Where Is Cybersecurity? An Analysis of U.S. State Hazard Mitigation and Emergency Plans

Abstract

Despite the growing convergence of physical and cyber risks, U.S. state disaster planning remains uneven in its treatment of cybersecurity threats. While federal guidance promotes an all-hazards approach to preparedness, the extent to which state-level hazard mitigation and emergency plans address cyber risks has not been systematically characterized. We present a national assessment of cybersecurity content in State Hazard Mitigation Plans (SHMPs: all 50 states) and State Emergency Plans (SEPs: 45 states). Using content analysis, we examine cyber risk framing, coverage across the emergency management cycle, and governance mechanisms (responsibilities, standards, detection, reporting). Although many plans reference cybersecurity, coverage varies widely and is often limited for recovery/continuity, threat detection, and procedural reporting guidance. SHMPs emphasize risk identification and mitigation, while SEPs emphasize agency roles and response coordination. We discuss implications for cyber crisis governance and identify practical priorities for strengthening state planning and supporting more coordinated cyber disaster readiness.