The modernization of public administration has forced states around the world to develop digital electronic government services and, in turn, consider threats to the information assets with which they provide these services. Studies reveal that a large part of the origin of threats to cybersecurity in state entities comes from internal personnel, and those threats are unintentional. This paper presents a systematic review of the state of the art about frameworks, models and other proposals to identify unintentional cybersecurity threats produced by internal personnel in public institutions.