Adapting the RCA-50 Cyber Readiness Assessment Framework for Government and Public Sector Organizations

Abstract Government and public sector organizations face increasing cybersecurity threats while operating under complex governance structures, constrained budgets, and diverse mission requirements. Although comprehensive cybersecurity frameworks exist, their practical application within local, state, and public-sector environments is often hindered by resource limitations, fragmented responsibility, and the need for executive-level clarity. Building on the RCA-50 Cyber Readiness Assessment Framework, this paper examines the adaptation and applicability of RCA-50 in government and public-sector contexts. The study demonstrates how RCA-50’s domain-based structure and standardized indicators can support cyber readiness evaluation, cross-agency comparability, and policy-aligned decision-making without imposing compliance-heavy or audit-centric burdens. The paper positions RCA-50 as a practical readiness assessment tool that supports public sector governance, risk prioritization, and national-scale adoption.