Building cyber resilience in a digitalizing state: Kazakhstan’s evolving national security architecture

1 Introduction

The rapid spread of digital technology in particular has changed the face of national security in the 21st century. Governments are now dependent on connected information systems, cloud systems, digital public services, artificial intelligence systems, and communication networks to deliver public services and economic development. Digital transformation is a revolution in management efficiency, transparency, and citizen engagement, and there are many opportunities to become efficient, transparent, and citizen-friendly, but it also creates new risks with cyberattacks, data leaks, operational disruptions (cyberattacks, data theft, etc.), and security threats to critical infrastructure.

As states become more dependent on digital ecosystems, cybersecurity has become more than technical and has become a key part of national security (Clarke and Knake, 2010). Up to now, cyber threats have been able to disrupt critical government functions, damage critical infrastructure, damage public trust, and have a cascading effect on all related sectors. As a result, the ability of states to prevent cyberattacks as well as to recover from them and adapt to new threats is becoming more crucial.

This has led to the rise of cyber resilience. As opposed to traditional cybersecurity, which primarily focuses on protecting information assets from unauthorized access or disruption, cyber resilience is about continuity, recovery, adaptation, and learning (Dunn Cavelty, 2014). It is a recognition that cyber incidents cannot be halted completely and that modern governance systems must be able to handle the continued threat of digital attacks.

Kazakhstan is an exceptional case study in this regard, and it is at the center of the digital transformation of the country but also the cybersecurity governance and cyber resilience. Since the past decade, it has introduced big digitalization initiatives in the form of e-government systems, integrated state databases, digital identification systems, smart city projects, and artificial intelligence programs. These digitalization efforts have significantly expanded the digital footprint of public administration and have positioned Kazakhstan as one of the leading digitalizing countries in Central Asia.

At the same time, increasing digital dependency has also opened the door to a multitude of cybersecurity challenges. The cyber threats to the government information system, critical infrastructure, personal data, telecommunications networks, industrial systems, and so on are growing more and more sophisticated and potentially disruptive. Kazakhstan has gradually developed a national cybersecurity architecture through the use of strategic documents, institutional reforms, operational mechanisms, technical standards, and regulatory instruments.

In 2017, the concept of Cybersecurity, Cyber Shield of Kazakhstan, became the central pillar of national cybersecurity governance. A series of policy ideas, including Digital Transformation, Cybersecurity for 2023–2029, which put cybersecurity in the context of digital development, was introduced in the framework of Security by the Information and Communication Technology Industry and Cybersecurity for 2020.

More recently, the implementation of national cybersecurity standards, personal data security, and AI issues have also intensified the importance of cyber resilience in Kazakhstan’s security agenda.

Despite the growing interest in cybersecurity and resilience in the field, some gaps are still present in the existing literature. The majority of research on cybersecurity is in technical systems and organizational practices or sectors. In contrast to this, few researchers have investigated cyber resilience as a part of national governance and public policy. Most of the existing research has focused on technologically advanced countries with good cybersecurity infrastructure, where the evolution of cyber resilience in rapidly digitalizing states is less explored. Third, national cybersecurity architectures are often discussed through official strategies and regulatory frameworks without the empirical evidence of operational preparedness, institutional coordination, and expert perception. This study aims to fill in this gap by investigating Kazakhstan’s cybersecurity architecture in connection to cyber resilience. It combines institutional and regulatory assessment with expert data derived from a Delphi-light survey among cybersecurity experts in government and academia, quasi-governmental organizations, and the private sector.

This article addresses four research questions: How has Kazakhstan’s cybersecurity architecture evolved in connection to digital transformation? What institutional and regulatory mechanisms shape cybersecurity governance in Kazakhstan? How have cyber resilience dimensions been incorporated in Kazakhstan’s cybersecurity policy and operational practices? What are some of the structural issues that hinder the development of cyber resilience in Kazakhstan?

Kazakhstan has developed the institutional and regulatory foundations of cybersecurity governance and has moved to a cyber resilience model for governance and is currently transitioning to a cyber resilience model. However, this transition is still far from complete because there is still a lack of operational preparedness, unified organization, coordination of security in the organization, cyber crisis management, and critical infrastructure resilience. Strategic frameworks, regulatory instruments, and technical standards have evolved, but operational readiness is not developing at the same pace.

The study contributes in three ways to the literature. First, it expands the existing research on cyber resilience in emerging digitalizing states. Secondly, it is one of the first comprehensive assessments of Kazakhstan’s evolving cybersecurity architecture from a governance perspective. Third, through document analysis, expert assessment, and external benchmarking data, the article provides a broad perspective on how it is possible to move from cybersecurity to cyber resilience in the context of the national digital transformation.

2 Literature review

2.1 From cybersecurity to cyber resilience: concepts and assessment

With the digitalization of public administration, critical infrastructure, financial systems and communication networks, both the opportunities on the one hand and the risks on the other are growing. As the countries and governments become more dependent on digital tools, the consequences of cyber-attacks are no longer just data loss or the temporary breakdown of information systems on a specific system. Cyberattacks can disrupt essential public service delivery, affect critical infrastructure, undermine institutions’ trust and have an impact on the rest of the country. As a result, the concept of cyber resilience has become much more important. Cybersecurity and cyber resilience are closely related.

Traditional cybersecurity is primarily concerned with protection against unauthorized access, damage and disruption of information systems, networks and data that is protected by the protection measures. It relies on preventative controls, monitoring instruments, access management processes, encryption, and incident response. Cyber resilience goes beyond that and poses a broader question of whether a system or an organization can carry out functions that are necessary that have to be performed when the preventive measures are not fully carried out or when the threat is the first one that comes to the fore.

As Tzavara and Vassiliadis (2024) point out, cyber resilience is a development of an idea that has evolved from one which was largely protection-centered to one that is about continuity, recovery and adaptation. This historical and conceptual review of resilience and its evolution in our age of cyber threats shows how the idea has evolved in response to ever more complex cyber threats. The authors also emphasize that resilience strategies must be adaptive given that the threat environment is changing continuously.

But resilience is not just cybersecurity. The concept was first introduced in ecological research and Holling (1973) defined resilience as stability within the context of the system. Stability is a state of equilibrium that a system must return to after a disturbance. Resilience in more general terms is the capacity to absorb change, but still retain its relationships and functions. This distinction is particularly important for digital systems. A cyber-resilient system does not always remain unchanged after an incident. Instead, it withstands disruption, keeps operations at acceptable levels, restores performance and changes its procedures and architecture according to the changing circumstances.

The concept of resilience has also been applied in the context of governance and development in Central Asia. Kuzembayeva et al. (2023) look at resilience through the lens of regional development and external cooperation and point out that the ability of institutions to respond to and withstand shocks in the sector, cross-sectoral coordination and social recovery are the key to resilience. The authors argue that resilience is increasingly seen as a strategic governance capability, not only as a response to one crisis.

Although they are concerned with the regional context, this also adds to the notion that resilience is about holding the system together, adapting to uncertainty and strengthening the capacity of the organization. These characteristics are in line with the current perspective in cyber resilience that it is about continuity, recovery and adaptation against evolving cyber threats. This is consistent with the framework, as put forth by the US National Institute of Standards and Technology (NIST). NIST defines cyber resiliency as the ability of systems to predict, resist, recover from and adapt to adverse situations, stresses, attacks or compromise of cyber resources (Ross et al., 2021). The four elements are important because they cover the entire life cycle of a cyber-incident: preparation before an attack, continuity during disruption, recovery after an incident and institutional learning to adapt to changing threats.

Cyber resilience is not the replacement of cybersecurity, but rather it provides the same protective measures (in the context of strategic, operational and institutional frameworks) (World Economic Forum, 2024). The change is especially significant in the public sector, where digital service continuity is increasingly linked to the stability of the state and the ability of the state to perform its main functions.

The literature increasingly treats cyber resilience not as static but as a multidimensional capability that can be developed, tested and measured. This perspective is not limited to the security controls, but rather a focus on the actual operational performance of systems and organizations in stress. Safitra et al. (2024) identify five interlinked components of cyber resilience as threat identification, protection, detection, reaction, and recovery. This process-based framework is useful because it shows the limitations of fragmented approaches.

Encryption, monitoring of the network, security protocols, and technical protections are needed but they do not necessarily create resilience. Their effectiveness depends on whether organizations are able to coordinate actions, identify disruption and act soon, contain damage and restore services and change procedures based on experience. Structured assessment is also emphasized by Sepúlveda Estay et al. (2020), who review cyber resilience assessment frameworks. The study shows that existing models are quite different in terms of scope, decision making levels, sectoral application, and analytical methods. Some frameworks focus on technical quality of systems and others on strategic or organizational aspects. This diversity shows that cyber resilience cannot simply be measured with an all-inclusive indicator.

Araujo et al. (2024) also suggest that resilience is a process that occurs at different stages. Such an approach is particularly feasible for assessing national cybersecurity architectures since it allows researchers to differentiate between measures that prevent an incident, capabilities needed in times of disruption, mechanisms to ensure services are restored, and changes to the institution after that incident. From these studies, cyber resilience assessment should incorporate a variety of indicators. Technical indicators include monitoring systems, backup infrastructure, alternative communication channels and protective equipment. Operational indicators include time taken to detect, escalate, contain, and recover from an incident. Institutional indicators include the scope of the responsibilities, the inter-agency coordination, the number of scenario-based exercises, the availability of skilled people, and the ability to change procedures after an incident.

Linkov and Kott (2019) have highlighted cyber resilience as a differentiator from traditional risk-management approaches and show that cyber resilience is the capacity of systems to perform and maintain critical functions in uncertain situations when they are disrupted and attacked. In recent years, Jin et al. (2025) have made a detailed case for cyber resilience by highlighting the interplay of physical, informational, cognitive and social aspects and their relevance for the modern cyber systems that are cyber environments are highly interrelated. The authors argue that traditional approaches that are based on system-hardening and not security are not good in order to cope with any new threat and will not keep pace with the rapidly changing and unpredictable challenges.

Instead, cyber resilience requires adaptive capabilities that enable systems to withstand disruptions, maintain essential functions, recover from attacks, and adapt to changing threat environments. From this perspective, cybersecurity needs to move away from protection-oriented cybersecurity to resilience-oriented governance and operational readiness.

2.2 Critical infrastructure, governance, and operational resilience

Critical infrastructure resilience is at the heart of current research. Digital transformation has brought energy, transport, telecommunications, healthcare, financial services, public administration and other key sectors closer together. Therefore, a disruption in one system can lead to cascading effects in other areas.

Aghazadeh Ardebili et al. (2024) consider risk assessment, governance, standards, guidelines and regulations as key to cyber resilience of critical infrastructure. Their review shows that vulnerability analysis is needed, but not sufficient. Policymakers must consider system interdependencies, the potential for disruption and continuity, and operators’ ability to bring essential services back. This approach offers a new perspective on the national cybersecurity architecture.

The protection of critical infrastructure cannot be achieved on the basis of the implementation of individual technical controls by a single organization. It requires a cooperative arrangement of regulators, public agencies, national incident response teams, operators of critical infrastructure, private technology companies and research institutions. Cyber resilience is therefore a socio-technical and institutional issue. These technological solutions depend on organizational processes, organizational routines, leadership, human capital, information sharing and decision-making processes to be made when uncertainty exists. The same technical system can produce different resilience outcomes depending on the way the system is structured, procedures are applied, communication channels are reliable and organizations can learn from prior incidents.

The governance component of cyber resilience has become very important in light of governments’ struggles to balance technological innovation, security and regulatory oversight and the need for innovation. Resilience can be evaluated not only in terms of technical safeguards but also institutional capacity, coordination mechanisms and strategic decision-making capability as well.

As a result, cybersecurity governance is now seen as a vital element of national resilience and state capacity. The literature also highlights the growing role of emerging technologies. Artificial intelligence and machine learning may enhance anomaly detection, threat analysis, and predictive monitoring.

On the other hand, they can also create new vulnerabilities and can increase the sophistication, scale, and speed of cyberattacks. Hence, cyber resilience needs to be balanced between technological modernization and risk assessment, adaptive regulation, professional development and institutional coordination.

An important distinction emerging from the literature is the difference between formal compliance and operational readiness. Organizations have cybersecurity regulations, dedicated units, monitoring systems and incident-response plans, but they are not well prepared for a complex disruption. Systems engineering can answer this question in NIST SP 800–160, Volume 2, Revision 1. It frames cyber resiliency as something to be incorporated in the architecture, design, implementation, maintenance and life-cycle management of systems (Ross et al., 2021). This strategy shifts the focus from reactive protection to resilience by design. The implications for public policy are significant. The maturity of a national cybersecurity architecture should not only be measured through legislation, SOC and SIEM systems and the number of incidents detected and monitored, or on the criteria for international standards.

It should also be evaluated by outcomes, such as: the time taken to detect and contain an incident; the speed of its restoration; the extent and magnitude of service disruptions; the number and status of backup systems and channels; the frequency and results of stress tests and scenario testing; and the institutions’ ability to react and improve the measures after the incident happened. Thus, it can be understood as a complete cycle from cybersecurity to cyber resilience as a whole.

The last part is particularly important. Cyber resilience is not possible if services are only restored. A resilient system takes the lessons of disruption into account in its governance process, technical architecture, risk assessments and coordination. And new technologies are an additional challenge to moving from compliance-based cybersecurity to operational resilience.

Kukeyeva et al. (2024) explore the theoretical and methodological framework to study artificial intelligence in international relations and international law. The authors contend that AI is becoming critical for many aspects of interstate relations: security, international legal regulation, ethical norms, technology dependency and so on. Without proper legal and governance frameworks, they also say, new vulnerabilities may arise and competition between states in important technology domains will be exacerbated. This is particularly relevant to cybersecurity governance as AI enhances cyber defense capabilities at the same time as creating new types of cyber threats. AI can help detect anomalies and predict cyber threats and protect ourselves but AI may also enable automated attacks, disinformation campaigns and other forms of technological dependency. Now cyber resilience needs regulatory and institutional mechanisms that can be used to deal with AI-related and current cybersecurity risks, they go on.

2.3 Digital governance, Kazakhstan, and the research gap

The development of cyber resilience in Kazakhstan needs to be considered in the broader context of the country’s digital transformation. Kosherbayeva and Kylbayev (2025) examine the evolution of digital governance in Kazakhstan, including technological infrastructure, public policy, institutional development, digital literacy, citizen engagement, and the expansion of digital public services. Their analysis shows that digitalization has affected not only the technological foundations of public administration but also the relationship between the state, public institutions, and citizens. This transformation has increased the importance of cybersecurity as a condition for the continuity and reliability of digital governance.

The regional dimension is also relevant to this discussion. Maltabarov et al. (2023) show that digital transformation in Central Asia is closely associated with institutional capacity, governance arrangements, and state modernization strategies. From this perspective, cyber resilience cannot be considered separately from the wider transformation of public institutions and digital governance. As public services and administrative processes become increasingly dependent on interconnected digital systems, disruptions may have consequences that extend beyond individual information systems and affect service delivery, institutional performance, and public trust.

The geopolitical dimension of digital transformation adds another layer to this relationship. Maltabarov et al. (2025) examine digital infrastructure, technological standards, and data governance in the context of geopolitical competition in Central Asia. Their analysis draws attention to the growing importance of technological dependence, digital infrastructure, and competing models of digital development. For Kazakhstan, these issues connect cybersecurity with broader questions of technological sovereignty, strategic autonomy, and the resilience of national digital infrastructure (Nye, 2011).

Kazakhstan has gradually developed the institutional and regulatory foundations of a national cybersecurity architecture. The Cybersecurity Concept, commonly known as the “Cyber Shield of Kazakhstan”, established the strategic basis for strengthening information security and cybersecurity governance (Government of the Republic of Kazakhstan, 2017). The Concept of Digital Transformation, Development of the Information and Communication Technology Industry and Cybersecurity for 2023–2029 subsequently placed cybersecurity within a broader digital-development framework (Government of the Republic of Kazakhstan, 2023). More recent attention to critical information infrastructure, personal data protection, national cybersecurity standards, and artificial intelligence has further expanded the scope of the cybersecurity agenda.

Earlier research in Kazakhstan had already identified cybersecurity as an issue extending beyond the technical protection of information systems. Issabayeva (2020) argued that the expansion of digital technologies across public administration, the economy, and social services creates vulnerabilities with implications for national security. Cyber threats may therefore affect not only information systems but also institutional stability, public functions, and trust in state institutions. This interpretation is consistent with the broader shift in the literature from cybersecurity understood primarily as protection toward cyber resilience understood in terms of continuity, recovery, and adaptation.

The development of Kazakhstan’s digital governance therefore raises a question that has received comparatively limited attention in the existing literature. As digital public services, interconnected state information systems, and critical information infrastructure expand, the existence of cybersecurity institutions and regulations alone provides an incomplete measure of preparedness. It is also necessary to examine whether the national cybersecurity architecture has developed the operational and institutional capacity to maintain essential functions, recover from disruption, and adapt to changing cyber threats.

The literature has made considerable progress in defining cyber resilience, identifying its main dimensions, developing assessment frameworks, and examining the resilience of critical infrastructure. However, several issues remain insufficiently explored.

First, much of the existing research concentrates on technical systems, sector-specific models, and organizational resilience, while cyber resilience as a feature of national governance and institutional development has received less attention (Organisation for Economic Co-operation and Development (OECD), 2015). Second, comparative research has focused largely on highly digitalized countries with mature regulatory systems. The experience of rapidly digitalizing middle-income states remains less extensively studied, despite the specific challenges they face, including the expansion of digital public services, uneven institutional capacity, shortages of specialized personnel, growing infrastructure interdependence, and the need to align national regulation with international standards. Third, formal cybersecurity arrangements are not always examined together with evidence of operational preparedness. Strategies, legislation, and institutional structures therefore need to be considered alongside incident readiness, critical infrastructure resilience, personal data protection, emerging AI-related risks, coordination mechanisms, and the capacity to respond to and recover from disruption.

Kazakhstan’s digital-governance transformation has been examined in previous research (Kosherbayeva and Kylbayev, 2025), but the evolution of its national cybersecurity architecture toward a cyber resilience model has received less focused attention. Existing studies have tended to examine digital transformation, cybersecurity, artificial intelligence governance, technological sovereignty, and regional resilience as separate fields of inquiry. The interaction between these processes, and their implications for the development of operational cyber resilience, remains underexplored.

A similar tension between formal institutional development and implementation capacity has been observed in other rapidly digitalizing post-Soviet states. In Georgia, successive cybersecurity strategies and institutional reforms have strengthened the formal governance architecture, while capacity assessments have continued to identify uneven implementation, resource constraints, and differences in institutional maturity (Global Cyber Security Capacity Centre, 2018). A recent regional assessment of Kazakhstan, Kyrgyzstan, Tajikistan, and Uzbekistan demonstrates that cybersecurity capacity needs to be considered across several dimensions, including governance and institutional structures, critical infrastructure protection, incident-response capabilities, and human capacity (Kaska and Maigre, 2025). These cases indicate that the existence of strategies, institutions, and regulatory frameworks does not by itself demonstrate operational cyber resilience. The key analytical question is whether formal institutional development is translated into organizational capabilities for anticipation, response, recovery, and adaptation.

Against this background, the contribution of the present study lies in connecting two strands of cyber resilience research that are often examined separately. Assessment-oriented studies identify the capabilities through which resilience can be evaluated, including detection, response, recovery, and adaptation, while organizational perspectives emphasize coordination, institutional responsibilities, organizational learning, and the continuity of essential functions. The Kazakhstan case brings these perspectives together at the level of national cybersecurity governance by examining whether formal institutional development is accompanied by the organizational and operational capabilities required for cyber resilience. Empirically, the study combines documentary analysis, a Delphi-light expert assessment, and external benchmarking to examine the relationship between institutional maturity and operational preparedness.

3 Data and analytical approach

3.1 Research design and evidence base

This study employs a qualitative case-study approach to analyze Kazakhstan’s national cybersecurity architecture in a time of rapid digital change. The research combines document analysis, expert assessment, and external benchmarking to evaluate the development of cybersecurity governance and the transition to a cyber resilience model. The case study is an ideal response to this issue because cybersecurity governance is influenced by the institutional, regulatory, technological, and organizational aspects which cannot be captured in one way in one analytical framework. The study therefore employs a triangulation approach by combining policy documents, expert judgment, and internationally known cybersecurity indicators. This is based on the study’s analysis of Kazakhstan’s cybersecurity architecture as it transitions from a traditional information security framework to a cyber resilience framework which is based on continuity, recovery of the network, adaptation, and education of the institution.

The empirical basis of the study is three different groups of sources.

Documentary Sources. The first group includes national strategic, legal, and analytical documents in the field of cybersecurity governance and digital transformation and is the Cybersecurity Concept “Cyber Shield of Kazakhstan” (2017), Digital Transformation, Development of the Information and Communication Technology industry & Cybersecurity for 2023–2029, technical reports of State Technical Service (CTS) including Cyberdigest 2025; (State Technical Service, 2025); the national cybersecurity standards adopted in 2025; and official documents on personal data protection and critical infrastructure security and cybersecurity governance. These papers are the key reference documents for Kazakhstan’s institutional development of cybersecurity architecture.

The second data source is the Delphi-light expert survey conducted in 2026. The survey was to complement documentary analysis by capturing expert views on the maturity of Kazakhstan’s cybersecurity governance system, operational cyber resilience, critical infrastructure protection, emerging cyber threats, and future policy priorities. Thirteen experts were involved in the survey. The panel consisted of government agencies, academics and research institutions, quasi-governmental entities, and private cybersecurity companies.

External Benchmarking Sources. They are internationally recognized cybersecurity assessment frameworks and threat intelligence reports used to validate and contextualize the findings. For example, the National Cyber Security Index (NCSI); the Global Cybersecurity Index (GCI); and the CIS Cyberthreat Landscape Report (H2 2024-Q3 2025). With external benchmarks, document analysis and expert assessment can be contextualized in the international context.

3.2 Delphi-light expert assessment

The Delphi-light method is chosen because it allows for the aggregation of expert judgment from various sectors of the cybersecurity ecosystem and is flexible and efficient compared to traditional multi-round Delphi studies.

The Delphi-light survey was designed and conducted by the author team in 2026. The authors developed the questionnaire, identified potential experts according to the selection criteria described below, distributed the survey, and analyzed the responses. Participation was voluntary and anonymous. Respondents were informed about the purpose of the research and the intended academic use of the results, and no personally identifiable or sensitive personal information was collected or reported. The institutions represented by the authors do not have a dedicated institutional review board or ethics committee for this type of non-medical expert research; therefore, formal IRB approval was not available. The research did not involve clinical procedures or vulnerable participants. As the authors are affiliated with different institutions, a statement concerning the research procedure can be provided by the Academic Council of the institution with which the first author is affiliated, if required by the journal (Table 1).

Table 1. Characteristics of the Delphi-light expert panel (n = 13).

The purpose of the Delphi-light survey was not statistical generalization but the compilation of expert opinions on Kazakhstan’s cybersecurity governance and cyber resilience architecture in an informed manner. This approach fits with exploratory policy research in which experts are used to help assess emerging institutional, regulatory and operational challenges that are currently not well understood in quantitative data studies. Since cybersecurity governance is a rapidly changing field, the Delphi-light methodology can provide valuable insights on how experts perceive the current situation as well as policy priorities and future risks. The questionnaire included closed-ended and open-ended questions in the five thematic areas: Kazakhstan’s cybersecurity architecture; institutional and regulatory mechanisms; cyber resilience and operational preparedness; critical infrastructure protection; emerging dangers, including artificial intelligence and personal data protection.

Experts were selected through purposive sampling based on three criteria: (1) at least three years of professional experience in cybersecurity, digital governance, information security, or related public policy; (2) direct involvement in cybersecurity governance, research, incident response, critical information infrastructure protection, or regulatory development; and (3) representation of different institutional sectors, including government agencies, academia, quasi-governmental organizations, and private cybersecurity companies. The Delphi-light design emphasized diversity of professional expertise rather than statistical representativeness.

Unlike a classical multi-round Delphi study, this research employed a modified Delphi-light approach consisting of one structured survey round combined with qualitative interpretation of expert responses. The objective was exploratory rather than predictive, allowing expert judgments to be considered alongside documentary analysis and external benchmarking.

3.3 Analytical framework and data interpretation

This study is based on cyber resilience, which means the ability of systems, organizations and institutions to respond to cyber-attacks. That is, they need to be able to predict problems, deal with them when they happen, recover from them and change in order to avoid them happening again and keep the major functions running.

Drawing on the NIST framework and recent cyber resilience research, the study examines cybersecurity governance through six interrelated dimensions: anticipation, protection, detection, response, recovery, and adaptation. This framework makes it possible to assess cybersecurity governance beyond formal compliance by considering the operational capacity of institutions to prepare for, manage, and recover from cyber incidents.

The BANI framework (Brittle, Anxious, Nonlinear, and Incomprehensible) is used as a complementary analytical lens for interpreting the conditions in which cybersecurity governance operates (Cascio, 2020). It is particularly relevant to highly interconnected digital environments, where disruptions may produce cascading effects and where emerging technologies, including artificial intelligence, introduce risks that are difficult to anticipate through conventional security approaches. In this study, the framework is used to interpret the relationship between institutional capacity, operational vulnerabilities, technological uncertainty, and the changing cyber threat environment.

The documentary analysis was conducted focusing on institutional reforms, governance processes, regulatory processes, operational cybersecurity measures and resilience-driven policy interventions. Because the Delphi-light panel consisted of a limited number of experts (n = 13), descriptive statistics were used exclusively for exploratory interpretation. Mean scores and response frequencies were employed to identify relative priorities, areas of convergence, and perceived weaknesses rather than to draw statistically generalizable conclusions. Accordingly, numerical differences between indicators should be interpreted as indicative expert judgments rather than statistically significant estimates. The highest rated and lowest rated statements provide an understanding of the perceived strengths and weaknesses of Kazakhstan’s cybersecurity architecture. Open-ended responses were analyzed in terms of thematic coding to identify general themes related to institutional capabilities, operational preparedness, critical infrastructure protection, personal data security, and emerging technology risks. The expert findings were compared with NCSI indicators and Positive Technologies threat intelligence data to assess whether expert perceptions were consistent with external evidence on cybersecurity capacity and the evolving threat environment.

Several limitations should be acknowledged. First, the Delphi-light survey involved a relatively small expert panel (n = 13), which is appropriate for exploratory qualitative policy research but does not allow statistical generalization. Consequently, descriptive indicators reported in this study (mean scores and percentages) should be interpreted as indicative measures of expert agreement rather than precise statistical estimates.

Second, the Delphi-light design consisted of a single consultation round. Although this approach increases efficiency and is widely applied in exploratory governance research, it does not pursue iterative consensus-building characteristic of the classical Delphi method.

Third, despite efforts to ensure sectoral diversity, expert judgments inevitably reflect professional perceptions that may evolve alongside Kazakhstan’s rapidly changing cybersecurity environment.

Finally, this research focuses on Kazakhstan as a single-country case study; therefore, the findings should be interpreted analytically rather than generalized directly to other national contexts.

4 Results

4.1 Evolution of Kazakhstan’s cybersecurity governance

The analysis of strategic and regulatory documents shows that the development of Kazakhstan’s cybersecurity architecture has followed three successive stages. Together, these stages demonstrate how cybersecurity has evolved from a relatively narrow regulatory issue into a broader component of digital governance and national security. More recent reforms place greater emphasis on resilience, reflecting a growing recognition that effective cybersecurity depends not only on regulation but also on institutional capacity and operational preparedness (Table 2).

Table 2. Stages of Kazakhstan’s cybersecurity architecture development.

The first stage marked the establishment of Kazakhstan’s institutional framework for cybersecurity. The adoption of the Cyber Shield of Kazakhstan brought together strategic objectives, institutional responsibilities, and regulatory measures within a single policy framework. The main priority during this period was the development of governance arrangements capable of supporting the country’s digital transformation. Issues related to operational resilience, including preparedness, incident response, and recovery, were addressed only to a limited extent. The second stage reflected a change in policy priorities. While institutional development continued, greater emphasis was placed on strengthening operational capabilities, including continuous monitoring, incident response, and the protection of government information systems. At the same time, the scope of cybersecurity governance expanded to include critical information infrastructure, indicating a shift from building regulatory frameworks toward supporting their implementation in practice. In the third stage, the scope of cybersecurity policy has widened. Recent reforms address cyber crisis management, the security of critical information infrastructure, personal data protection, risks associated with artificial intelligence, and the development of national cybersecurity standards. This change in priorities points to a broader understanding of cybersecurity, in which prevention remains important but is complemented by the capacity to maintain essential functions, manage incidents, and restore operations after disruption. These developments suggest a gradual shift from a compliance-oriented model to a resilience-oriented governance framework.

Kazakhstan’s cybersecurity institutions have developed in parallel with a broader regulatory framework. Strategic planning is now supported by sector-specific rules, technical standards, personal data protection measures, and a clearer distribution of responsibilities among public authorities.

Recent regulatory changes also give more attention to critical information infrastructure. Standards such as ST RK 1073–2025 and ST RK 4009–2025 strengthen the technical basis of cybersecurity regulation (Inbusiness.kz, 2025; Paragraph Information System, 2025), while analytical documents increasingly address vulnerability management, incident response, and recovery. This broadening of the regulatory agenda shows that cybersecurity policy is moving beyond formal compliance toward the practical requirements of operational preparedness.

The current governance framework rests on four main elements: strategic planning; cybersecurity regulation and technical standards; protection of critical information infrastructure and personal data; and specialized institutions responsible for monitoring, incident response, and coordination.

4.2 Expert assessment of institutional and operational resilience

The Delphi-light survey also provides additional evidence regarding expert perceptions of Kazakhstan’s cybersecurity architecture. The highest levels of expert agreement concerned measures related to cyber resilience and critical information infrastructure protection. The strongest support was for stronger cybersecurity assessments of operators responsible for critical information infrastructure and large databases (mean = 4.77). Experts also strongly supported the development of an updated cyber resilience strategy (mean = 4.62), the strengthening of personal data protection (mean = 4.62), SOC/SIEM systems and threat-hunting capabilities (mean = 4.54) and the protection of industrial control systems and operational technology environments (mean = 4.54; Table 3).

Table 3. Areas of strongest expert agreement on cyber resilience governance.

Source: Delphi-light survey of cybersecurity experts (n = 13).

These findings indicate broad agreement among experts on the necessity for stronger operational cybersecurity capabilities and strengthening cyber resilience of sectors that are strategic to the nation. Despite positive assessment of Kazakhstan’s cybersecurity development overall, experts mentioned some issues that continue to hinder the development of cyber resilience. These areas were ranked with the lowest average score of the study and indicate challenges in operational preparedness, coordination, and implementation (Table 4).

Table 4. Areas of greatest concern identified by experts.

Source: Delphi-light survey of cybersecurity experts (n = 13).

The lowest-rated area was organizational readiness for cyber incident detection, response, and recovery (mean = 3.08), indicating limited confidence in operational preparedness. Experts also expressed some concern about coordination among government agencies, information system operators, and private-sector organizations (mean = 3.31). The relatively poor assessment of the resilience of critical infrastructure (mean = 3.38) indicates that progress in regulatory measures has not fully translated into operational resilience. The moderate approval of the regulatory framework and the availability of people is also a sign of some challenges to adaptation, implementation, and capacity building. In summary, the expert reports are more on institutional maturity than the capacity of the organizations to respond to cyber incidents in practice.

The Delphi-light survey also identified the principal priorities for cybersecurity development over the next three to 5 years.

Protection of Critical Information Infrastructure (CII) and personal data protection were identified as the most important priorities, each selected by 84.6% of experts. The development of an updated national cyber resilience strategy (76.9%) and the strengthening of cybersecurity awareness and cyber hygiene among citizens and public servants (76.9%) were also highly ranked. More than half of respondents emphasized the importance of regulating artificial intelligence risks (61.5%), strengthening incident response capabilities (53.8%), and expanding international cooperation (53.8%).

The threat landscape identified by experts was dominated by concerns related to personal data breaches, which were selected by 84.6% of respondents. Other frequently identified threats included phishing and social engineering attacks (61.5%), attacks against government information systems (61.5%), and AI-enabled threats such as deepfakes and automated attacks (61.5%). Attacks against critical infrastructure were identified by 46.2% of experts.

These findings indicate growing concern regarding both traditional cyber threats and emerging risks associated with artificial intelligence and large-scale digitalization.

Key constraints include operational readiness gaps, coordination challenges, cyber crisis management weaknesses, workforce shortages, and emerging AI-related risks.

4.3 Strategic priorities, emerging threats, and external validation

The findings from document analysis and expert assessment are largely supported by external benchmarking indicators.

According to the National Cyber Security Index, Kazakhstan ranks 51st globally with an overall score of 76.67, demonstrating relatively strong institutional cybersecurity capacity, critical information infrastructure protection, and personal data protection (e-Governance Academy, 2026). The country demonstrates particularly high scores in regulatory and institutional dimensions of cybersecurity governance. However, lower scores in cyber crisis management indicate that operational preparedness remains an area that needs further progress.

Positive Technologies analysis of Threat Intelligence revealed that Kazakhstan had about 7% of successful cyberattacks against organizations in the CIS region from the second half of 2024 to the third quarter of 2025 (Positive Technologies, 2025). Social engineering and malware were the most common attack vectors. More than half of successful attacks compromised confidential information, while personal information was the majority of information that was exposed through dark web articles about Kazakhstani organizations. The sector-based nature of attacks also shows the importance of government institutions, industrial companies, telecommunications operators, and critical infrastructure.

These observations are consistent with the priorities identified by the Delphi-light survey and underscore the importance of personal data protection, critical infrastructure resilience, and operational cybersecurity capabilities.

The triangulation of documentary analysis, Delphi-light findings, NCSI indicators, and Positive Technologies threat intelligence reveal a consistent pattern. Kazakhstan demonstrates comparatively strong institutional performance in cybersecurity governance (NCSI score 76.67), while threat intelligence indicates persistent exposure to personal data breaches, social engineering attacks, and attacks targeting government institutions. Expert assessments similarly identify operational readiness and inter-organizational coordination as the weakest dimensions of cyber resilience. Together, these findings indicate that institutional capacity has developed more rapidly than operational resilience.

The empirical findings can also be interpreted through the BANI framework (Brittle, Anxious, Nonlinear and Incomprehensible), which provides an analytical lens for understanding Kazakhstan’s evolving cybersecurity environment.

The system remains brittle because operational preparedness and cyber crisis management continue to lag behind institutional development, making critical digital services potentially vulnerable during large-scale incidents.

The environment is increasingly anxious due to the rapid growth of personal data breaches, AI-enabled attacks, phishing campaigns, and uncertainty surrounding emerging technologies, all of which were consistently identified by experts.

Cyber risks are also nonlinear, as disruptions affecting critical information infrastructure may rapidly propagate across interconnected public services, financial systems, telecommunications, and industrial sectors.

Finally, the cybersecurity environment has become increasingly incomprehensible because artificial intelligence, automated attacks, deepfakes, and evolving threat actors generate complex interactions that are difficult to anticipate using traditional compliance-based approaches.

These findings suggest that Kazakhstan’s transition toward cyber resilience reflects not only regulatory modernization but also institutional adaptation to the characteristics of the emerging BANI environment.

Combined, these results suggest Kazakhstan has a relatively established institutional and regulatory framework for cybersecurity governance. Strategic documents, national standards and institutions provide a solid foundation to protect information systems and critical infrastructure.

At the same time, expert assessments and external benchmarking data show that operational preparedness, cyber crisis management, inter-organizational coordination and incident response capabilities remain issues. Our findings indicate that Kazakhstan’s cybersecurity architecture is now transitioning from a compliance and regulatory model to a more cyber resilience governance model that can be adapted and maintained in the face of change and recovery.

5 Discussion

5.1 From institutional maturity to operational resilience

The findings showed that Kazakhstan’s cybersecurity architecture has evolved in the last few years from a very information security-centric approach to a multi-dimensional model of cyber resilience governance, reflecting the global trends and frameworks of cybersecurity in which protection of information systems is increasingly combined with the ability of institutions and infrastructure operators to predict, withstand, respond to, recover from and adapt to cyber incidents and threats.

The Cyber Shield of Kazakhstan laid the bases for cybersecurity governance by establishing the institutionalized framework for cybersecurity governance by defining what needs to be done, clarifying responsibilities and enabling coordinated coordination of agencies to work together. The policy efforts thereafter expanded this framework and cybersecurity was incorporated in the context of digital transformation policy and personal data protection and cybersecurity standards in alignment with international standards. The findings therefore support the view of cyber resilience literature that cybersecurity is not just a technical domain but a governance capability in the form of institutional capability, continuity, and adaptive capacity. Kazakhstan can also illustrate how digital transformation can lead to technological development and also to a more sophisticated approach to risk management.

The analysis indicates that Kazakhstan’s cybersecurity architecture has reached a stage where institutional development and operational capacity are evolving at different rates. Over the past decade, considerable progress has been made in establishing legal frameworks, strengthening institutional responsibilities, and integrating cybersecurity into the broader system of national security and digital governance. At the same time, the results show that operational resilience has not advanced to the same extent.

This distinction reflects the broader evolution of thinking in cybersecurity research. Previous studies have emphasized that cybersecurity is primarily concerned with reducing the likelihood of successful attacks through technical and regulatory measures, whereas cyber resilience places greater emphasis on maintaining essential functions, responding effectively to disruptions, and adapting to changing conditions (Linkov and Kott, 2019; National Institute of Standards and Technology (NIST), 2021; Tzavara and Vassiliadis, 2024). Viewed from this perspective, the development of national cybersecurity depends not only on preventive measures but also on the capacity of institutions to continue operating during and after cyber incidents.

The empirical findings support this interpretation. National strategies, legislative reforms, and technical standards have strengthened the institutional foundations of cybersecurity governance. However, the Delphi-light survey and external benchmarking indicate comparatively lower levels of preparedness in incident response, recovery planning, cyber crisis management, and inter-agency coordination. These results suggest that the institutional framework has developed more rapidly than the operational capabilities needed to support a mature model of cyber resilience.

This imbalance can be interpreted as a feature of institutional transition in which regulatory and organizational structures develop before operational capabilities reach a comparable level of maturity. Building regulatory and organizational structures is an important prerequisite for cyber resilience, but their effectiveness ultimately depends on how successfully they are translated into operational practice, coordinated decision-making, and organizational learning.

The most important result of this study is the identification of a gap between institutional maturity and operational readiness in Kazakhstan’s cybersecurity architecture. Document-based research shows the progress in the process of developing regulatory frameworks, strategic planning documents, technical standards and institutional responsibilities. Kazakhstan’s NCSI performance provides additional evidence of comparatively strong institutional and regulatory capacity, particularly in cybersecurity policy, critical information infrastructure protection, and personal data protection. At the same time, weaker performance in cyber crisis management points to a continuing gap between the formal development of cybersecurity governance and the operational capacity to manage major cyber incidents. This pattern is consistent with the Delphi-light findings, in which experts expressed lower confidence in incident response, recovery capacity, and inter-organizational coordination.

The Delphi-light results also indicate strong expert support for the strategic direction of cybersecurity development. High levels of support were found for update of national cyber resilience strategy, critical infrastructure protection, enhancement of cybersecurity standards and improvement of personal data protection.

On the other hand, the experts were much less confident of the operational capacity of organizations to detect, respond to, and recover from cyber incidents. Cooperation among government institutions, information system operators and private sector organizations also received relatively low scores.

These findings suggest that institutional development has been progressing faster than operational capability to implement cyber resilience in practice. This is the second major issue in cyber resilience research. Regulatory compliance and formal institutional arrangements may improve cybersecurity governance, but that does not mean operational effectiveness.

Resilience is not only about having rules and standards, but also about being able to keep up with the situation on the ground, incident response capacity, recovery, organizational learning and adaptation to the ever changing environment. Kazakhstan appears to have established much of the institutional foundation required for cybersecurity governance, while the transition toward operational cyber resilience remains incomplete.

The observed gap between institutional maturity and operational readiness illustrates a broader transition from compliance-oriented cybersecurity toward resilience-oriented governance. Rather than reflecting regulatory failure, the Kazakhstan case suggests that institutional reforms have progressed more rapidly than the operational capabilities required to support incident response, recovery, and cross-sector coordination. This distinction is important for assessing cyber resilience because formal institutional development alone does not demonstrate the ability of a system to maintain essential functions during and after disruption.

5.2 Critical infrastructure, digital governance, and the changing threat environment

Another important finding concerns the growing strategic importance of critical information infrastructure protection. Both documentary evidence and expert assessments indicate that critical infrastructure has become a central element of Kazakhstan’s cybersecurity agenda. Experts gave the most support to more sophisticated cybersecurity assessments of critical infrastructure and large-scale data systems operators.

In addition, the protection of critical information infrastructure is anticipated to be one of the most important policy priorities for the future. These findings are in line with the general trends in the world. As digital technology is increasingly integrated within energy systems, transportation networks, telecommunications, finance, healthcare and public administration, damage to critical infrastructure can have huge implications that extend well beyond the digital environment.

The growing attention to industrial control systems and technology use points to the transformation from information security of physical systems to digital ones. It is especially appropriate for Kazakhstan in view of the importance of energy, transportation and industrial sectors of the country.

The Kazakhstan case illustrates that the development of cyber resilience extends beyond the introduction of new technologies or the strengthening of cybersecurity regulation. The findings show that the effectiveness of a national cybersecurity architecture depends on how institutional arrangements, organizational capabilities, and coordination mechanisms evolve alongside digital transformation. In this context, cyber resilience is shaped not only by technical safeguards but also by the capacity of public institutions to coordinate responses, learn from incidents, and adapt to a changing threat environment.

This perspective reinforces recent approaches that treat cyber resilience as an element of digital governance rather than a purely technical function. The empirical evidence suggests that institutional capacity, inter-agency cooperation, and adaptive decision-making are as important as technological modernization in maintaining the continuity of public services and protecting critical information infrastructure. As digital transformation increases the interdependence of government systems, resilience becomes a characteristic of governance itself rather than of individual technologies or organizations.

The findings also have broader relevance for countries undergoing rapid digital transformation. In such contexts, regulatory reforms often progress more quickly than operational capabilities. Kazakhstan demonstrates that strengthening cyber resilience requires more than the adoption of new legal frameworks or technical standards. Sustainable resilience depends on the ability of institutions to integrate regulation, operational preparedness, organizational learning, and cooperation across the public and private sectors into a coherent governance system.

The findings also support the use of the BANI paradigm in the context of contemporary cybersecurity governance. Kazakhstan’s digital ecosystem is increasingly brittle, anxious, nonlinear, and incomprehensible. With the increasing interdependence of digital systems, the vulnerability to cascading failures and the emergence of artificial intelligence technologies increases the uncertainty and complexity.

Experts identified personal data breaches, social engineering attacks, attacks against government information systems and AI-enabled threats as the leading cybersecurity problems faced by Kazakhstan. Such concerns are in general consistent with threat intelligence data by Positive Technologies that show increasing personal data exposure, social engineering attacks and attacks targeting public sector institutions.

Also, the development of deepfakes, automated phishing campaigns, AI-assisted malware and cyberattacks that are algorithmically enhanced is complicating the governance of cybersecurity. In this situation resilience is more dependent on adaptability, situational awareness and institutional learning than static security controls. These conditions increase the importance of adaptability, situational awareness, and institutional learning within Kazakhstan’s cybersecurity governance system.

5.3 Cyber resilience governance in comparative perspective

Several features of Kazakhstan’s cybersecurity architecture can be considered in relation to established international approaches. The integration of cybersecurity with digital public services and digital governance has parallels with Estonia, while centralized strategic coordination and the role of national institutions share certain features with the Singaporean model. Recent attention to critical infrastructure, technical standards, and organizational accountability also corresponds to priorities reflected in the European Union’s NIS2 framework. At the same time, the emphasis on technological sovereignty and national cybersecurity capabilities has some similarities with approaches developed in Russia.

Kazakhstan does not fully correspond to any of these models. Its cybersecurity architecture combines centralized governance, regulatory modernization, critical infrastructure protection, and an increasing emphasis on technological sovereignty, while operational resilience mechanisms remain less mature. The Delphi-light findings, particularly the lower assessments of incident response, cyber crisis management, and inter-organizational coordination, distinguish the Kazakhstan case from more mature resilience-oriented systems.

The comparison therefore suggests that Kazakhstan represents a hybrid and still evolving model of cyber resilience governance. Its institutional architecture incorporates elements found in several international approaches, but their practical integration into incident preparedness, response, recovery, and adaptation remains incomplete.

The findings point to several features that are important for understanding cyber resilience as a governance issue. The first concerns coordination. Operational resilience depends on the interaction between public authorities, critical infrastructure operators, private-sector organizations, and other actors involved in monitoring, response, and recovery. Regulatory frameworks and technical standards provide the formal basis for cybersecurity governance, but their effectiveness depends on how these arrangements function during actual incidents.

A second issue is the relationship between regulation and operational capacity. The evidence presented in this study shows that Kazakhstan has made considerable progress in building institutional and regulatory structures, while incident response, recovery, and inter-organizational coordination remain less developed. This gap suggests that the transition toward cyber resilience requires not only further regulatory development but also stronger operational capabilities and more consistent implementation across organizations.

Personal data protection and emerging technologies form another important part of this governance agenda. Both the Delphi-light survey and external threat intelligence identify data breaches, social engineering, and AI-enabled threats among the most relevant risks. These developments increase the importance of adaptive regulation, information sharing, and institutional learning, particularly as artificial intelligence expands both defensive capabilities and the range of potential cyber threats.

In this sense, Kazakhstan’s experience supports a broader understanding of cyber resilience governance. Strategic planning, regulation, technical standards, critical infrastructure protection, operational cybersecurity practices, and institutional coordination are not separate components of the system. Their effectiveness depends on how well they are integrated. The main challenge is therefore not simply the existence of cybersecurity institutions or policies, but the capacity of the governance system to translate them into preparedness, continuity, response, recovery, and adaptation (Table 5).

Table 5. Research questions and main findings.

5.4 Limitations and future research

The results need to be interpreted in light of several limitations. The expert survey reflects professional assessments made at a specific point in time, while both cybersecurity regulation and the threat environment in Kazakhstan continue to change. The external sources used for comparison also serve different purposes and rely on different methodologies. NCSI measures national cybersecurity capacity, whereas threat intelligence reports describe observed patterns of cyber activity. Their findings are therefore useful for comparison, but they do not provide equivalent measures of cyber resilience.

A further constraint is the limited availability of publicly accessible operational data. Comparable national-level information on incident detection, response times, service restoration, and the impact of major cyber incidents is not consistently available. The assessment of operational resilience therefore draws on several types of evidence, including policy documents, expert judgments, NCSI indicators, and threat intelligence data. This approach provides a broader basis for analysis, although it cannot substitute for direct measurement of response and recovery performance.

Longitudinal research would make it possible to examine whether the current relationship between institutional development and operational preparedness changes as Kazakhstan’s cybersecurity system evolves. Cross-country research could also establish whether the pattern observed in Kazakhstan is shared by other states undergoing rapid digital transformation. Access to operational data would allow future studies to examine more directly how regulatory and institutional changes affect incident response, recovery, and the continuity of critical services.

6 Conclusion

The findings indicate that Kazakhstan’s national cybersecurity architecture is undergoing a gradual transition from a predominantly compliance-oriented model toward a broader concept of cyber resilience. This transition has accompanied the country’s rapid digital transformation and increasing dependence on digital public services, critical information infrastructure, and interconnected information systems. By combining institutional analysis, comparative evidence, external cybersecurity indicators, and a Delphi-light expert survey, the study examined how cybersecurity governance has evolved and identified the principal challenges that continue to constrain operational resilience.

The analysis shows that Kazakhstan has established a substantial institutional and regulatory framework for cybersecurity. Since the adoption of the Cyber Shield of Kazakhstan in 2017, cybersecurity has become increasingly integrated into national security policy and digital governance. Successive reforms have strengthened legal regulation, institutional coordination, cybersecurity standards, and the protection of critical information infrastructure and personal data. At the same time, institutional development has progressed more rapidly than operational capabilities. Incident preparedness, inter-agency coordination, crisis response, and recovery capacities remain comparatively less developed.

The Delphi-light survey provides additional empirical support for this conclusion. Experts expressed the strongest levels of agreement regarding the need to strengthen cybersecurity requirements for operators of critical information infrastructure, adopt an updated national cyber resilience strategy, improve personal data protection, and expand operational capabilities such as SOC, SIEM, and threat-hunting mechanisms. Lower assessments were recorded for cyber incident detection and recovery, cross-sector coordination, and the operational resilience of critical infrastructure. These results indicate that the next stage of cybersecurity development depends not only on further regulatory refinement but also on strengthening the institutional and operational capacities required to anticipate, manage, and recover from increasingly complex cyber incidents.

The empirical findings are consistent with external evidence. The National Cyber Security Index indicates relatively strong performance in cybersecurity governance, critical infrastructure protection, and personal data security, while cyber crisis management remains comparatively weaker. Threat-intelligence data likewise point to continued exposure to personal data breaches, social engineering, attacks targeting government information systems, and AI-enabled cyber threats. Considered together, these sources reinforce the finding that institutional capacity has developed more rapidly than operational resilience.

The BANI framework also provides a useful perspective for interpreting cybersecurity governance under conditions of uncertainty, interdependence, and technological complexity. Kazakhstan’s experience illustrates how digital transformation increases systemic vulnerabilities while simultaneously requiring more adaptive forms of governance capable of maintaining essential functions, responding to disruption, and supporting recovery. In this context, cyber resilience should be understood not only as a technological capability but also as an institutional characteristic of the state that depends on governance capacity, organizational learning, and effective coordination across public and private sectors.

These findings also connect two strands of cyber resilience research that are often considered separately. Assessment-oriented approaches focus on capabilities such as detection, response, recovery, and adaptation, while organizational perspectives emphasize coordination, institutional responsibility, organizational learning, and the continuity of essential functions. The Kazakhstan case shows that these dimensions are closely related at the level of national cybersecurity governance. Strategies, institutions, regulations, and technical standards provide the formal foundations of cybersecurity, but their contribution to resilience depends on how effectively they are translated into organizational preparedness, coordinated response, recovery capacity, and adaptation.

The study therefore contributes empirical evidence from a rapidly digitalizing middle-income country to the broader literature on cyber resilience and digital governance. Kazakhstan’s experience shows that the evolution of national cybersecurity architecture cannot be explained solely through technological modernization or regulatory reform. The relationship between institutional development and operational preparedness is equally important for understanding the transition toward cyber resilience. Future research could examine whether similar patterns are found in other rapidly digitalizing states and, through longitudinal analysis, assess how changes in institutional capacity affect incident response, recovery, and continuity over time.

Generative AI statement

The author(s) declared that Generative AI was used in the creation of this manuscript. Generative AI was used to support the organization and presentation of Delphi-light expert survey results, improve the structure and readability of the manuscript, and assist with language editing. The design of the study, data collection, validation of sources, interpretation of results, development of conclusions, and all substantive scholarly judgments were performed by the author. The author reviewed and verified all AI-assisted outputs and takes full responsibility for the content of the manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Ilia Murtazashvili, University of Pittsburgh, United States

Reviewed by: Muharman Lubis, Telkom University, Indonesia

Svitlana Sachenko, West Ukrainian National University, Ukraine