Tag: security

Categories
Budgeting & Resources

Cybersecurity Budgets Shouldn’t Be a Black Box

When local officials review the annual budget, they routinely make decisions involving millions of taxpayer dollars. They debate staffing levels, infrastructure projects, pension obligations, public safety priorities, and capital improvements. These decisions often involve weighing competing priorities and determining how much risk the organization is willing to accept. Then they arrive at the cybersecurity budget.

Too often, what they see is a single line item buried somewhere within Information Technology.

Cybersecurity: $1,500,000

What exactly does that mean?

Is the organization investing in prevention or merely reacting to incidents? Are critical systems adequately protected? Are emergency response capabilities sufficient? Is the municipality able to recover quickly from a ransomware attack? Most importantly, how can elected officials determine whether the proposed expenditures align with the organization’s cyber risk tolerance? The honest answer is that they often cannot.

This creates a significant governance challenge. Local officials have a fiduciary duty to protect public assets, ensure continuity of services, and maintain public trust. In today’s digital environment, that responsibility includes cybersecurity. As the Local Government Officials Guide to Cybersecurity notes, cybersecurity is no longer simply an IT issue—it is a strategic, enterprise-level risk that requires leadership engagement.

Yet many governing bodies are expected to approve cybersecurity budgets without a meaningful way to understand how those expenditures reduce organizational risk.

The result is predictable. Some organizations underinvest because decision-makers cannot see the connection between spending and risk reduction. Others overspend in areas that may not represent their greatest vulnerabilities. Still others make decisions reactively, increasing funding only after experiencing a major incident. There is a better approach.

Using NIST CSF 2.0 as a Budget Framework

The National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 provides a practical structure that helps local governments translate cybersecurity spending into governance language. Its six core functions are not technical product categories; they are high-level objectives for cyber resilience. Rather than debating specific technologies, cybersecurity activities can be organized around six conceptually straightforward objectives:

  • Govern
  • Identify
  • Protect
  • Detect
  • Respond
  • Recover

These functions provide a common language that bridges the gap between technical professionals and governing bodies.

Most elected officials do not need to understand the differences between endpoint detection platforms, security information and event management tools, or intrusion prevention systems. However, they do understand questions such as:

  • Are we effectively detecting cyberattacks?
  • Can we respond quickly enough to minimize damage?
  • Do we have the ability to recover critical services after a disruption?
  • Are we investing appropriately in governance and risk management?

Those are governance discussions.

Connecting Spending to Risk

Imagine that, alongside the proposed budget, the governing body received a cybersecurity assessment aligned with the NIST Cybersecurity Framework. The assessment might indicate that the organization demonstrates relatively strong capabilities in Protect and Recover, moderate maturity in Govern and Identify, but significant gaps in Detect and Respond. Suddenly, the conversation changes.

Instead of asking, “Why do you need another cybersecurity tool?” officials can ask:

“Our assessment shows that our ability to detect malicious activity is weak. How does this proposed investment improve that capability?”

The discussion shifts from technology purchases to risk management. Current expenditures, proposed expenditures, and assessment results can all be aligned under the six NIST functions. Decision-makers gain visibility into where resources are being allocated and whether those investments address areas of greatest concern. This allows governing bodies to exercise one of their most important responsibilities: setting organizational risk appetite.

Defining Risk Appetite

No organization can eliminate cyber risk entirely. Just as local governments accept certain financial, operational, and legal risks in pursuit of their mission, they must also determine what level of cyber risk they are willing to tolerate.

That determination belongs to leadership. Technical staff can explain vulnerabilities and recommend mitigation strategies. Auditors and assessors can provide independent evaluations of current capabilities. However, elected officials ultimately decide whether the residual risk is acceptable based on community priorities, available resources, and competing obligations.

The challenge is that these decisions require understandable information. A single cybersecurity line item does not provide that information. A budget structured around the six NIST objectives does.

From Technical Details to Governance Discussions

Consider two different budget presentations. The first includes line items for firewalls, endpoint detection software, log management platforms, and threat intelligence subscriptions. Typically in a single line item, like the one above. The second shows:

NIST FunctionRisk RatingCurrent SpendingProposed Spending
GovernModerate$75,000$100,000
IdentifyModerate$125,000$150,000
ProtectLow$500,000$525,000
DetectHigh$150,000$325,000
RespondHigh$100,000$250,000
RecoverModerate$200,000$225,000

Which presentation is more useful to a city council member, county supervisor, or special district board? The answer is obvious. The second presentation enables leaders to understand where risks exist, how resources are being allocated, and whether proposed expenditures align with the organization’s stated risk tolerance. It elevates cybersecurity from an operational discussion to a strategic one.

Building Better Governance

The NIST Cybersecurity Framework was never intended to be just a technical resource. It provides a structure for understanding and managing cybersecurity risk across the enterprise. By aligning cybersecurity expenditures with the six NIST CSF 2.0 functions, local governments can transform budget discussions into meaningful governance conversations.

Officials gain the ability to:

  • See how cybersecurity investments address material risks.
  • Understand the relationship between spending and organizational resilience.
  • Prioritize funding based on independent assessments.
  • Establish and communicate risk appetite.
  • Exercise effective oversight without becoming technical experts.

In short, they gain the information necessary to fulfill their fiduciary responsibilities. Cybersecurity should never be a black box. Local government leaders deserve clear, actionable information that helps them govern wisely, steward public resources responsibly, and strengthen the resilience of the communities they serve. If cybersecurity is truly an enterprise risk, as we increasingly recognize it to be, then our budgets should reflect that reality.

Perhaps it is time to stop asking, “How much are we spending on cybersecurity?” And instead begin asking, “What risks are we reducing, and are we investing where it matters most?”

Help is on the Way

The Local Government Cybersecurity Alliance (LGCA) is currently developing a whitepaper that explores this concept in greater depth, providing practical guidance for local governments seeking to align cybersecurity budgets with the NIST Cybersecurity Framework 2.0. The goal is to equip elected officials, executives, finance officers, and cybersecurity leaders with a common language for discussing cyber risk, prioritizing investments, and making informed, risk-based decisions. By connecting assessment results to budget allocations, local governments can move beyond viewing cybersecurity as a technical expense and begin managing it as the enterprise risk it truly is. We believe this approach has the potential to transform cybersecurity budgeting from an opaque line item into a transparent governance tool that strengthens resilience, accountability, and public trust.

Categories
Budgeting & Resources Leadership & Governance

You Paid For The Lock — Now USE IT!

The Gap Between Owning & Fully “Implemented” Cyber Tooling You Already Own

You fought for the budget. You built the business case, presented the risk landscape to leadership, justified every line item, and won cybersecurity funding. New tools were purchased — Identity and Access Management, advanced EDR/XDR, SIEM and more. Boxes checked. Audit requirements are satisfied. A genuine win.

But here is the uncomfortable question nobody asks in the post-purchase debrief: did you actually fully implement them?

Not install. Not license. Implement — fully configured, integrated into your architecture, with every feature activated, monitored and tested. Because there is a dangerous gap between owning a security tool and deriving security from it. And that gap is exactly where attackers live.

Only 14%of organizations are confident they have the people and skills required to meet their cybersecurity needs today — WEF Global Cybersecurity Outlook 2025

The Stryker Wake-Up Call

On March 11, 2026, medical technology giant Stryker suffered a devastating cyberattack that wiped data from thousands of employee and personal devices across 79 offices worldwide. The attackers — an Iran-linked group — did not deploy malware. They did not exploit a zero-day vulnerability. They simply obtained high-privilege administrative credentials and weaponized Microsoft Intune’s Remote Wipe feature, a legitimate IT management tool built for lost or stolen device recovery, to factory-reset tens of thousands of enrolled devices simultaneously.

The lesson is not that Intune is dangerous. The lesson is that privileged access was not properly governed, identity boundaries between on-premises and cloud environments were not enforced, and monitoring either did not exist or did not trigger fast enough. All of these are configuration failures in tools organizations already owned.

The attackers did not break in through a sophisticated exploit. They walked through a door left open by an incomplete implementation.

The Preparedness Gap Is Real — and Growing

The Stryker attack is not an anomaly. It is a symptom of an industry-wide crisis that the World Economic Forum’s (WEF) Global Cybersecurity Outlook 2025 has quantified and it is sobering.

72%of organizations report that cyber risks increased in the past year — WEF Global Cybersecurity Outlook 2025
2 in 3organizations report moderate-to-critical cybersecurity skills gaps, lacking the talent needed to meet their security requirements — WEF Global Cybersecurity Outlook 2025
54%of large organizations cite third-party and supply chain risk management as their biggest barrier to achieving cyber resilience — WEF Global Cybersecurity Outlook 2025
35%of small organizations believe their cyber resilience is inadequate — a proportion that has increased sevenfold since 2022 — WEF Global Cybersecurity Outlook 2025

These numbers describe an industry buying security and not implementing it. Organizations are acquiring the tools, but the talent, architecture, and operational discipline needed to extract full value from those investments is not keeping pace. The result is a fleet of half-deployed, partially configured tools that create a false sense of security while leaving real gaps wide open.

The Agentic AI Threat Multiplier

Attackers are not waiting for organizations to catch up. Generative AI is reshaping the cybercrime landscape at an accelerating pace and the gap between offense and defense is widening.

47%of organizations cite the advance of adversarial AI capabilities — including AI-enhanced phishing, malware development and deepfakes — as their primary GenAI cybersecurity concern — WEF 2025
66%of organizations believe AI will have the most significant impact on cybersecurity in the next 12 months, yet only 37% have processes in place to assess the security of AI tools before deployment — WEF 2025

In an Agentic AI attack scenario where AI autonomously chains together reconnaissance, credential harvesting, lateral movement and execution — a monolithic, single-vendor security stack is a structural liability. If the attacker understands your provider’s architecture better than you do, and your tools are not fully configured, they will find the path of least resistance.

This is not hypothetical. It is the architecture of the Stryker attack, translated into the AI era.

Do You Have the Talent to Use What You Bought?

Before the next purchase order is signed, every security leader, technical and executive alike, should answer these questions honestly:

  • Do we have in-house expertise to fully configure and operationalize the features in our existing tools?
  • Was our tool selection driven by a holistic architecture strategy, or were tools purchased reactively to satisfy an audit requirement?
  • Are all features within our EDR/XDR, IAM, and SIEM platforms fully activated, integrated, and effectively monitored?
  • Do we have unified, normalized logging across every layer of our technology stack feeding a well-configured and monitored dashboard?
  • Is every vendor connection to our environment governed by Zero Trust principles — remote browser isolation, VPN-less access, and Just-In-Time privileged access with approval notification chains configured?

If the honest answer to any of these is ‘no’ or ‘I’m not sure,’ you are not alone — but you are exposed.

A Layered, Heterogeneous Defense: The Architecture That Holds

A monolithic, single-vendor solution may be cost-effective and operationally convenient. But in an Agentic AI threat environment, it is a single point of architectural failure. A breach that understands one vendor’s toolset can traverse your entire environment.

A heterogeneous, layered defense, built intentionally, implemented fully, and integrated across every layer of your stack is a fundamentally different proposition for an attacker. When one protective layer is compromised, the next one holds. The following architecture has proven itself in real-world attack scenarios:

External Perimeter

  • SASE and next-generation firewall with full north-south traffic decryption and inspection and integrated real time defense
  • Advanced API gateways for all internet-facing applications with bot detection and agentic AI defense capabilities
  • All vendor and third-party remote access governed exclusively through remote browser isolation and VPN-less Zero Trust Network Access (ZTNA)

Internal Network

  • Switch-to-switch encryption across internal network segments
  • Micro-segmentation with east-west firewall inspection, full traffic decryption, and XDR/API integration with network admission control policies
  • Patch panel and port-level monitoring via MAC device admission control with logging and firewall integration feeding XDR

Endpoint

  • EDR/XDR deployed with all features fully activated
  • Consider stacking heterogeneous endpoint agents from different vendors — if one provider’s agent is compromised or bypassed, a second independent layer remains active

Identity and Privileged Access

  • Isolate privileged identities: on-premises admins must not carry high-privilege roles in Microsoft 365 or Entra ID — a critical lesson from the Stryker attack
  • Deploy Entra Private Access for Domain Controllers, extending Conditional Access and MFA requirements to sensitive Active Directory operations including LDAP and Kerberos
  • Implement Just-In-Time (JIT) access with approval workflows for all privileged identity management (PIM) accounts
  • Replace manual service account passwords with Active Directory Group Managed Service Accounts (gMSAs)
  • Rotate the KRBTGT password at minimum twice per year; in a breach scenario, rotate immediately — do not wait
  • Restrict all Domain Controller network access; ensure DCs cannot directly reach the internet
  • Audit and enforce strict anomaly monitoring across all security logs

Cloud Security

  • Conduct cloud security posture reviews frequently — cloud providers release new security features continuously; newly available controls should be assessed and implemented as a priority, not deferred
  • Consider disabling Password Hash Sync to keep credential validation on-premises through pass-through authentication or federation
  • All Saas tenant entry points should be isolated to just your agency IP block, with access for remote users only via browser based isolation and ZTNA solutions and fronted by advanced application gateways or proxies
A layered, heterogeneous defense does not require unlimited budget. It requires deliberate architecture and full implementation of the tools you already own.

How to Close the Configuration Gap Without Starting Over

1. Request a Free Implementation Assessment From Your Vendors

Most enterprise security vendors will conduct a complimentary implementation health check if asked directly. They will identify misconfigured features, unused capabilities, and integration gaps. Many will also provide staff education sessions at no additional cost. This is one of the highest-ROI actions available to any security team and it costs nothing but time.

2. Consider an MSP With Cybersecurity Depth

If in-house talent is the constraint — and the WEF data confirms it is for the majority of organizations — a Managed Security Service Provider (MSSP) with genuine cybersecurity staff, 24/7 monitoring capabilities, and a contractual cyber retainer for incident response is not a cost; it is a force multiplier. The right MSSP partner helps you operationalize the tools you already own and ensures that someone is watching when your team cannot be.

3. Build a Unified Visibility Layer

Every device, every endpoint, every cloud workload, every network segment should feed normalized logs into a centralized, well-configured SIEM or XDR dashboard. Visibility gaps are where attackers operate undetected. Unified logging is not glamorous, but it is foundational.

4. Prioritize Identity Above All Else

The Stryker attack was an identity attack. The WEF report confirms that identity theft has become the top personal cyber risk for both CISOs and CEOs in 2025. If you can only harden one area this quarter, harden identity: implement JIT access, enforce MFA everywhere without exception, isolate privileged accounts, and audit every administrative role in both your on-premises and cloud environments.

5. Review Attack Anatomy Regularly

An easy way to have a leg up on all attacks is to regularly review the anatomy of attacks.  This is a free and easy way to identify gaps within your architecture and alerting.  You can implement additional custom alerts from the indicators of compromise you review in attack anatomy, address configuration updates and hardening, and review with your team or your Managed Service Provider.  Attack review should be part of your day-to-day operations.  You cannot protect against what you do not understand.  Also, you cannot harden architecture if you have not operationalized architecture review.

The Bottom Line

The cybersecurity industry has a spending problem masquerading as a security problem. Organizations are acquiring tools at scale while the skills gap required to effectively implement them grows faster than the workforce can fill it. The result is a fleet of expensive, partially deployed technology that creates compliance confidence without creating actual resilience.

The WEF Global Cybersecurity Outlook 2025 reports that 49% of public-sector organizations lack the talent to meet their cybersecurity goals — an increase of 33% in a single year. The private sector is not immune.

The answer is not more tools. It is full implementation of the tools you already own, a deliberate layered heterogeneous architecture designed to survive a breach of any single component, and the operational talent — whether in-house or through a trusted partner — to run it.

You paid for the lock.

Now use it.

About the Author

Eudora Fleischman  |  Infrastructure Architect & Retired CISO Eudora Fleischman is the Infrastructure Architect and Retired with over 31 years of experience in infrastructure architecture, cybersecurity, governance risk, and disaster recovery management and serves as an Advising Member of the Local Government Cybersecurity Alliance.

Sources

World Economic Forum — Global Cybersecurity Outlook 2025 (January 2025, in collaboration with Accenture)

Stryker SEC Filing & Incident Reports, March 2026

Categories
Budgeting & Resources Key Questions for Boards Leadership & Governance Planning & Policy

A Cyber Insurance Briefing for Elected Leaders

In today’s digital landscape, a local government’s data—from citizen records and utility operations to internal communications—is a prime target for cybercriminals. A single ransomware attack or data breach can cripple services, drain resources, and erode public trust.

While strong cybersecurity measures are your first line of defense, Cyber Insurance acts as a crucial safety net, helping your municipality manage the massive financial fallout of a successful attack.

If your village, town, city, county, or public utility is considering or renewing a policy, here is a look at what local governments can expect, the vital differences between what is typically covered versus what isn’t, and the critical questions you must ask your municipality and your broker.

The Six Critical Questions Elected Leaders Must Answer

As an elected leader, your top priority is the continuity of public service and the protection of taxpayer funds. Cyber risk is no longer an “IT problem”—it is a governance and financial crisis waiting to happen. Before you sign a policy, your governing body must confront these fundamental questions about your municipality’s readiness and resilience.

Focus AreaThe Core Question for the Governing BodyThe Bottom Line for Taxpayers
Operational ImpactIf our critical digital systems (email, payroll, utility controls) were locked down by an attack tomorrow, what essential public service would fail immediately?We must know which services—from 911 dispatch to water quality monitoring—are immediately jeopardized. If the lights go out, your response must be immediate.
Downtime ToleranceHow many hours can our municipality sustain a complete disruption of public records and digital services before the damage to the community becomes irreversible?Every hour of downtime multiplies the cost, halts services, and directly erodes public trust. This defines your operational breaking point.
Financial CostWhat is the documented, unbudgeted cost our municipality would face for recovery, separate from any ransom demand?The true expense is in forensic investigation, legal fees, and system restoration. You need a transparent figure on the financial exposure, which often runs into the millions.
Budget ResilienceDo we have an explicitly dedicated and sufficient reserve fund that can absorb an unbudgeted recovery cost of at least $250,000?Most local governments do not. This question forces a review of whether a cyber event would force painful cuts to essential public programs.
Risk StrategyAre we relying only on our technology defenses, or have we established a financial safety net for when those defenses inevitably fail?Technology is a tool, but cyber insurance is the risk transfer mechanism. It is a layer of resilience for a modern public entity.
Governance & AccountabilityWho is the executive-level owner of cyber risk in this municipality, and is a tested incident response plan in place?Cyber risk is a leadership issue. Insurance helps ensure that the highest levels of governance have a clear, tested plan to guide the community through the chaos of a breach.

What is Typically INCLUDED in a Policy?

Cyber policies generally cover three distinct areas:

Coverage AreaWhat is Covered?Examples
First-Party (Breach Response)Who pays the costs for us to recover from the attack?Fees for forensic investigators, legal counsel, system restoration, and paying cyber extortion (ransom) demands (subject to limits).
Third-Party (Liability to Others)Who pays if we get sued or fined for exposing citizen data?Defense costs, settlements, damages from citizen lawsuits, regulatory fines, and costs for notifying all affected individuals.
E-Crime & Financial LossWho pays if a criminal tricks an employee into sending public funds to a fraudulent account?Financial loss from Computer Fraud, Funds Transfer Fraud (e.g., fraudulent vendor invoices), and Social Engineering Fraud.

What is EXCLUDED?

Exclusions can be policy-specific, but there are several common areas where cyber insurance will not provide coverage:

  • Failure to Maintain Minimum Security: Claims can be denied if the breach is traced to your municipality failing to implement a required security measure, such as an unpatched server or not enforcing Multi-Factor Authentication (MFA).
  • Property Damage or Bodily Injury: Physical damage caused by a cyber event (e.g., a hack on a utility system causing a physical failure) may be covered by a General Liability or Property policy, not the cyber policy, unless specifically added.
  • Acts of War or Terrorism: Losses stemming from hostilities or state-sponsored cyber-attacks are often explicitly excluded.
  • Cost of Hardware/Software Upgrades: The policy will pay to restore systems, but generally not for the cost of upgrading to newer technology.
  • Known Vulnerabilities: If a claim arises from a vulnerability your municipality was aware of before the policy inception date, coverage may be denied.

Where Are the Hidden Traps?

The real risk often lies in the fine print. You need to look beyond the general coverage summary and scrutinize the endorsements and warranties within the policy. These items can act as “trap doors” that allow insurers to legally deny a claim.

1. The “Failure to Maintain Security” Clause

This is the most common and dangerous reason for denial today. Many policies contain a clause that makes coverage conditional upon maintaining specific security controls, most notably Multi-Factor Authentication (MFA).

  • The Warranty Trap: If your municipality warrants (guarantees) in the application that 100% of privileged users or remote access points use MFA, and an attack happens through an account that didn’t have it, the insurer may reject the entire claim based on a breach of warranty.
  • The No-MFA Endorsement: A particularly insidious version of this is the MFA Exclusion Endorsement. This endorsement is added to a policy to state that the insurer will not pay any claim that arises from or is attributed to the lack of MFA on specific systems (e.g., all email, remote access, or privileged accounts).
    • What does the No-MFA Endorsement mean for our paid policy? It means you could pay your full premium for a $1 million policy, but if the claim is traced back to a compromised employee email account that lacked MFA, the insurer can legally reject the entire claim. You have the policy, but no coverage for your greatest risk.

Action: Ensure your policy defines required security controls clearly and realistically. If an MFA endorsement is present, treat it as a policy killer unless you are 100% certain every covered access point complies.

2. The Retroactive Date

All policies have a date—the Retroactive Date—before which the insurer will not cover any incident, even if the loss is discovered during the policy period. If a hacker has been in your system for six months and you purchase a policy today, you may not be covered for the full extent of the intrusion. This prevents coverage for “silent data breaches.”

3. The Exclusion for Software/Hardware “Betterment”

After an attack, forensic experts often recommend system upgrades (e.g., replacing an old server or moving to cloud services). Insurers will only pay for the cost of restoring the old system, not the cost of making it “better” or new. Your municipality must be prepared to budget for these betterment costs, which can be substantial and unexpected.

The Six Critical Questions to Ask Your Broker

Cyber insurance should be a true safety net, not a piece of paper. Use these questions to determine if your policy provides the coverage, expertise, and support your community needs.

1. What does the policy cover? What specific security controls are mandatory, and what happens if we fail to maintain them?

Demand a clear list of mandatory controls (like MFA for all remote access). Clarify if non-compliance with a warranty will void the entire policy or only exclude payment for claims related to that specific missing control.

2. What is the annual premium and deductible, and how does this fit our budget risk?

Understand the financial spread: Premiums for municipalities often range from $600 to over $100,000 annually, with deductibles from $1,000 to $100,000. Ensure these costs are sustainable and that the deductible is affordable in a crisis.

3. Does the insurer have demonstrated experience specifically with the public sector?

Government entities have unique challenges: tight budgets, complex regulatory compliance (like state breach laws), and critical services. An experienced insurer will offer tailored coverage that respects these public sector obligations.

4. What loss prevention and risk mitigation services are provided in addition to the coverage?

Look for high-value extras included in the policy: access to incident response hotlines, employee training platforms, vulnerability scans, and tabletop exercises. These proactive services reduce risk and can help lower future premiums.

5. If we report a breach, what is the guaranteed response time, and who is our dedicated contact?

Day to day or in a crisis, you need human support, not an automated line. Ask for a commitment to a response within hours, not days. Confirm you will have access to a cyber specialist or dedicated claims manager or 24/7 breach response team.

6. What is the likely impact of making a claim on our future premiums and coverage availability?

Ask for candor: Will premiums spike after a claim, or will the insurer consider non-renewal? Understanding the long-term relationship ensures you are not penalized for using the safety net you paid for.

Categories
Actionable Steps Budgeting & Resources Cybersecurity Basics Leadership & Governance Planning & Policy Press Release Tools & Guidance

Announcing the Local Government Officials Guide to Cybersecurity

We are thrilled to announce the official publication of a critical new resource: the Local Government Officials Guide to Cybersecurity (LGOGC)!

This project was developed by the Local Government Cybersecurity Alliance (LGCA) specifically to empower elected and appointed officials—from supervisors and council members to city managers and agency heads—to effectively navigate the increasingly complex world of cyber risk.

Moving Beyond the Technical Jargon

Cybersecurity is not just an IT department problem; it is an enterprise-wide, whole-of-government issue that impacts finance, legal compliance, emergency services, and public trust.

The LGOGC cuts through technical jargon to focus on what matters most to community leaders: governance, accountability, and resilience. This guide was truly built by and for local government professionals, ensuring every concept is practical and immediately relevant to your fiduciary duty to protect the systems that serve your communities.

LGOGC Cybersecurity Guide (October 2025)Download

What the Guide Will Help You Achieve

The LGOGC provides a clear, actionable framework to help local leaders translate responsibility into practical action. Inside, you’ll find guidance to:

  • Integrate cybersecurity into your strategic and budget planning.
  • Strengthen oversight and reporting mechanisms.
  • Align your efforts with nationally recognized frameworks, such as NIST CSF 2.0.
  • Build a culture of cyber resilience that spans all departments and elected offices.

Download and Share Your Feedback

We believe that making cybersecurity governance as natural and necessary as financial oversight is achievable in every county, city, town, village, and district. This guide is a huge step toward that goal.

Download the Local Government Officials Guide to Cybersecurity (LGOGC) now.

We invite your feedback! Tell us how your jurisdiction is addressing these challenges and what resources would be most valuable to you next in our community forum or white paper.

Categories
Planning & Policy

Relevant Laws & Compliance Checklists: What Local Governments Need to Know

Cybersecurity laws and regulations are evolving rapidly. For local governments, staying compliant isn’t just about checking boxes—it’s about protecting public trust, ensuring operational continuity, and avoiding costly legal exposure. As the threat landscape changes, so do the legal obligations that govern how municipalities handle data, respond to incidents, and manage third-party risks.

Why Legal Review Matters

Boards and senior leaders must be regularly updated on both existing laws and proposed legislation that could impact current practices. This includes federal mandates, state-specific statutes, and sector-based requirements. Engaging your general counsel or external legal advisors is essential to ensure that your organization remains compliant and prepared.

Legal teams can help:

  • Interpret new regulations and assess their applicability.
  • Identify gaps in current policies and procedures.
  • Draft or revise internal compliance checklists.
  • Advise on risk exposure and liability mitigation.

Federal Laws to Watch

Several federal statutes directly affect state and local governments:

  • Federal Information Security Modernization Act (FISMA): Now applies more stringently to local governments, requiring robust protections for information systems and timely incident reporting.
  • Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA): Requires organizations in critical infrastructure sectors—including many municipal services—to report cyber incidents within 72 hours and ransomware payments within 24 hours.
  • State and Local Government Cybersecurity Act of 2021: Provides federal support through grants, cooperative agreements, and training programs.
  • Federal Rotational Cyber Workforce Program Act of 2021: Encourages talent development and resource sharing across government agencies.

These laws are designed to improve coordination, transparency, and resilience across public sector entities.

State-Level Regulations

Cybersecurity legislation continues to evolve rapidly across the United States. In 2025, 48 states and Puerto Rico introduced or considered more than 500 bills or resolutions related to cybersecurity. These laws reflect growing concerns about ransomware, data breaches, and the need for stronger digital infrastructure in government.

Key Trends and Examples
  • New York: Updated procurement laws now require endpoint device purchases to align with the NIST Cybersecurity Framework. As of 2025/2026, there is a .gov web domain mandate, incident reporting requirements, and a training mandate for local governments.
  • Arkansas: Mandated the Division of Information Systems to maintain cybersecurity policies aligned with state standards.
  • Idaho: Requires all state agencies to implement multifactor authentication and maintain cybersecurity best practices.
  • Mississippi: Established limits on cyber liability claims and introduced new requirements for cybersecurity insurance.
  • Montana: Expanded its workforce development program to include cybersecurity roles beyond entry-level analysts.
  • Hawaii: Adopted resolutions to build cybersecurity education pipelines and strengthen its innovation economy.

These laws vary widely in scope and applicability. Some focus on procurement, others on workforce development, insurance, or incident reporting. Local governments must consult legal counsel to determine which laws apply and how to comply.

Compliance Checklists and Internal Oversight

To manage compliance effectively, local governments should maintain internal checklists that cover:

  • Data classification and retention policies.
  • Incident response and reporting protocols.
  • Vendor risk assessments and contract language.
  • Employee training and awareness programs.
  • Access controls and audit trails.
  • Insurance coverage and legal disclosures.

These checklists should be reviewed and updated regularly, especially when new laws are enacted or existing ones are amended. Legal advisors can help tailor these tools to your organization’s structure, risk profile, and regulatory environment.

Cybersecurity compliance is not one-size-fits-all. Each state may have different laws, and local governments must navigate these requirements with care. Legal review should be a standing agenda item for boards and councils, and compliance checklists should be living documents that evolve with the law.

If your organization hasn’t conducted a legal review recently, now is the time. Engage your legal team, update your checklists, and ensure that your cybersecurity practices are aligned with current and emerging regulations.

Categories
Leadership & Governance

Implementing Key Performance Indicators (KPIs): Templates for Cybersecurity Governance

Cybersecurity performance should be measured with clear, objective indicators—not just ad hoc updates or reactive reporting. While IT leadership often bears the burden of communicating cyber risk, boards and executives need structured, strategic insights to make informed decisions—especially during a crisis.

Key performance indicators (KPIs) help organizations:

  • Track progress toward cybersecurity goals.
  • Evaluate the effectiveness of training, insurance coverage, and incident response.
  • Benchmark performance using recognized standards such as NIST, COBIT, ISO 27001, and CIS.

Dashboards that consolidate and visualize these KPIs over time support better governance, resource allocation, and strategic planning.

What Should Cybersecurity KPIs Measure?

KPIs should be relevant, reader-friendly, and designed to convey meaning, highlight change, and enable dialogue. Recommended categories include:

  • Security Incidents: Frequency, severity, and trends.
  • Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR): Indicators of monitoring and response effectiveness.
  • Vulnerability Management: Number of vulnerabilities identified, severity ratings, and remediation timelines.
  • User Awareness: Training completion rates, phishing simulation results, and incidents caused by user error.
  • Compliance Metrics: Audit results, system alignment with standards, and resolved violations.
  • Budget Allocation: Spending breakdowns, comparisons with peer organizations, and funding gaps.

These metrics should be presented in concise, visual formats that support decision-making without overwhelming non-technical audiences.

14 Cybersecurity KPIs to Track in Vendor Risk Management

To demonstrate vendor risk management efforts, organizations should track these 14 KPIs. Each is framed as a question to guide performance improvement and stakeholder reporting.

1. Level of Preparedness

How well is your organization equipped to prevent, detect, and respond to threats?
Includes metrics like:

  • Number of incidents resolved.
  • Frequency of phishing simulations.
  • Patch coverage and backup testing.
  • Security awareness training participation.

2. Unidentified Devices on Internal Networks

How many devices are untracked or unauthorized?
Includes:

  • Asset inventory accuracy.
  • IoT and BYOD security.
  • Rogue access point detection.

3. Intrusion Attempts

How many unauthorized access attempts were blocked?
Includes:

  • IDS/IPS performance.
  • Firewall logs.
  • Investigation and escalation timelines.

4. Security Incidents

What types of incidents occurred and what was their impact?
Includes:

  • Incident frequency and resolution time.
  • Root cause analysis.
  • Downtime and financial impact.

5. Mean Time to Detect (MTTD)

How quickly are threats identified?
Includes:

  • Average detection time.
  • Alert triage and prioritization.
  • False positive/negative rates.

6. Mean Time to Resolve (MTTR)

How long does full remediation take?
Includes:

  • Response coordination.
  • Root cause identification.
  • Restoration and stakeholder communication.

7. Mean Time to Contain (MTTC)

How fast are threats isolated?
Includes:

  • Containment effectiveness.
  • Cross-department coordination.
  • Reduction in incident frequency and cost.

8. First-Party Security Ratings

What is your organization’s current security score?
Includes:

  • Benchmark comparisons.
  • Rating trends.
  • Improvement actions.

9. Average Vendor Security Rating

How secure are your vendors?
Includes:

  • Vendor tiering and reassessment.
  • Rating systems and monitoring.
  • Communication of issues.

10. Patching Cadence

How frequently are patches applied?
Includes:

  • Patch prioritization.
  • Legacy system management.
  • Patch validation and exceptions.

11. Access Management

How well is access to sensitive systems controlled?
Includes:

  • MFA implementation.
  • Privileged account controls.
  • Access audits and training.

12. Company vs Peer Performance

How does your security posture compare to peers?
Includes:

  • Benchmarking KPIs.
  • Competitive intelligence.
  • Strategy alignment.

13. Vendor Patching Cadence

Are vendors patching vulnerabilities promptly?
Includes:

  • Scan frequency.
  • Remediation tracking.
  • SLA enforcement.

14. Mean Time for Vendor Incident Response

How fast do vendors respond to incidents?
Includes:

  • MTTR tracking.
  • Coordination and communication.
  • SLA monitoring.

Best Practices for KPI Implementation

  1. Align KPIs with Strategic Goals
    Ensure indicators reflect organizational priorities and risk appetite.
  2. Use Recognized Standards
    Benchmark against frameworks like NIST CSF, ISO 27001, and CIS Controls.
  3. Automate Data Collection
    Use tools that integrate with existing systems to streamline reporting.
  4. Update Dashboards Regularly
    Maintain relevance by refreshing data and adjusting metrics as threats evolve.
  5. Tailor Dashboards to the Audience
    Provide executive summaries for leadership and detailed views for technical teams.
Categories
Budgeting & Resources

Risk-Based Prioritization and Investment for Local Government Cybersecurity

Cybersecurity is no longer just a technical concern—it’s a strategic imperative. For local governments, the challenge lies in balancing limited resources with escalating threats. A risk-based approach to cybersecurity investment ensures that spending is aligned with the most pressing vulnerabilities and organizational priorities.

Understanding the Threat Landscape

Boards and councils must be regularly briefed on the evolving threat landscape. This includes identifying threat actors—such as cybercriminals, nation-state actors, and insiders—and understanding the types of attacks they may launch, from ransomware and phishing to denial-of-service and supply chain exploits. Management should assess the potential impact of these threats on operations, finances, and public trust.

Conducting Risk Assessments

A formal risk assessment report should be presented at least annually. This report must:

  • Identify key cyber risks.
  • Evaluate the likelihood and impact of each risk.
  • Describe existing controls and mitigation strategies.

This process helps prioritize investments and ensures that cybersecurity efforts are focused on the most critical areas.

Ensuring Compliance

Boards must be kept informed about the organization’s compliance with relevant regulations, frameworks (e.g., NIST CSF), and best practices. Annual updates should include:

  • A summary of compliance status.
  • Identification of gaps or deficiencies.
  • An action plan to address issues.

This transparency supports accountability and helps align cybersecurity with legal and regulatory obligations.

Incident Response Planning

Management should report on the organization’s incident response capabilities, including:

  • Recent incidents and how they were handled.
  • Lessons learned from internal and external events.
  • Updates to the incident response plan.

Effective incident response planning includes defined roles, escalation paths, and playbooks for common scenarios like ransomware or data breaches.

Promoting Cybersecurity Awareness

Cybersecurity is everyone’s responsibility. Boards should receive updates on awareness programs, including:

  • Training participation rates.
  • Results of phishing simulations.
  • Cultural initiatives to foster security-minded behavior.

Evaluating the effectiveness of these programs helps identify areas for improvement and reinforces a proactive security culture.

Budget and Resource Allocation

Cybersecurity budgets must be clearly communicated to decision-makers. Reports should include:

  • Budget comparisons with peer organizations.
  • Allocation breakdowns.
  • Identified constraints and funding needs.

This ensures that financial decisions are informed by risk exposure and strategic priorities.

Using Security Metrics to Drive Decisions

Metrics should be relevant, concise, and actionable. Key metrics include:

  • Number of Security Incidents: Tracks frequency and severity.
  • Mean Time to Detect (MTTD): Measures detection speed.
  • Mean Time to Respond (MTTR): Assesses response efficiency.
  • Vulnerability Management: Tracks identification and remediation.
  • User Awareness: Evaluates training effectiveness.
  • Compliance Metrics: Monitors adherence to standards.

These metrics should be presented in a format that enables discussion and supports strategic decision-making.

Balancing Spending with Risk

A risk-based investment strategy helps prioritize cybersecurity initiatives based on threat likelihood and impact. This approach avoids overspending on low-impact risks and ensures that resources are directed toward protecting high-value assets. Boards should understand the methodology behind budget decisions and how spending aligns with risk management goals 

Categories
Planning & Policy

Cybersecurity on a Budget: How Small Governments Can Implement NIST CSF

For smaller local governments, adopting a cybersecurity framework like the NIST Cybersecurity Framework (CSF) can feel daunting. Limited budgets, lean IT teams, and competing priorities often make comprehensive implementation seem out of reach. Yet the benefits—risk reduction, operational resilience, and insurance alignment—are too significant to ignore.

Why Frameworks Matter

Cybersecurity frameworks provide structure, consistency, and a shared language for managing digital risk. They help local governments:

  • Integrate cybersecurity into enterprise risk management.
  • Improve communication across departments and with external partners.
  • Support regulatory compliance and demonstrate due diligence.
  • Adapt to evolving threats through continuous improvement.

Even partial adoption of a framework can yield meaningful improvements in security posture and incident readiness.

Right-Sizing the Approach

Smaller jurisdictions don’t need to implement every control at once. Instead, they can focus on foundational practices that offer high impact with minimal cost:

  • Enforce strong password policies.
  • Implement multi-factor authentication.
  • Conduct regular backups.
  • Provide basic cybersecurity training for staff.

These steps align with the NIST CSF’s core functions—Identify, Protect, Detect, Respond, and Recover—and can be scaled over time.

Outsourcing and Shared Services

To overcome staffing and expertise gaps, smaller governments can explore:

  • CISO-as-a-Service: Contracting a virtual Chief Information Security Officer to guide strategy and compliance.
  • Managed Service Providers (MSPs): Outsourcing monitoring, patching, and incident response.
  • Regional Partnerships: Collaborating with neighboring towns, counties, or councils to share cybersecurity functions and reduce costs.

These models allow governments to maintain high standards of protection without the overhead of building full in-house teams.

Ensuring Accountability

When outsourcing, it’s essential to:

  • Align vendor responsibilities with internal policies.
  • Establish clear reporting structures.
  • Require accountability for protecting systems and data.

Framework adoption should be accompanied by governance practices that ensure transparency and control.

Continuous Improvement

Cybersecurity is not a one-time project. Even without a full-time IT or security team, smaller governments can:

  • Schedule periodic reviews of cybersecurity practices.
  • Update policies based on new threats and technologies.
  • Use tabletop exercises to test incident response readiness.

These efforts build resilience and demonstrate a commitment to protecting public assets.

Categories
Planning & Policy

Cyber Framework Comparison: Choosing the Right Path for Your Organization

Selecting and implementing a cybersecurity framework is one of the most strategic decisions a local government or public entity can make. Frameworks provide structure, consistency, and a shared language for managing cyber risks across departments, vendors, and leadership. They also help align cybersecurity efforts with regulatory requirements, funding eligibility, and enterprise risk management.

Why Frameworks Matter

Cybersecurity frameworks:

  • Standardize practices across departments.
  • Support communication between technical teams and leadership.
  • Enable benchmarking and continuous improvement.
  • Align with compliance mandates and funding requirements.

For smaller governments, frameworks can feel overwhelming. But right-sizing your approach—through shared services, outsourcing, or phased adoption—can make implementation realistic and effective 

Key Frameworks to Consider

FrameworkFocus AreaBest ForHighlights
NIST CSFRisk-based cybersecurity managementPublic and private sectorsFlexible, scalable, organized into five core functions: Identify, Protect, Detect, Respond, Recover. Widely adopted and regularly updated.
NIST SP 800-53Security and privacy controlsFederal agencies and contractorsDense and detailed. Provides hundreds of specific controls. Ideal for organizations needing granular technical guidance.
NIST CIS (Critical Infrastructure Security)Sector-specific protectionsEnergy, healthcare, transportationTailored to critical infrastructure sectors. Often used in conjunction with CSF.
PCI DSSPayment card data protectionFinance, retail, municipalities handling paymentsMandates encryption, access control, and regular audits.
HIPAAPatient data protectionHealthcare providersRequires safeguards for electronic protected health information (ePHI).
CJISCriminal justice data securityLaw enforcement, courtsStrict access control and audit requirements.
CCPAConsumer privacy rightsCalifornia-based entitiesFocuses on data transparency, access, and deletion rights.
FAA/EPASector-specific cybersecurityAviation, environmental agenciesIncludes operational and compliance mandates.
OWASPApplication securityDevelopers, IT teamsFocuses on common vulnerabilities like injection, broken authentication, and misconfigurations.

How to Choose the Right Framework

Ask these guiding questions:

  • Does the framework align with our size, mission, and regulatory environment?
  • Can we integrate it into our enterprise risk management strategy?
  • Are there opportunities to share services or outsource functions?
  • Does it support communication with leadership and external stakeholders?
  • Are there clear guidelines for incident response and recovery?
  • Is the framework regularly updated to reflect evolving threats?
Categories
Tools & Guidance

Cybersecurity Is a Team Sport: Why Local Governments Must Partner Up

In the face of increasingly sophisticated cyber threats, local governments must recognize that cybersecurity is not a solo endeavor. Defending against bad actors with more resources and reach requires collective action. No single entity can fully secure its digital infrastructure in isolation. By fostering collaboration—across departments, municipalities, and with state and federal partners—local governments can strengthen their defenses and build a more resilient cybersecurity posture.

Why Collaboration Matters

Cybersecurity is a shared responsibility. Collaboration enables local governments to:

  • Share threat intelligence and best practices.
  • Pool resources for tools and training.
  • Coordinate incident response and recovery.
  • Reduce costs through economies of scale.

Boards should actively support cross-departmental collaboration between IT, finance, legal, and risk management teams to ensure cybersecurity is integrated into all aspects of governance 

Risk Pooling and the Weakest Link

Risk pooling is one of the most effective collaborative strategies. By combining cybersecurity resources—such as firewalls, intrusion detection systems, and threat monitoring—municipalities can achieve stronger protection at lower cost. Shared services models, including CISO-as-a-Service, are especially valuable for smaller jurisdictions with limited budgets 

However, collaboration also means shared risk. A weak link in one organization’s defenses can expose others. For example, outdated software in one municipality could become an entry point for attackers targeting interconnected systems. This underscores the need for consistent security standards across all partners.

Information Sharing Platforms

Timely threat intelligence is critical. Local governments can stay ahead of cyber threats by participating in trusted information-sharing platforms:

Examples of Collaborative Initiatives

  • Cybersecurity Shared Services
    Some states offer centralized threat monitoring, incident response teams, and access to specialized tools for local governments.
  • Public-Private Partnerships
    Collaborating with cybersecurity firms can provide access to advanced technologies and expertise that may be out of reach for smaller municipalities.
  • Joint Cybersecurity Exercises
    Simulated cyberattacks involving multiple agencies help test response protocols, improve coordination, and identify gaps in preparedness.

Practical Steps to Foster Collaboration

  1. Formalize Agreements
    Establish MOUs or service-level agreements with partners to define roles, responsibilities, and expectations.
  2. Participate in Regional Consortia
    Join or form regional cybersecurity alliances to share resources and coordinate efforts.
  3. Conduct Tabletop Exercises
    Practice incident response scenarios with internal teams and external partners to build readiness.
  4. Align on Frameworks
    Use common cybersecurity frameworks like NIST CSF to ensure consistency across organizations 2.
  5. Engage Leadership
    Ensure boards and senior officials understand the value of collaboration and support cross-agency initiatives.

Sign In

Don't have an account yet? Register

Forgot password?

Register

Reset Password

Please enter your username or email address, you will receive a link to create a new password via email.