Computers & Security, 98, 101734. https://doi.org/10.1016/j.cose.2020.101734
Alshaikh, M., Maynard, S. B., Ahmad, A., & Chang, S. (2021). Policy communication & employee compliance. Section: Information security policy effectiveness, pp. 1–9. https://doi.org/10.1016/j.cose.2021.102202
Amishav, J. (2024, December 8). Equifax data breach case study: Causes and aftermath. Breachsense. https://www.breachsense.com/blog/equifax-data-breach
Avast Business (2025). City of Atlanta Ransomware Attack. Gen Digital Inc. https://www.avast.com/en-my/business/resources/atlanta-ransomware#pc.
Bada, M., Sasse, A. M., & Nurse, J. R. C. (2019), Human behaviour & cybersecurity policy compliance. Section: Cyber security awareness campaigns, pp. 118–125. https://doi.org/10.1016/j.cose.2019.03.007
Chong, W. F., Feng, R., Hu, H., & Zhang, L. (2025). Cyber risk assessment for capital management. Journal of Risk and Insurance, 92(2), 424–471. https://doi.org/10.1111/jori.12504
Cook, R. D. (1979). Influential observations in linear regression. Journal of the American Statistical Association, 74(365), 169-174. https://doi.org/10.1080/01621459.1979.10481634
Cortina, J. M. (1993). What is coefficient alpha? An examination of theory and applications. Journal of Applied Psychology, 78(1), 98. https://doi.org/10.1037/0021-9010.78.1.98
Cyber Security Agency of Singapore. (2021). Singapore cybersecurity strategy, pp. 18–25.
https://www.csa.gov.sg/Strategy/singapore-cybersecurity-strategy
Cyber Security Agency of Singapore. (2021). The Singapore Cybersecurity Strategy?2021 (Policy document). Government of Singapore. https://www.csa.gov.sg/resources/publications/the-singapore-cybersecurity-strategy-2021/
Daoud, J. I. (2017, December). Multicollinearity and regression analysis. Journal of Physics: Conference Series, 949(1). https://doi.org/10.1088/1742-6596/949/1/012009
Das, K. R., & Imon, A. H. M. R. (2016). A brief review of tests for normality. American Journal of Theoretical and Applied Statistics, 5(1), 5-12. https://doi.org/10.11648/j.ajtas.20160501.12
Equifax Inc. (2017). Equifax announces cybersecurity incident involving consumer information, pp. 4–7.
https://www.equifax.com/personal/education/identity-theft/articles/-/learn/equifax-data-breach/
European Union Agency for Cybersecurity (ENISA),2022. Cybersecurity training, skills development, phishing and credential misuse in public sector organisations. Pages 22–35.
European Union Agency for Cybersecurity. (2026). Cybersecurity certification framework. ENISA. https://www.enisa.europa.eu/topics/product-security-and-certification/cybersecurity-certification-framework
Fabritius, P. (2019). Baltimore ransomware attack costs city over $18 million. Government Technology.
https://www.govtech.com/security/Baltimore-Ransomware-Attack-Costs-City-Over-18M.html
Fabritius, W. (2019). July 25). Ransomware attack shows Baltimore’s lack of organizational resilience. https://www.route-fifty.com/digital-government/2019/07/ransomware-baltimore-organizational-resilience/158314/
Goswami, S. S., Sarkar, S., Gupta, K. K., & Mondal, S. (2023). The role of cyber security in advancing sustainable digitalization: Opportunities and challenges. Journal of Decision Analytics and Intelligent Computing, 3(1), 270–285. https://doi.org/10.31181/jdaic10018122023g
Goswami, S., Dey, S., & Mukherjee, S. (2023). Human factors in cybersecurity risk management: A systematic review. Computers & Security, 124, 102973, pp. 6–12.
https://doi.org/10.1016/j.cose.2022.102973
Gupta, A., & Remella, S. (2025). Building resilience in hybrid cloud systems: Security frameworks for mission?critical applications — A systematic literature review. International Journal of Computer Science and Mobile Computing, 14(9), 52–62. https://doi.org/10.47760/ijcsmc.2025.v14i09.008
Hair, J. F., Hult, G. T. M., Ringle, C. M., Sarstedt, M., & Thiele, K. O. (2017). Mirror, mirror on the wall: A comparative evaluation of composite-based structural equation modeling methods. Journal of the Academy of Marketing Science, 45(5), 616-632. https://doi.org/10.1007/s11747-017-0517-x
Hannigan, R. (2025, December 3). Securing the unseen: The future of supply chain cybersecurity [Keynote presentation]. SANS CyberThreat Summit 2025.
Heal, R., & Twycross, A. (2015). Validity and reliability in quantitative research. Evidence-Based Nursing, 66-67. https://doi.org/10.1136/eb-2015-102129
Herath, T., & Rao, H. R. (2009). Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness. Decision Support Systems, 47(2), 154–165.
https://doi.org/10.1016/j.dss.2009.02.005
Herath, T., & Rao, H. R. (2009). Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness. Decision Support Systems, 47(2), 154–165. https://doi.org/10.1016/j.dss.2008.10.007
Herath, T., & Rao, H. R. (2009). Protection motivation and deterrence: A framework for security policy compliance in organisations. European Journal of Information Systems, 18(2), 106–125. https://doi.org/10.1057/ejis.2009.6 https://www.enisa.europa.eu/publications/cybersecurity-skills-development
https://www.iso.org/standard/27001
InfoMSP. (2025, May 30). Definition of cyber risk management. InfoMSP. https://www.infomsp.com/whatis/definition/cyber-risk-management/
Insurica (2025, April 25). Cyber case study: Colonial Pipeline ransomware attack. Insurica. https://insurica.com/blog/colonial-pipeline-ransomware-attack/
International Organization for Standardization. (2018). ISO/IEC 27005:2018 — Information technology — Security techniques — Information security risk management. ISO, Clauses 6–8.
https://www.iso.org/standard/75281.html
International Organization for Standardization. (2022). ISO/IEC 27001:2022 — Information security management systems — Requirements. https://www.iso.org/standard/27001
ISO/IEC (2022), Information Security Management governance. ISO/IEC 27001:2022 – Clause 5 (Leadership), Clause 6 (Planning), Annex A.5 (Information Security Policies)
Jackson, S. L. (2012). Research methods and statistics: A critical thinking approach (4th ed.). Wadsworth Publishing.
Kenton, W. (2025, October). Durbin Watson Test explained: Understanding autocorrelation in regression analysis. Investopedia. https://www.investopedia.com/terms/d/durbin-watson-statistic.asp
Kline, R. B. (2011). Principles and practice of structural equation modeling (5th ed.). The Guilford Press.
Masson, V. L. (2025, June 26). The magic number: How to optimize and improve your survey response rate. Kantar.
Mohajan, H. K. (2017). Two criteria for good measurements in research: Validity and reliability. Economic Series, 17(4), 59-82.
National Audit Office – NAO (2018), National Health Service – WannaCry ransomware attack, Part Two: Why the attack succeeded, pp. 18–27. https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/
National Audit Office (NAO), United Kingdom, 2018. National Health Service – WannaCry ransomware attack, Staff awareness, outdated training, organisational preparedness, Pages 18–27. https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/
National Audit Office. (2018). Investigation: WannaCry cyber attack and the NHS. https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/
Palo Alto Networks. (2025). What is cybersecurity? Why it matters & core concepts. Palo Alto Networks. https://www.paloaltonetworks.com/cyberpedia/what-is-cyber-security
Parsons, K., McCormac, A., Butavicius, M., Pattinson, M., & Jerram, C. (2017). Human behaviour, phishing awareness, password practices, cybersecurity training effectiveness. Pages 165–172. https://doi.org/10.1016/j.cose.2017.01.002
Ponemon Institute. (2020). Cost of a data breach report 2020 (Research report). IBM Security & Ponemon Institute. https://www.capita.com/sites/g/files/nginej291/files/2020-08/Ponemon-Global-Cost-of-Data-Breach-Study-2020.pd
Puhakainen, P., & Siponen, M. (2010). Improving employees’ compliance through information systems security training: An action research study. MIS Quarterly, 34(4), 757–778.
https://doi.org/10.2307/25750704
Puhakainen, P., & Siponen, M. T. (2010). Improving employees’ compliance through information systems security training: An action research study. MIS Quarterly, 34(4), 757–778. https://doi.org/10.2307/25750704
Rapid7 (2017, Dec 14). Introduction to ISO/IEC 27035 - Planning for and Detection of Incidents. https://www.rapid7.com/blog/post/2017/04/20/introduction-to-isoiec-27035-planning-for-and-detection-of-incidents/
Saccenti, E., Hendriks, M. H., & Smilde, A. K. (2020). Corruption of the Pearson correlation coefficient by measurement error and its estimation, bias, and correction under different error models. Scientific Reports, 10(1), 438. https://doi.org/10.1038/s41598-019-57247-4
Saini, D., & Raman, N. (2025). A case study of the 2007 attack on Estonia. International Journal of Creative Research Thoughts, 13(4), a32–a36.
Sarumi, A. O., & Abdul-Raheem, I. (2022). Leadership commitment and cybersecurity governance in public organizations. Journal of Information Security and Applications, 67, 103176, pp. 5–9.
https://doi.org/10.1016/j.jisa.2022.103176
Sarumi, J., & Abdul-Raheem, I. (2022). Ethical hacking and cyber security in Nigerian telecommunication industry. Advances in Multidisciplinary & Scientific Research Journal Publication, 10(1), 1–36.
Schmitt, N. (1996). Uses and abuses of coefficient alpha. Psychological Assessment, 8(4), 350. https://doi.org/10.1037/1040-3590.8.4.350
Siponen, M., & Willison, R. (2009). Information security management standards: Problems and solutions. Information & Management, 46(5), 267–270. https://doi.org/10.1016/j.im.2008.12.007
Traynor, O. (2025, March 24). NIST Cybersecurity Framework 2.0: An Overview. https://cybelangel.com/blog/guide_nist_2/
U.S. Department of Justice (DOJ), 2018. City of Atlanta ransomware attack / Employee preparedness, cybersecurity training gaps, incident escalation, Pages 4–9. https://www.justice.gov/criminal-ccips/file/1096976/download
U.S. Government Accountability Office – GAO (2021). SolarWinds supply-chain cyberattack. GAO-21-105325, pp. 9–18 (Root causes & governance gaps). https://www.gao.gov/products/gao-21-105325
U.S. House Committee on Oversight and Reform. (2018). The Equifax data breach (Majority staff report). https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
United Nations Department of Economic and Social Affairs. (2022). United Nations E?Government Survey 2022: The future of digital government (Report). United Nations. https://unpan.un.org/sites/unpan.org/files/Full%20report%20and%20annexes%20%28English%29.pdf
von Solms, R. & van Niekerk, J. (2013), Cybersecurity governance framework. Section: From information security to cyber security (pp. 97–102, Computers & Security, Vol. 38). https://doi.org/10.1016/j.cose.2013.04.004
Paino, H., & Rahmat, M. B. (2026). The Architecture of Vulnerability: How Organizational Dynamics Drive Cyber Risk. International Journal of Academic Research in Economics and Management Sciences, 15(3), 36–54.
Copyright: © 2026 The Author(s)
Published by HRMARS (www.hrmars.com)
This article is published under the Creative Commons Attribution (CC BY 4.0) license. Anyone may reproduce, distribute, translate and create derivative works of this article (for both commercial and non-commercial purposes), subject to full attribution to the original publication and authors. The full terms of this license may be seen at: http://creativecommons.org/licences/by/4.0/legalcode