CyberSim & Take9: Digital Security Survey

The National Civic League is excited to launch CyberSim and Take9 for Civic Digital Resilience, a new national initiative in partnership with craig newmark philanthropies and Aspen Digital at the Aspen Institute. Through immersive cybersecurity simulations, local governments and civic leaders will build the skills, partnerships, and awareness needed to protect critical community infrastructure.

As we begin this work, we’re launching a short baseline survey to help us tailor these interactive simulations to the challenges communities are facing. Take this quick survey to help us better understand:

The digital security threats local governments are encountering
Local government capacity to prevent and respond to cyber incidents
The types and effectiveness of cybersecurity trainings being offered to local governments
How individuals prefer to learn about digital security

1.Which of the following best describes your role in your local government? (Select one)

Other (please specify)

2.Which of the following do you consider the GREATEST cybersecurity threat facing local governments and municipalities today? (SELECT ONE)

Attacks that lock critical city systems (e.g., 911 dispatch, water utilities)

Attacks on election infrastructure (by either foreign or domestic actors)

Data breaches exposing residents' personal and financial information

Insider threats from government employees or contractors with malicious intent

Other (please specify)

3.How prepared do you believe your local government is to defend against a significant cyberattack? (SELECT ONE)

Very prepared — we have strong, visible cybersecurity policies and resources

Somewhat prepared — we have basic defenses but room for improvement

Not very prepared — I have seen little evidence of robust digital security measures

I don't have enough information to assess our preparedness

4.What factors do you think affect local government employees in terms of adhering to established cybersecurity policies and best practices? (SELECT ALL THAT APPLY)

Lack of enforcement by management or IT, leading to staff complacency

Policies are too complicated or are perceived to be irrelevant

Lack of training for staff on policies

No incentive to follow or adhere to them

Not applicable - I don’t see gaps between policy and practice.

Other (please specify)

5.Do elected local government officials receive formal digital security training? (SELECT ONE)

Yes, all elected officials receive mandatory training

Yes, but it is optional/voluntary

Some do, but it varies by department or role

No, there is no formal training for elected officials

I'm not sure / I don't know

6.Does your workplace have any restrictions on you accessing work accounts from personal devices (e.g. laptops, mobiles)? (SELECT ONE)

Yes, we are prohibited from using personal devices to access any work-related accounts (e.g. technical restrictions or authentication requirements may prevent access from personal devices)

Yes, there is a policy against using personal devices, but it is not enforced

There are no restrictions on using personal devices to access work-related accounts

I'm not sure / I don't know

7.Did you receive cybersecurity training as part of your onboarding process? (SELECT ONE)

Yes, I completed a required cybersecurity training (e.g., structured course, video modules, and/or quiz)

Yes, cybersecurity was covered in a meeting or orientation session, but I did not complete a formal training course

No formal training, but I was provided written materials, policies, or resources to review

No, cybersecurity was not addressed during onboarding

I don't recall

8.Have you had to undergo any form of cybersecurity training (in-person, virtual) at least once a year? (SELECT ONE)

Yes, at least once a year — it is required

Yes, at least once a year — but it is voluntary

No, training happens less frequently than once a year

No, I have never received cybersecurity training in this role

I'm not sure / I don't recall/ I have spent less than a year at this organization

9.If yes, how effective do you feel it was in improving your overall awareness about cybersecurity threats? (SELECT ONE)

Very effective - I came away with new knowledge and skills I actively use

Somewhat effective - I learned a few useful things but much of it felt surface-level

Neutral - I completed it but don't feel it changed my behavior or awareness

Somewhat ineffective - the content felt outdated, irrelevant, or too generic

Very ineffective - it felt like a box-checking exercise with little real value

I'm not sure / I don't recall

Not applicable - I didn't receive cybersecurity training

10.How can local governments help their employees improve their digital security awareness to reduce likelihood of cyber incidents? (SELECT TOP THREE)

Provide regular, mandatory cybersecurity training (at least annually)

Conduct simulation exercises to test and build awareness with colleagues

Implement role-specific training rather than one-size-fits-all

Ensure there is a clear and easy process in place for reporting suspicious activity or other cyber-related incidents

Improve documentation and resources on digital security best practices

Bring in external cybersecurity experts for workshops or seminars

Other (please specify)

11.What would be the most effective methods for you to learn about digital security in the workplace? (SELECT ALL THAT APPLY)

Short, self-paced online modules I can complete on my own schedule

Live in-person workshops or training/awareness sessions

Live virtual sessions (e.g. webinars or video calls)

Simulated real-world exercises (e.g. table top exercises)

Short video content available on-demand (e.g. explainer videos or recorded demonstrations)

One-on-one or small group coaching

Gamified learning (e.g. quizzes, competitions, or point-based challenges)

Other (please specify)

12.Do you engage in any of the following cybersecurity practices consistently (daily, weekly or monthly)? (SELECT ALL THAT APPLY)

Take a short pause before clicking links or downloading files to assess the legitimacy of the source

Restart devices

Automated or frequent software updates

Report phishing attempts

Use a password manager with strong and unique passwords

Use double authentication

Other (please specify)

13.Provide your email below if you’d like to join a focus group on digital security or learn how your community could be selected as a pilot site for a free in-person CyberSim simulation.