Author: Elisabeth Dubois

Elisabeth Dubois, Ph.D., is a cybersecurity expert and researcher dedicated to protecting communities and empowering public leaders in the digital age. Currently serving as a Cyber Risk Specialist with NYMIR and Co-Director of the Local Government Cybersecurity Alliance, Elisabeth specializes in helping local governments navigate the complexities of AI, cyber risk management, and incident response.

Her research focuses on the intersection of technology, risk management, and social equity—specifically investigating how cyber threats and crisis communications affect vulnerable populations. With a Ph.D. in Information Science (specializing in crisis communication and information assurance), an MBA, and a B.S. in Digital Forensics from the University at Albany, Elisabeth combines technical expertise with a passion for public policy and international education.

Categories
Emerging Tech & AI Public Works & Infrastructure (DPW)

What Municipal Leaders Need to Know About Today’s Cyber Threats to Water Systems

For most residents, turning on the faucet is one of the most routine actions of the day. They expect clean water to come out. They expect toilets to flush, wastewater to be treated, fire hydrants to work, and the systems supporting their community to operate quietly in the background.

Behind that reliability, however, is an increasingly complex network of pumps, sensors, programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, computers, communications equipment, vendors, and employees. As water and wastewater operations have become more connected, they have also become more exposed to cyber threats.

That threat is no longer theoretical.

In July 2026, the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the Environmental Protection Agency (EPA), and other government partners issued an updated warning regarding Iran-affiliated cyber actors targeting U.S. critical infrastructure. Federal agencies specifically highlighted exploitation of PLCs across multiple sectors, including U.S. water and wastewater facilities.

EPA has also warned more broadly that cyberattacks against public water systems are increasing.

For municipal leaders, the lesson should be clear: cybersecurity at a water or wastewater facility is no longer simply an IT issue. It is an operational resilience, public safety, financial, and governance issue.

Why Water Systems Are Attractive Targets

Water and wastewater utilities present a particularly challenging cybersecurity environment. Many municipalities operate systems that combine modern technology with equipment installed years—or sometimes decades—ago. Operational technology may have been designed primarily for reliability and longevity rather than today’s cybersecurity environment.

At the same time, remote connectivity has become increasingly common. Employees, contractors, integrators, and vendors may need remote access to equipment. Internet-connected human-machine interfaces (HMIs), PLCs, SCADA environments, and other operational systems can create pathways into infrastructure when they are improperly configured or inadequately protected.

The threat actors themselves vary. A municipality may face ransomware criminals seeking money, hacktivists looking for attention, opportunistic attackers scanning the internet for exposed devices, or sophisticated actors associated with foreign governments.

The motivation may be different, but the result can be the same: disruption of an essential public service.

EPA’s cybersecurity incident guidance warns that incidents can interfere with treatment, distribution, and conveyance processes; compromise industrial control systems; expose sensitive information; damage components; and disrupt a utility’s ability to provide safe water and wastewater services.

Cybersecurity Has to Reach the Operational Technology Environment

One of the most important conversations municipal leaders should have with their water departments is simple:

What equipment in our water or wastewater operations can be accessed remotely—and who can access it?

The answer may surprise you.

Municipalities should identify every internet-facing or remotely accessible operational technology asset, including HMIs, PLCs, SCADA systems, engineering workstations, remote monitoring equipment, vendor connections, and communications devices.

Then determine whether that connectivity is actually necessary.

Federal guidance recommends restricting internet access to process-control systems unless absolutely necessary, separating operational/process-control traffic from business networks, identifying all methods of remote access, eliminating unnecessary remote connectivity, and tightly restricting whatever access must remain.

This is especially important because attackers do not necessarily need to develop an elaborate attack specifically for a small municipality. Poorly secured internet-connected equipment can provide an opportunity.

In other words, being small does not necessarily make a municipality invisible.

Seven Actions Municipalities Can Take Now

Municipal cybersecurity can quickly become overwhelming, particularly for smaller communities with limited staff and budgets. Rather than trying to solve everything at once, municipal leaders can begin with several practical actions.

1. Know what you have.
Create and maintain an inventory of critical IT and operational technology. Identify PLCs, SCADA servers, HMIs, engineering workstations, remote-access systems, network equipment, computers, software, and communications systems supporting water operations. Document who owns, maintains, and has access to each critical system. CISA has emphasized asset inventories as a foundation for protecting operational technology.

2. Identify and reduce internet exposure.
Determine which devices and systems are accessible from the public internet. If internet connectivity is unnecessary, remove it. Where remote access is operationally necessary, restrict it and protect it appropriately. Reducing exposure to the public-facing internet is the first action highlighted in the federal government’s Top Cyber Actions for Securing Water Systems.

3. Separate IT from OT.
The computer used for email and administrative work should not have unrestricted access to systems controlling pumps, valves, treatment processes, or chemical operations. Network segmentation and firewalls can help prevent a compromise of the municipality’s business network from becoming an operational emergency.

4. Review remote and vendor access.
Municipalities frequently depend upon outside vendors to maintain specialized equipment. That relationship does not eliminate the municipality’s responsibility for understanding how vendors connect to its environment. Ask who has remote access, how accounts are authenticated, whether access is continuously available or enabled only when needed, and how access is removed when an employee or contractor leaves.

5. Prepare to operate manually.
Technology can fail due to cyberattacks, equipment failures, communication outages, or other emergencies. Public works personnel should know how critical operations will continue if SCADA or other automated systems become unavailable. Procedures should be documented, accessible offline, and periodically exercised.

6. Develop and exercise a cyber incident response plan.
Do not wait until an attack occurs to decide who calls the mayor, supervisor, emergency management, law enforcement, regulators, IT provider, cyber insurer, or outside incident-response firm. EPA now provides a customizable Cybersecurity Incident Response Plan specifically for drinking water and wastewater systems. The agency recommends that utilities develop, practice, and regularly update these plans.

7. Assess the system—and turn the findings into a budget.
An assessment sitting on a shelf does not reduce risk. Identify vulnerabilities, prioritize them based on operational consequences, assign responsibility, set deadlines, and determine the required funding. EPA offers both self-assessment resources and a program through which water systems can receive cybersecurity assessments and risk-mitigation assistance.

Questions Elected Officials Should Be Asking

Elected officials do not need to become SCADA engineers or cybersecurity specialists. They do, however, have a responsibility to ask appropriate governance questions.

At an upcoming board or council meeting, consider asking:

  • Do we have a current inventory of our water and wastewater IT and operational technology?
  • Are any PLCs, HMIs, SCADA components, cameras, or other control devices directly accessible from the internet?
  • Who can remotely access our water systems—including outside vendors?
  • Is multifactor authentication required for remote access where technically feasible?
  • Are our administrative IT systems appropriately separated from operational technology?
  • When were our critical systems last assessed for cybersecurity vulnerabilities?
  • Do we maintain secure backups, and have we tested our ability to restore them?
  • Can operators safely maintain essential operations if SCADA or network connectivity becomes unavailable?
  • Do we have a written cyber incident response plan?
  • Has that plan actually been exercised with municipal leadership, public works, IT, emergency management, and other key partners?
  • Who has authority to make critical decisions during an incident?
  • Who must be notified if an incident occurs?
  • What cybersecurity improvements need to be included in the next municipal budget or capital plan?

If municipal leadership cannot readily answer those questions, that is not necessarily evidence that the municipality has failed. It is evidence that a conversation needs to begin.

Put Cybersecurity Into the Emergency Response Plan

Cybersecurity should not exist in isolation from emergency management.

A cyberattack against a water facility could simultaneously become a public works emergency, a public health issue, a communications challenge, a financial event, and a political crisis.

That means the emergency response plan should account for scenarios such as loss of SCADA visibility, manipulation of control systems, loss of communications, compromised employee credentials, ransomware, inability to process customer payments, loss of access to operational data, or suspicious changes to treatment processes.

EPA provides “rip and run” Incident Action Checklists designed specifically to help water and wastewater utilities prepare for, respond to, and recover from cybersecurity incidents.

For community water systems serving more than 3,300 people, federal law also requires risk and resilience assessments and emergency response planning under Section 1433 of the Safe Drinking Water Act, as amended by America’s Water Infrastructure Act. Those emergency plans must incorporate the findings of the system’s risk and resilience assessment and address physical security and cybersecurity.

But compliance should be the starting point—not the finish line.

Cybersecurity Is Also a Budget Conversation

One of the greatest mistakes municipal governments can make is identifying cybersecurity deficiencies without creating a realistic path to correct them.

Public works departments cannot implement improvements without resources.

If an assessment identifies obsolete equipment, unsupported operating systems, insecure remote access, inadequate network segmentation, insufficient backups, or a need for monitoring, those findings should be incorporated into the municipality’s operational and capital planning.

Not everything has to happen in one budget year. Prioritize improvements according to their potential consequences.

Ask: If this system were compromised tomorrow, what could affect our ability to safely provide water or wastewater services?

Start there.

Preparedness Matters More Than Perfection

No municipality can eliminate cyber risk completely.

The objective is resilience.

Can you detect something unusual? Can you isolate affected equipment? Can operators continue critical functions? Can you communicate with the public? Can you quickly reach the right external resources? Can you restore systems safely? And can municipal leaders make informed decisions under pressure?

Those capabilities can dramatically change the outcome of an incident.

Municipal water and wastewater systems are among the most important pieces of infrastructure local government operates. Protecting them requires cooperation between public works, IT professionals, vendors, emergency management, municipal administrators, elected officials, insurers, state partners, and federal agencies.

Cybersecurity cannot belong exclusively to the IT department or the water superintendent.

It has to become part of how the entire municipality thinks about continuity and public safety.

The next cyber incident affecting the water sector may target a large metropolitan utility—or it may begin with an exposed device at a small community water plant.

Municipal leaders cannot control who attempts to attack their systems.

They can control how difficult they make those systems to compromise—and how prepared their community will be if an attacker succeeds.

Resources for Municipal Water and Wastewater Leaders

EPA maintains cybersecurity planning, assessment, incident response, and emergency planning resources specifically for drinking water and wastewater systems.

EPA Cybersecurity for the Water Sector

EPA Cybersecurity Planning and Top Cyber Actions

EPA Risk and Resilience Assessment and Emergency Response Planning Resources

EPA Incident Action Checklists for Water Utilities

CISA’s July 2026 Advisory on Threats to U.S. Water and Wastewater Facilities

Categories
Governance & Funding Public Safety (Police, Fire, EMS)

Safeguarding the 250th: Cybersecurity on the Front Lines

As local communities take center stage for America’s 250th anniversary, mayors, county executives, and city councils face a unique leadership challenge. While municipal teams focus on the visible triumphs of parades, local festivals, and historic tourism, a parallel operational reality demands executive attention.

Large-scale civic milestones carry immense symbolic value, which elevates our towns and counties into high-priority targets for ransomware syndicates, hacktivists, and nation-state adversaries. When thousands of visitors gather in your jurisdiction, a cyber disruption is no longer just an IT headache—it is a direct threat to public safety, fiscal stability, and community trust.

For elected officials and senior administrators, cybersecurity cannot be treated as a hidden line item buried in a tech budget. It is a fundamental pillar of emergency management and risk governance.

Why does the 250th Change the Stakes?

In today’s threat landscape, local governments are primary targets because they manage critical, day-to-day services with highly constrained resources. During a high-visibility historical celebration, a successful digital disruption provides threat actors with maximum leverage.

As a decision-maker, your risk exposure during this milestone spans three operational areas:

  • Public Safety Overload: Local dispatch networks, traffic control systems, and first-responder communications operate under peak strain during mass public gatherings. A distributed denial-of-service (DDoS) attack or ransomware deployment on municipal operational technology (OT) could delay emergency response times exactly when a crowd requires rapid coordination.
  • Public Utility Targets: Water treatment facilities, regional power grids, and local transit networks are prime targets for adversaries aiming to cause maximum community disruption. Many of these environments rely on legacy systems where security models have lagged behind rapid IT-OT integration.
  • Digital Disinformation & Municipal Trust: Ransomware gangs frequently time their data exfiltration and public disclosure threats alongside highly visible civic timelines to maximize leverage. Simultaneously, local government websites and social media channels—trusted by citizens for real-time updates—face heightened risks of defacement or credential hijacking.

The Governance Framework

Protecting your municipality does not require a deep technical background. It requires strong executive governance, targeted resource allocation, and a culture of accountability.

Elected leaders and top executives should evaluate their regional posture across four non-technical, high-impact milestones:

  1. Authorize a Comprehensive Asset Assessment: Governance Phase.

Direct your management team to complete a verified inventory of all municipal digital assets. Your administration must have clear visibility into which systems control public utilities, tax databases, and emergency dispatch before they can be effectively insured or defended.

2. Mandate Identity and Access Policies: Policy Implementation.

Enact executive policies requiring multi-factor authentication (MFA) across all municipal departments. Identity verification remains the most cost-effective barrier against unauthorized network entry, protecting sensitive data from basic credential theft.

3. Leverage Intergovernmental Grant Programs: Fiscal Strategy.

Task your finance team with pursuing state and federal funding vehicles. Utilizing these external capital streams allows your town or county to modernize legacy systems without exhausting local tax revenue.

4. Participate in Unified Tabletop Exercises: Operational Readiness.

Set the tone from the top by actively participating in cross-departmental crisis simulations. Ensure your county executives, police chiefs, utility directors, and public information officers rehearse communication protocols together, establishing clear lines of authority if a network incident occurs.

The Bottom Line

Defending a community does not mean achieving absolute immunity from digital threats; it means ensuring operational resilience. When leadership prioritizes fundamental risk management, establishes clear lines of communication, and builds a culture of readiness, the municipality ensures that its heritage remains the sole focus of the historic celebration.

Cyber resilience is an ongoing investment in your community’s safety. The choices made by elected boards today determine how securely local government functions when the eyes of the region are on your community.

Categories
Governance & Funding Public Safety (Police, Fire, EMS)

CJIS 6.0: Governance for Law Enforcement Leaders

Imagine waking up to a 3:00 AM phone call that instantly makes your blood run cold. It isn’t an officer-involved shooting or a pileup on the interstate—it’s worse. The dispatcher on the line tells you the entire Computer-Aided Dispatch (CAD) system has gone black. Out on the streets, officers are suddenly flying blind, unable to run plates, verify active warrants, or know if the suspect they are pulling over is armed and dangerous. Back at the station, every computer screen goes dark and snaps back on with a terrifying message: hackers have locked down all your files. They are demanding a $1 million ransom in 24 hours, or they will leak the home addresses of your officers, names of your undercover informants, and domestic abuse victims onto the dark web.

For generations, a police chief’s job description was clear-cut: fight crime, protect the community, build public trust, and make sure officers make it home safe at the end of their shift. Today, that entire landscape has been fundamentally altered. In a post-George Floyd era marked by intense public scrutiny, systemic staffing shortages, and heightened anti-police sentiment, the pressure on law enforcement executives is at an all-time high.

While protecting lives on the street remains the top priority, managing these compounding real-world challenges means that ignoring digital threats is no longer just a blind spot—it is a recipe for disaster. Modern chiefs and sheriffs can no longer act solely as tactical commanders; they must realize they are now the gatekeepers of massive, highly sensitive digital networks where a single breach can instantly shatter fragile community trust and compromise the physical safety of their personnel.

With the rollout of the FBI’s Criminal Justice Information Services (CJIS) Security Policy Version 6.0 (slated for full enforcement by October 1, 2027), cybersecurity is no longer an “IT issue” that can be blindly delegated. It is now a critical operational risk. If an agency fails to comply, the consequences are devastating: the FBI can completely cut off their access to vital criminal databases, freeze their federal grants, and strip away key agency partnerships. Beyond the administrative fallout, non-compliance invites catastrophic data breaches, ruined investigations, and massive civil or criminal liabilities for leadership.

Why Law Enforcement is a Prime Target

Law enforcement agencies are no longer just accidental targets caught in broad cyber nets—they are being intentionally hunted. To a sophisticated hacker, a police department is a digital goldmine. The networks maintained by local and state agencies house a concentrated treasure trove of highly sensitive, unredacted data: Social Security numbers, biometric records, active warrants, open homicide files, and the true identities of confidential informants.

Cybercriminals have realized that weaponizing this specific information against public safety infrastructure yields immense leverage. If a bank gets hacked, money is lost; if a police department gets hacked, lives are immediately put in jeopardy. This extreme pressure makes law enforcement agencies highly attractive targets for extortion.

The Critical Risks to the Command

When leadership treats cybersecurity as a secondary priority, they open the door to three devastating structural risks:

Total Operational Paralysis

Cyber criminals deliberately strike police departments because they know law enforcement cannot afford a single minute of downtime. When hackers successfully breach a network, they move fast—state and local government sectors face an overwhelming 98% data encryption rate during successful ransomware attacks.

If your Records Management System (RMS) or CAD system is suddenly locked behind an unbreakable encryption key, your agency plunges into the dark ages. Dispatchers are forced to use pen and paper, response times plummet, and officers on the street lose the ability to pull up critical hazards before entering a scene.

The Expanding Attack Surface

The modern patrol officer is a walking network of connected technology. Between the mobile data terminal (MDT) bolted into the cruiser, body-worn cameras, department-issued smartphones, automated license plate readers (ALPRs), and field tablets, the “attack surface” of a single precinct has exploded exponentially.

Every single one of these endpoints is a potential doorway into your core server room. Cybercriminals don’t need to crack your central firewall if they can exploit an unpatched vulnerability on a single officer’s tablet. Across all sectors, unpatched software vulnerabilities remain the number-one gateway for attackers, triggering 32% of all successful ransomware breaches.

Double Extortion and the Collapse of Trust

The playbook for modern cybercrime has evolved past simple data locking. Today, groups practice “double extortion.” First, they quietly clone and steal (exfiltrate) your entire database; only then do they deploy the ransomware to lock your screens.

For a police chief, this is the ultimate nightmare. Even if you manage to restore your systems from backups without paying a dime, the hackers still hold your data hostage. They will threaten to publish unredacted active wiretaps, sealed juvenile records, or undercover officer identities on public forums.

Worse yet, in today’s highly charged social climate, cybercriminals are actively weaponizing officers’ home addresses, internal affairs files, and disciplinary records. Dumping this information online doesn’t just destroy morale—it puts officers and their families directly in the crossfire. In a post-George Floyd era marked by intense scrutiny and heightened anti-police sentiment, a data leak of personal addresses transforms a digital breach into a terrifying physical threat, exposing an officer’s spouse and children to targeted harassment or worse. The moment that data hits the internet, ongoing criminal prosecutions are permanently compromised, informant networks evaporate, and decades of hard-earned community trust vanish overnight.

The CJIS Shift: Beyond the Checklist

Historically, many agencies treated CJIS compliance as a “point-in-time” chore—filling out a questionnaire, checking a few boxes, and putting it away until the next audit.

CJIS 6.0 completely dismantles that lazy approach. The FBI has overhauled and mapped the entire policy directly to the National Institute of Standards and Technology (NIST) SP 800-53 Moderate Baseline. This alignment forces a complete cultural pivot away from periodic “annual checkups” and straight toward continuous risk management and continuous governance.

Under this framework, law enforcement leaders must command four critical pillars of modern compliance:

  • Stronger Identity and Access Controls: Security parameters have advanced beyond simple password enforcement. Agencies must now verify exactly who an employee is before granting access, manage accounts tightly from their first day to their last, and have the power to instantly lock down a user’s account the second suspicious activity is detected.
  • Expanded Auditing and Evidence: The days of simply telling an auditor “yes, our systems are safe” are over. Under CJIS 6.0, you have to prove it. Agencies must show digital receipts, logs, and actual system data to demonstrate that security rules are actively running, regularly checked, and updated when threats change.
  • Formalized Leadership Governance: True security isn’t achieved by just making an IT technician watch a compliance video. The new rules place the responsibility squarely on leadership. Chiefs and sheriffs must explicitly define who is responsible for what, actively oversee security operations, and sign off on the department’s digital safety strategy.
  • Continuous Risk Tracking: Instead of checking for security gaps once every few years before an audit, departments must now maintain a rolling, real-time list of their digital vulnerabilities. You are required to create an active game plan that tracks exactly how and when you will fix security flaws, showing constant progress over time.

To achieve this baseline, chiefs and sheriffs must urgently enforce three non-negotiable operational requirements:

1. Phishing-Resistant Multi-Factor Authentication (MFA)

The days of relying on simple passwords or easily intercepted text-message codes are officially over. The new rules mandate a much tougher form of multi-factor authentication (MFA) whenever anyone accesses sensitive criminal justice data, especially from a cruiser or a remote location. To keep things moving fast for officers in the field without cutting corners on security, departments are switching to fingerprint scanning, smart cards, or physical USB security keys (like FIDO2 tokens). These tools cannot be bypassed by hackers trying to trick an officer or spam their phone with login approvals.

2. Maximum-Strength Data Encryption (FIPS 140-3 Encryption)

Information flying through the air over cellular networks or public Wi-Fi is incredibly easy for bad actors to intercept. To stop this, the updated rules require agencies to completely phase out older, weaker security methods. Any data moving outside the secure walls of your station must be scrambled using the government’s latest gold standard of protection: FIPS 140-3 encryption. Think of it as an uncrackable digital armored car for your data while it travels from the street to your servers.

3. Isolated Network Segmentation and Physical Security

Great digital firewalls mean nothing if someone can physically walk right up to your computers or if a hacker can slip in through a weak link on the municipality’s network. First, the new policy requires departments to completely separate police data from general municipal data (like the water department or village/town/city/county traffic). If a hacker hits the municipal hall, a digital wall prevents them from jumping over to your police records. Second, the physical rules are strictly enforced: server rooms must be locked down, entryways monitored by cameras 24/7, and any outside technician or contractor stepping inside must clear a full fingerprint-backed background check.

The High Cost of Non-Compliance

For a police chief, ignoring these requirements carries severe operational and political penalties:

Risk CategoryImmediate ImpactLong-Term Consequence
Sanctions & DisconnectionThe FBI or state CJIS systems agency can cut off access to NCIC (National Crime Information Center) and Nlets.Officers are left blind during roadside stops, unable to run plates, check warrants, or verify firearms.
Financial ExtortionRansomware recovery costs average hundreds of thousands of dollars in remediation, even if the ransom is paidLocal tax dollars are diverted from community policing and equipment into emergency IT restoration.
Legal LiabilitiesExposure of sensitive data (like officer records or domestic abuse victim info) triggers devastating civil lawsuits.Decades of built-up community trust vanish overnight under the weight of negligence headlines.

Why Leadership Cannot Simply “Outsource” the Problem

It is common for municipal leaders and police chiefs to pass the buck, saying, “I have a great IT director,” or “We hire a trusted tech vendor to handle all of that.”

While the actual technical work belongs to the tech experts, the ultimate accountability rests squarely on the shoulders of agency leadership. Under CJIS 6.0, the rules explicitly state that chiefs and sheriffs must personally own their agency’s cybersecurity strategy. You must be able to prove to auditors that you are actively tracking your department’s digital risks and making measurable progress to fix them.

When a compliance audit fails, or a catastrophic data breach occurs, the public, the media, and the municipal board aren’t going to call the network administrator to the podium for answers—they are going to demand answers from the Chief.

An Action Plan for Law Enforcement Leaders

Steering an agency through this high-risk digital landscape requires more than just acknowledging the threat; it demands an active, disciplined strategy from the top down. Chiefs and sheriffs can use the following roadmap to protect their networks, shield their personnel, and maintain absolute CJIS compliance:

  1. Map Your Agency’s Total Data Footprint:

Phase 1: The Critical Prerequisite.

You cannot protect what you do not know exists. Leadership must order a comprehensive audit to document exactly how sensitive criminal justice data enters, moves through, and leaves the department. Track every single destination—whether that data lives on a cruiser’s mobile data terminal, a cloud-based records system, a detective’s field tablet, or a desktop at the main precinct. If data is flowing through an unmapped channel, it is an open invitation for a breach.

2. Enforce Leadership-Led Tech Briefings:

Phase 2: Monthly Mandate.

Stop treating the IT department or your third-party technology vendor like an isolated island. Establish a recurring monthly briefing to actively review your security posture. Avoid asking vague, passive questions like “Are we safe?” Tech teams will usually say yes. Instead, ask targeted, specific questions that demand proof:

  • “Can we pull up audit-ready evidence of our MFA compliance right now?”
  • “When was our last critical software patch cycle completed?”
  • “Do we have any unpatched vulnerabilities older than 30 days?”

3. Instill a Culture of Security Awareness:

Phase 3: Continuous Operation.

The most advanced firewall in the world can be bypassed by a single employee clicking a bad link. Security is a continuous human obligation, not a yearly classroom chore. Ensure that every single employee, dispatcher, records clerk, and outside contractor undergoes a comprehensive fingerprint-based background check and completes CJIS security awareness training within six months of their hire date. Follow this up with engaging, mandatory annual refreshers and regular, unannounced internal phishing tests to keep the entire command sharp.

4. Operationalize Your Incident Response:

Phase 4: High-Priority Planning

When a cyberattack hits, confusion is your greatest enemy. Do not wait for a crisis to figure out your chain of command. Implement a formalized, written Cyber Incident Response Plan that explicitly outlines who does what when systems go dark. Under CJIS regulations, certain data breaches must be reported to state and federal authorities within a strict window of discovery. Regularly run tabletop exercises with your leadership team so everyone knows how to isolate systems, notify authorities, and keep emergency operations moving without panic.

The Bottom Line: Cybersecurity is no longer an administrative footnote. It is a foundational element of public safety. A department’s frontline defense is determined just as much by its firewall configurations and access privileges as it is by the tactical gear in its cruisers. Leading an agency requires protecting the data of the citizens who trust you—and the officers who rely on it to come home safe.

Categories
Governance & Funding

Why “Silent Cyber” Should Alarm Local Government

The phrase “cyber risk” often conjures images of corporate data breaches or national espionage. But for municipalities, counties, and local agencies, the threat is far more immediate and complex—especially when considering Silent Cyber.

As local governments digitize records, automate critical infrastructure, and manage massive databases of sensitive resident information, they become prime targets for attackers. However, a major risk lurks not just in the network, but in the fine print of your existing insurance policies.

What is Silent Cyber for a Municipality?

Silent Cyber, or non-affirmative cyber risk, is the danger that a major cyber event—like a ransomware attack or a system breach—could trigger unexpected and massive claims under your municipality’s traditional insurance policies, such as:

  • General Liability
  • Commercial Property
  • Public Officials & Law Enforcement Liability

These policies were not originally written to address digital threats. They are “silent” on the issue, meaning they neither explicitly cover nor explicitly exclude losses caused by a cyber incident. This ambiguity can lead to an unexpected loss for the insurer (if they have to pay a claim they didn’t price for) or a crippling coverage gap for the municipality (if the claim is denied).

Real-World Scenarios for Local Government

For a city or town, a cyber attack is not just about stolen data; it’s about the disruption of essential public services.

Policy TypeCyber-Triggered EventPotential Silent Cyber Loss
Property/EquipmentRansomware infects the Industrial Control System (ICS) managing the water treatment plant, causing mechanical failure and physical damage to pumps.Physical damage to equipment and extended business interruption/loss of utility service income, covered under a policy not priced for cyber risk.
General LiabilityA malicious hack causes the municipal traffic light control system to fail catastrophically, leading to a major vehicle collision and subsequent bodily injury claims.Third-party bodily injury and property damage liability claims caused by the digital disruption of physical infrastructure.
D&O LiabilityA major data breach exposes resident tax and voter records, leading to a class-action lawsuit and an investigation into the Town Board/City Council for failure to maintain adequate security protocols.Litigation and defense costs covered by a Public Officials/ Law Enforcement policy that didn’t factor in cyber risk aggregation.

Historically, the ambiguous wording may have worked in the municipality’s favor. Today, regulators are demanding clarity, and insurers are introducing explicit cyber exclusions to avoid these unforeseen payouts.

Eliminating Ambiguity

As local governments operate on limited budgets, relying on traditional policies to “silently” cover a modern cyber catastrophe is a gamble your residents can’t afford.

Here are the critical steps your administration should take right now:

  1. Stop Relying on Silence: Understand that the days of assuming coverage from general policies are ending. New, clearer exclusions are rapidly being introduced to your insurance forms.
  2. Conduct a Full Policy Audit: Work with your risk manager and broker to review every liability and property policy. Identify the specific cyber exclusions (or lack thereof). Where possible, aim for language that is affirmative—it clearly states what is covered and what is excluded.
  3. Invest in Dedicated Cyber Insurance: A comprehensive, standalone Cyber Insurance Policy is the only way to reliably cover first-party losses unique to municipalities:
    • Ransomware Response: Cost of ransom negotiation, forensic IT, and decryption.
    • Public Notification: Mandated costs for notifying thousands of affected residents after a breach of PII (Personally Identifiable Information).
    • System Restoration: Costs for rebuilding and restoring municipal data and computer systems.

Cybersecurity is no longer just an IT issue; it is a fundamental public safety and fiscal responsibility. By actively addressing “silent cyber,” local government leaders ensure that when the inevitable digital crisis occurs, the city’s financial resilience and ability to serve its citizens are not compromised by an insurance dispute.

Categories
Governance & Funding

Cybersecurity is Financial Risk: The Hidden Million-Dollar Price Tag of Hacking Local Governments

When a cyberattack hits a local government, the price tag goes far beyond ransom demands and new computers. It triggers a financial tsunami of hidden costs that divert taxpayer money from vital public services for years. These aren’t just IT budget line items; they are existential threats to a municipality’s financial stability and ability to serve its citizens.

1. Direct Recovery Costs

The first wave of financial devastation hits during the frantic, high-priced effort to claw back control of municipal systems.

  • Emergency Procurement and Consultant Fees: When systems go dark, normal competitive bidding processes are thrown out the window. Municipalities are forced to hire specialized incident response firms and forensic investigators on an emergency basis, paying premium, last-minute rates to stop the attack, find the root cause, and clean systems.
  • System Rebuild and Replacement: Local governments frequently rely on decades-old, vulnerable infrastructure. Cyber insurance rarely covers the full cost of an upgrade. An attack often forces a massive, unplanned leap into modern infrastructure—costing millions more than any planned capital improvement project.
    • Case in Point: The 2018 Atlanta ransomware attack cost the city an estimated $17 million to recover—a sum equivalent to funding the city’s entire Parks and Recreation budget for a full year. One single breach effectively erased twelve months of community development.

2. Long-Term Financial Damage

The financial markets treat cyber vulnerability as a systemic operational failure, driving up the cost of a municipality’s future operations and debt.

  • Credit Rating Downgrades: Rating agencies like S&P Global and Moody’s view a severe cyberattack as a symptom of weak governance and operational instability. A major breach can trigger a direct downgrade of a municipality’s credit rating.
  • Increased Borrowing Costs: A lower credit rating—or even the public reputation of being digitally vulnerable—makes a municipality a high-risk borrower. When the municipality issues municipal bonds to fund critical infrastructure (like roads, water treatment plants, or schools), it is forced to offer higher interest rates to attract investors.
    • A seemingly minor 0.5% increase in a bond’s interest rate translates into millions of dollars in additional interest payments over a 20- or 30-year term. That is pure capital coming out of the community’s treasury forever.
  • The Cyber Insurance Impact: The insurance market has turned its back on soft targets. Because public entities are viewed as high-risk, local governments face a brutal insurance landscape:
    • Skyrocketing premiums paired with slashed coverage limits.
    • Strict, non-negotiable security mandates (like mandatory multi-factor authentication or EDR) that underfunded municipalities can’t afford to implement.
    • The looming threat of non-renewal leaves the municipality entirely exposed.

3. Operational and Reputational Costs

Some of the most damaging costs are non-financial, yet they have a profound effect on governance and citizen life.

  • Massive Productivity Losses: Municipal staff are idled, unable to perform basic functions like processing permits, managing utility billing, or accessing court records. The municipality continues to pay salaries while operations grind to a total halt.
  • Legal and Regulatory Fines: If the attack involved a data breach, the municipality may face regulatory fines from state or federal agencies (especially if health or law enforcement data was involved). They also face the potential for class-action lawsuits from affected citizens whose Personally Identifiable Information (PII) was exposed.
  • Erosion of Public Trust: When citizens can’t pay their water bill, apply for a license, or receive timely emergency services due to a hack, public confidence in the government plummets. This can hurt everything from voter turnout to bond measure support and the morale of the government workforce.

The true cost of a municipal cyberattack is measured by what the community is forced to abandon. Every dollar handed to a ransomware hacker, an emergency IT consultant, or a bond investor is a dollar stolen from parks, paved streets, public safety, and schools.

Cybersecurity is no longer an IT issue—it is the single most critical form of municipal fiscal risk management.

Categories
Governance & Funding

A Cyber Insurance Briefing for Elected Leaders

In today’s digital landscape, a local government’s data—from citizen records and utility operations to internal communications—is a prime target for cybercriminals. A single ransomware attack or data breach can cripple services, drain resources, and erode public trust.

While strong cybersecurity measures are your first line of defense, Cyber Insurance acts as a crucial safety net, helping your municipality manage the massive financial fallout of a successful attack.

If your village, town, city, county, or public utility is considering or renewing a policy, here is a look at what local governments can expect, the vital differences between what is typically covered versus what isn’t, and the critical questions you must ask your municipality and your broker.

The Six Critical Questions Elected Leaders Must Answer

As an elected leader, your top priority is the continuity of public service and the protection of taxpayer funds. Cyber risk is no longer an “IT problem”—it is a governance and financial crisis waiting to happen. Before you sign a policy, your governing body must confront these fundamental questions about your municipality’s readiness and resilience.

Focus AreaThe Core Question for the Governing BodyThe Bottom Line for Taxpayers
Operational ImpactIf our critical digital systems (email, payroll, utility controls) were locked down by an attack tomorrow, what essential public service would fail immediately?We must know which services—from 911 dispatch to water quality monitoring—are immediately jeopardized. If the lights go out, your response must be immediate.
Downtime ToleranceHow many hours can our municipality sustain a complete disruption of public records and digital services before the damage to the community becomes irreversible?Every hour of downtime multiplies the cost, halts services, and directly erodes public trust. This defines your operational breaking point.
Financial CostWhat is the documented, unbudgeted cost our municipality would face for recovery, separate from any ransom demand?The true expense is in forensic investigation, legal fees, and system restoration. You need a transparent figure on the financial exposure, which often runs into the millions.
Budget ResilienceDo we have an explicitly dedicated and sufficient reserve fund that can absorb an unbudgeted recovery cost of at least $250,000?Most local governments do not. This question forces a review of whether a cyber event would force painful cuts to essential public programs.
Risk StrategyAre we relying only on our technology defenses, or have we established a financial safety net for when those defenses inevitably fail?Technology is a tool, but cyber insurance is the risk transfer mechanism. It is a layer of resilience for a modern public entity.
Governance & AccountabilityWho is the executive-level owner of cyber risk in this municipality, and is a tested incident response plan in place?Cyber risk is a leadership issue. Insurance helps ensure that the highest levels of governance have a clear, tested plan to guide the community through the chaos of a breach.

What is Typically INCLUDED in a Policy?

Cyber policies generally cover three distinct areas:

Coverage AreaWhat is Covered?Examples
First-Party (Breach Response)Who pays the costs for us to recover from the attack?Fees for forensic investigators, legal counsel, system restoration, and paying cyber extortion (ransom) demands (subject to limits).
Third-Party (Liability to Others)Who pays if we get sued or fined for exposing citizen data?Defense costs, settlements, damages from citizen lawsuits, regulatory fines, and costs for notifying all affected individuals.
E-Crime & Financial LossWho pays if a criminal tricks an employee into sending public funds to a fraudulent account?Financial loss from Computer Fraud, Funds Transfer Fraud (e.g., fraudulent vendor invoices), and Social Engineering Fraud.

What is EXCLUDED?

Exclusions can be policy-specific, but there are several common areas where cyber insurance will not provide coverage:

  • Failure to Maintain Minimum Security: Claims can be denied if the breach is traced to your municipality failing to implement a required security measure, such as an unpatched server or not enforcing Multi-Factor Authentication (MFA).
  • Property Damage or Bodily Injury: Physical damage caused by a cyber event (e.g., a hack on a utility system causing a physical failure) may be covered by a General Liability or Property policy, not the cyber policy, unless specifically added.
  • Acts of War or Terrorism: Losses stemming from hostilities or state-sponsored cyber-attacks are often explicitly excluded.
  • Cost of Hardware/Software Upgrades: The policy will pay to restore systems, but generally not for the cost of upgrading to newer technology.
  • Known Vulnerabilities: If a claim arises from a vulnerability your municipality was aware of before the policy inception date, coverage may be denied.

Where Are the Hidden Traps?

The real risk often lies in the fine print. You need to look beyond the general coverage summary and scrutinize the endorsements and warranties within the policy. These items can act as “trap doors” that allow insurers to legally deny a claim.

1. The “Failure to Maintain Security” Clause

This is the most common and dangerous reason for denial today. Many policies contain a clause that makes coverage conditional upon maintaining specific security controls, most notably Multi-Factor Authentication (MFA).

  • The Warranty Trap: If your municipality warrants (guarantees) in the application that 100% of privileged users or remote access points use MFA, and an attack happens through an account that didn’t have it, the insurer may reject the entire claim based on a breach of warranty.
  • The No-MFA Endorsement: A particularly insidious version of this is the MFA Exclusion Endorsement. This endorsement is added to a policy to state that the insurer will not pay any claim that arises from or is attributed to the lack of MFA on specific systems (e.g., all email, remote access, or privileged accounts).
    • What does the No-MFA Endorsement mean for our paid policy? It means you could pay your full premium for a $1 million policy, but if the claim is traced back to a compromised employee email account that lacked MFA, the insurer can legally reject the entire claim. You have the policy, but no coverage for your greatest risk.

Action: Ensure your policy defines required security controls clearly and realistically. If an MFA endorsement is present, treat it as a policy killer unless you are 100% certain every covered access point complies.

2. The Retroactive Date

All policies have a date—the Retroactive Date—before which the insurer will not cover any incident, even if the loss is discovered during the policy period. If a hacker has been in your system for six months and you purchase a policy today, you may not be covered for the full extent of the intrusion. This prevents coverage for “silent data breaches.”

3. The Exclusion for Software/Hardware “Betterment”

After an attack, forensic experts often recommend system upgrades (e.g., replacing an old server or moving to cloud services). Insurers will only pay for the cost of restoring the old system, not the cost of making it “better” or new. Your municipality must be prepared to budget for these betterment costs, which can be substantial and unexpected.

The Six Critical Questions to Ask Your Broker

Cyber insurance should be a true safety net, not a piece of paper. Use these questions to determine if your policy provides the coverage, expertise, and support your community needs.

1. What does the policy cover? What specific security controls are mandatory, and what happens if we fail to maintain them?

Demand a clear list of mandatory controls (like MFA for all remote access). Clarify if non-compliance with a warranty will void the entire policy or only exclude payment for claims related to that specific missing control.

2. What is the annual premium and deductible, and how does this fit our budget risk?

Understand the financial spread: Premiums for municipalities often range from $600 to over $100,000 annually, with deductibles from $1,000 to $100,000. Ensure these costs are sustainable and that the deductible is affordable in a crisis.

3. Does the insurer have demonstrated experience specifically with the public sector?

Government entities have unique challenges: tight budgets, complex regulatory compliance (like state breach laws), and critical services. An experienced insurer will offer tailored coverage that respects these public sector obligations.

4. What loss prevention and risk mitigation services are provided in addition to the coverage?

Look for high-value extras included in the policy: access to incident response hotlines, employee training platforms, vulnerability scans, and tabletop exercises. These proactive services reduce risk and can help lower future premiums.

5. If we report a breach, what is the guaranteed response time, and who is our dedicated contact?

Day to day or in a crisis, you need human support, not an automated line. Ask for a commitment to a response within hours, not days. Confirm you will have access to a cyber specialist or dedicated claims manager or 24/7 breach response team.

6. What is the likely impact of making a claim on our future premiums and coverage availability?

Ask for candor: Will premiums spike after a claim, or will the insurer consider non-renewal? Understanding the long-term relationship ensures you are not penalized for using the safety net you paid for.

Categories
Basics & Actionable Steps Governance & Funding Press Release

Announcing the Local Government Officials Guide to Cybersecurity

We are thrilled to announce the official publication of a critical new resource: the Local Government Officials Guide to Cybersecurity (LGOGC)!

This project was developed by the Local Government Cybersecurity Alliance (LGCA) specifically to empower elected and appointed officials—from supervisors and council members to city managers and agency heads—to effectively navigate the increasingly complex world of cyber risk.

Moving Beyond the Technical Jargon

Cybersecurity is not just an IT department problem; it is an enterprise-wide, whole-of-government issue that impacts finance, legal compliance, emergency services, and public trust.

The LGOGC cuts through technical jargon to focus on what matters most to community leaders: governance, accountability, and resilience. This guide was truly built by and for local government professionals, ensuring every concept is practical and immediately relevant to your fiduciary duty to protect the systems that serve your communities.

LGOGC Cybersecurity Guide (October 2025)Download

What the Guide Will Help You Achieve

The LGOGC provides a clear, actionable framework to help local leaders translate responsibility into practical action. Inside, you’ll find guidance to:

  • Integrate cybersecurity into your strategic and budget planning.
  • Strengthen oversight and reporting mechanisms.
  • Align your efforts with nationally recognized frameworks, such as NIST CSF 2.0.
  • Build a culture of cyber resilience that spans all departments and elected offices.

Download and Share Your Feedback

We believe that making cybersecurity governance as natural and necessary as financial oversight is achievable in every county, city, town, village, and district. This guide is a huge step toward that goal.

Download the Local Government Officials Guide to Cybersecurity (LGOGC) now.

We invite your feedback! Tell us how your jurisdiction is addressing these challenges and what resources would be most valuable to you next in our community forum or white paper.

Categories
Basics & Actionable Steps

Relevant Laws & Compliance Checklists: What Local Governments Need to Know

Cybersecurity laws and regulations are evolving rapidly. For local governments, staying compliant isn’t just about checking boxes—it’s about protecting public trust, ensuring operational continuity, and avoiding costly legal exposure. As the threat landscape changes, so do the legal obligations that govern how municipalities handle data, respond to incidents, and manage third-party risks.

Why Legal Review Matters

Boards and senior leaders must be regularly updated on both existing laws and proposed legislation that could impact current practices. This includes federal mandates, state-specific statutes, and sector-based requirements. Engaging your general counsel or external legal advisors is essential to ensure that your organization remains compliant and prepared.

Legal teams can help:

  • Interpret new regulations and assess their applicability.
  • Identify gaps in current policies and procedures.
  • Draft or revise internal compliance checklists.
  • Advise on risk exposure and liability mitigation.

Federal Laws to Watch

Several federal statutes directly affect state and local governments:

  • Federal Information Security Modernization Act (FISMA): Now applies more stringently to local governments, requiring robust protections for information systems and timely incident reporting.
  • Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA): Requires organizations in critical infrastructure sectors—including many municipal services—to report cyber incidents within 72 hours and ransomware payments within 24 hours.
  • State and Local Government Cybersecurity Act of 2021: Provides federal support through grants, cooperative agreements, and training programs.
  • Federal Rotational Cyber Workforce Program Act of 2021: Encourages talent development and resource sharing across government agencies.

These laws are designed to improve coordination, transparency, and resilience across public sector entities.

State-Level Regulations

Cybersecurity legislation continues to evolve rapidly across the United States. In 2025, 48 states and Puerto Rico introduced or considered more than 500 bills or resolutions related to cybersecurity. These laws reflect growing concerns about ransomware, data breaches, and the need for stronger digital infrastructure in government.

Key Trends and Examples
  • New York: Updated procurement laws now require endpoint device purchases to align with the NIST Cybersecurity Framework. As of 2025/2026, there is a .gov web domain mandate, incident reporting requirements, and a training mandate for local governments.
  • Arkansas: Mandated the Division of Information Systems to maintain cybersecurity policies aligned with state standards.
  • Idaho: Requires all state agencies to implement multifactor authentication and maintain cybersecurity best practices.
  • Mississippi: Established limits on cyber liability claims and introduced new requirements for cybersecurity insurance.
  • Montana: Expanded its workforce development program to include cybersecurity roles beyond entry-level analysts.
  • Hawaii: Adopted resolutions to build cybersecurity education pipelines and strengthen its innovation economy.

These laws vary widely in scope and applicability. Some focus on procurement, others on workforce development, insurance, or incident reporting. Local governments must consult legal counsel to determine which laws apply and how to comply.

Compliance Checklists and Internal Oversight

To manage compliance effectively, local governments should maintain internal checklists that cover:

  • Data classification and retention policies.
  • Incident response and reporting protocols.
  • Vendor risk assessments and contract language.
  • Employee training and awareness programs.
  • Access controls and audit trails.
  • Insurance coverage and legal disclosures.

These checklists should be reviewed and updated regularly, especially when new laws are enacted or existing ones are amended. Legal advisors can help tailor these tools to your organization’s structure, risk profile, and regulatory environment.

Cybersecurity compliance is not one-size-fits-all. Each state may have different laws, and local governments must navigate these requirements with care. Legal review should be a standing agenda item for boards and councils, and compliance checklists should be living documents that evolve with the law.

If your organization hasn’t conducted a legal review recently, now is the time. Engage your legal team, update your checklists, and ensure that your cybersecurity practices are aligned with current and emerging regulations.

Categories
Governance & Funding

Implementing Key Performance Indicators (KPIs): Templates for Cybersecurity Governance

Cybersecurity performance should be measured with clear, objective indicators—not just ad hoc updates or reactive reporting. While IT leadership often bears the burden of communicating cyber risk, boards and executives need structured, strategic insights to make informed decisions—especially during a crisis.

Key performance indicators (KPIs) help organizations:

  • Track progress toward cybersecurity goals.
  • Evaluate the effectiveness of training, insurance coverage, and incident response.
  • Benchmark performance using recognized standards such as NIST, COBIT, ISO 27001, and CIS.

Dashboards that consolidate and visualize these KPIs over time support better governance, resource allocation, and strategic planning.

What Should Cybersecurity KPIs Measure?

KPIs should be relevant, reader-friendly, and designed to convey meaning, highlight change, and enable dialogue. Recommended categories include:

  • Security Incidents: Frequency, severity, and trends.
  • Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR): Indicators of monitoring and response effectiveness.
  • Vulnerability Management: Number of vulnerabilities identified, severity ratings, and remediation timelines.
  • User Awareness: Training completion rates, phishing simulation results, and incidents caused by user error.
  • Compliance Metrics: Audit results, system alignment with standards, and resolved violations.
  • Budget Allocation: Spending breakdowns, comparisons with peer organizations, and funding gaps.

These metrics should be presented in concise, visual formats that support decision-making without overwhelming non-technical audiences.

14 Cybersecurity KPIs to Track in Vendor Risk Management

To demonstrate vendor risk management efforts, organizations should track these 14 KPIs. Each is framed as a question to guide performance improvement and stakeholder reporting.

1. Level of Preparedness

How well is your organization equipped to prevent, detect, and respond to threats?
Includes metrics like:

  • Number of incidents resolved.
  • Frequency of phishing simulations.
  • Patch coverage and backup testing.
  • Security awareness training participation.

2. Unidentified Devices on Internal Networks

How many devices are untracked or unauthorized?
Includes:

  • Asset inventory accuracy.
  • IoT and BYOD security.
  • Rogue access point detection.

3. Intrusion Attempts

How many unauthorized access attempts were blocked?
Includes:

  • IDS/IPS performance.
  • Firewall logs.
  • Investigation and escalation timelines.

4. Security Incidents

What types of incidents occurred and what was their impact?
Includes:

  • Incident frequency and resolution time.
  • Root cause analysis.
  • Downtime and financial impact.

5. Mean Time to Detect (MTTD)

How quickly are threats identified?
Includes:

  • Average detection time.
  • Alert triage and prioritization.
  • False positive/negative rates.

6. Mean Time to Resolve (MTTR)

How long does full remediation take?
Includes:

  • Response coordination.
  • Root cause identification.
  • Restoration and stakeholder communication.

7. Mean Time to Contain (MTTC)

How fast are threats isolated?
Includes:

  • Containment effectiveness.
  • Cross-department coordination.
  • Reduction in incident frequency and cost.

8. First-Party Security Ratings

What is your organization’s current security score?
Includes:

  • Benchmark comparisons.
  • Rating trends.
  • Improvement actions.

9. Average Vendor Security Rating

How secure are your vendors?
Includes:

  • Vendor tiering and reassessment.
  • Rating systems and monitoring.
  • Communication of issues.

10. Patching Cadence

How frequently are patches applied?
Includes:

  • Patch prioritization.
  • Legacy system management.
  • Patch validation and exceptions.

11. Access Management

How well is access to sensitive systems controlled?
Includes:

  • MFA implementation.
  • Privileged account controls.
  • Access audits and training.

12. Company vs Peer Performance

How does your security posture compare to peers?
Includes:

  • Benchmarking KPIs.
  • Competitive intelligence.
  • Strategy alignment.

13. Vendor Patching Cadence

Are vendors patching vulnerabilities promptly?
Includes:

  • Scan frequency.
  • Remediation tracking.
  • SLA enforcement.

14. Mean Time for Vendor Incident Response

How fast do vendors respond to incidents?
Includes:

  • MTTR tracking.
  • Coordination and communication.
  • SLA monitoring.

Best Practices for KPI Implementation

  1. Align KPIs with Strategic Goals
    Ensure indicators reflect organizational priorities and risk appetite.
  2. Use Recognized Standards
    Benchmark against frameworks like NIST CSF, ISO 27001, and CIS Controls.
  3. Automate Data Collection
    Use tools that integrate with existing systems to streamline reporting.
  4. Update Dashboards Regularly
    Maintain relevance by refreshing data and adjusting metrics as threats evolve.
  5. Tailor Dashboards to the Audience
    Provide executive summaries for leadership and detailed views for technical teams.
Categories
Governance & Funding

Risk-Based Prioritization and Investment for Local Government Cybersecurity

Cybersecurity is no longer just a technical concern—it’s a strategic imperative. For local governments, the challenge lies in balancing limited resources with escalating threats. A risk-based approach to cybersecurity investment ensures that spending is aligned with the most pressing vulnerabilities and organizational priorities.

Understanding the Threat Landscape

Boards and councils must be regularly briefed on the evolving threat landscape. This includes identifying threat actors—such as cybercriminals, nation-state actors, and insiders—and understanding the types of attacks they may launch, from ransomware and phishing to denial-of-service and supply chain exploits. Management should assess the potential impact of these threats on operations, finances, and public trust.

Conducting Risk Assessments

A formal risk assessment report should be presented at least annually. This report must:

  • Identify key cyber risks.
  • Evaluate the likelihood and impact of each risk.
  • Describe existing controls and mitigation strategies.

This process helps prioritize investments and ensures that cybersecurity efforts are focused on the most critical areas.

Ensuring Compliance

Boards must be kept informed about the organization’s compliance with relevant regulations, frameworks (e.g., NIST CSF), and best practices. Annual updates should include:

  • A summary of compliance status.
  • Identification of gaps or deficiencies.
  • An action plan to address issues.

This transparency supports accountability and helps align cybersecurity with legal and regulatory obligations.

Incident Response Planning

Management should report on the organization’s incident response capabilities, including:

  • Recent incidents and how they were handled.
  • Lessons learned from internal and external events.
  • Updates to the incident response plan.

Effective incident response planning includes defined roles, escalation paths, and playbooks for common scenarios like ransomware or data breaches.

Promoting Cybersecurity Awareness

Cybersecurity is everyone’s responsibility. Boards should receive updates on awareness programs, including:

  • Training participation rates.
  • Results of phishing simulations.
  • Cultural initiatives to foster security-minded behavior.

Evaluating the effectiveness of these programs helps identify areas for improvement and reinforces a proactive security culture.

Budget and Resource Allocation

Cybersecurity budgets must be clearly communicated to decision-makers. Reports should include:

  • Budget comparisons with peer organizations.
  • Allocation breakdowns.
  • Identified constraints and funding needs.

This ensures that financial decisions are informed by risk exposure and strategic priorities.

Using Security Metrics to Drive Decisions

Metrics should be relevant, concise, and actionable. Key metrics include:

  • Number of Security Incidents: Tracks frequency and severity.
  • Mean Time to Detect (MTTD): Measures detection speed.
  • Mean Time to Respond (MTTR): Assesses response efficiency.
  • Vulnerability Management: Tracks identification and remediation.
  • User Awareness: Evaluates training effectiveness.
  • Compliance Metrics: Monitors adherence to standards.

These metrics should be presented in a format that enables discussion and supports strategic decision-making.

Balancing Spending with Risk

A risk-based investment strategy helps prioritize cybersecurity initiatives based on threat likelihood and impact. This approach avoids overspending on low-impact risks and ensures that resources are directed toward protecting high-value assets. Boards should understand the methodology behind budget decisions and how spending aligns with risk management goals 

Sign In

Don't have an account yet? Register

Forgot password?

Register

Reset Password

Please enter your username or email address, you will receive a link to create a new password via email.