Abstract
Public administration, critical infrastructure and public services are rapidly becoming digitalized, and cybersecurity has become an integral part of national security and governance. As cyber threats are more complex, states are moving beyond traditional cybersecurity approaches to cyber resilience based on preparedness, continuity, recovery and adaptation. In this study, we look at the evolution of Kazakhstan’s national cybersecurity architecture in the context of digital transformation and we evaluate how cyber resilience has emerged in cybersecurity governance. The research is based on a qualitative case study, with document analysis, a Delphi-light expert survey and external benchmarking data. The study finds that Kazakhstan’s cybersecurity architecture has evolved through three stages: institutionalization, operational cybersecurity development and resilience-oriented modernization. Strategic planning frameworks, cybersecurity standards, critical information infrastructure protection mechanisms, personal data protection regulations and specialized cybersecurity institutions have played a crucial part in cybersecurity governance. However, expert assessments and external benchmarks reveal a longstanding gap between institutional maturity and operational readiness in incident response, cyber crisis management and inter-organizational coordination. Kazakhstan has accomplished much of the institutionalization phase of cybersecurity governance and is moving towards a cyber resilience model, the study suggests, but the long-term success of this transition will depend on strengthening operational capabilities, adaptive governance systems and resilience-oriented responses to changing technological threats. The findings add to a growing body of international literature on cyber resilience governance and reflect on the challenges in rapidly digitalizing states.