How Government Agencies Evaluate Cybersecurity Capacity Building Outcomes: A Case of Malawi

The unprecedented rise in cybercrimes has become a global concern. Government agencies across the globe are now faced with the task of protecting internet users and securing national critical infrastructures. However, government agencies in developing countries are already facing political, social and economic challenges, which have a detrimental impact on cybersecurity. Cybersecurity capacity building is thus one of the key measures that are used to capacitate and empower individuals, societies, and nations to enhance their cyber resilience. Different cybersecurity capacity-building interventions are being developed to empower internet users and cybersecurity actors and/or practitioners to improve cybersecurity posture in many parts of developing countries. The current study therefore sought to understand how government agencies in developing countries evaluate cybersecurity capacity-building outcomes. This will inform policymakers and developmental partners in improving cybersecurity evaluation techniques. We used an inductive approach to theory, and purposive and snowball sampling to select 23 participants from eight government institutions in Malawi tasked with the development and implementation of cybersecurity strategy and cybersecurity education, awareness, and training. The study adopted an interpretive approach. Data was collected through semi-structured interviews and document analysis. The findings showed that, at the time of this research, government agencies did not use any cybersecurity-specific evaluation techniques. At the time, government agencies were using existing evaluation techniques, which we refer to in this paper as ‘generic evaluation techniques. The study found that the existing evaluation techniques are inadequate in capturing the effectiveness of the existing cybersecurity capacity-building initiatives. Most government agencies use informal evaluation techniques, for instance, observations as a means of evaluating outcomes.