Cybersecurity Practices for E-Government: An Assessment in Bhutan

The main goal of e-government implementation is to improve the effectiveness, efficiency and quality of public service delivery using Information and Communication Technologies (ICT). However, its success is dependent on the provision of information security goals such as confidentiality, integrity, availability and trust. Therefore, cybersecurity is vital for the successful adoption of e-government systems. This paper presents an assessment of cybersecurity practices, cyber threats and other factors affecting effective implementation of cybersecurity program in government organizations in Bhutan. Selected cybersecurity practices included in the study were cyber policy, risk management, training and awareness, and access controls for protection of network including mobile computing devices. Out of 280 potential respondents, 157 respondents completed the survey. The results show that, in many organizations, there is very limited use of or a lack of formal cybersecurity policy, risk management, awareness, or incident management practices. The results also indicate that many organizations have either suffered from, or been affected by, cybersecurity threats such as malware, hacking and phishing scams. The study recommends both managerial and technological practices to improve cybersecurity posture of government organizations and to improve people’s level of trust and confidence in e-government services. Keywords—cybersecurity; cybersecurity policy; risk management; awareness and training; cyber threats; egovernment;