Cybersecurity for Local Governments: Preparing for an Attack That Disrupts Essential Services

When a cyberattack hits a local government, the effects reach residents quickly. Utility payments may stop processing, permit work can stall and the records staff rely on every day can go dark. Cybersecurity for local governments comes down to protecting the services a community can’t go without, and much of the preparation happens in planning meetings well before any new software is involved.

Why Local Governments Make Easy Targets

Local governments hold a large amount of personal information, from tax and utility records to employee data, and many run on tight budgets with small IT teams. They also provide services that can’t simply close for a week while systems are rebuilt, and that urgency raises the pressure to pay.

Money drives most of these attacks. Verizon’s public sector findings show that 69% of breaches in public administration, a category that covers government broadly rather than local governments alone, were financially motivated. A person was involved in the same share of breaches, whether through a phishing email, a misdirected message or another everyday mistake. The most common entry point was a software weakness attackers could exploit, responsible for 40% of public administration breaches. 

Know Which Services Can’t Stop

Every government should decide ahead of time which services come back first after an attack and how long each can safely stay offline. Utilities, emergency dispatch, payroll and tax collection often top that list, though the answer looks different in every community. Many of those decisions involve the finance office, since tax, payroll and vendor payments all run through financial systems.

Ransomware is the threat that makes this planning urgent. Ransomware now appears in 48% of all breaches in Verizon’s data, up from 44% the year before. In Florida, the stakes are higher still, because section 282.3186 of the Florida Statutes bars counties and municipalities from paying or otherwise complying with a ransom demand. With payment off the table, recovery depends entirely on preparation. State law also requires counties and municipalities to report a ransomware incident to the state’s Cybersecurity Operations Center, the Florida Department of Law Enforcement and the local sheriff within 12 hours of discovery. A written plan should name who makes decisions during an outage, who makes those required calls, how residents will be kept informed and how essential payments and records will be handled by hand in the meantime. Backups belong in that plan too, and the only way to know they work is to restore from them in a test. A tabletop exercise, where leaders walk through a mock attack step by step, is a simple way to find the gaps in a plan before a real outage does. 

Small Habits Prevent Big Problems

Many cyber problems in government start with an everyday action. Staff should know how to spot a suspicious email, especially one asking for a password, a payment or a change to banking details, and how to report it quickly. In Florida, that training is already required, since state law calls for local government employees with network access to complete basic cybersecurity training within 30 days of starting and every year after. Multifactor authentication (MFA), which asks for a second proof of identity before anyone can log in, should be required on email and financial systems.

Sending information to the wrong person is another risk worth training for. Verizon found that misdelivery, meaning letters or emails sent to the wrong recipient, accounts for 88% of errors in the public sector, which it ties to the sheer volume of notices, bills and correspondence governments send. Across all government errors, it traced 91% to simple carelessness, with flawed processes and technology accounting for very few. A second look before sending anything that contains personal information takes seconds and can prevent a disclosure no one wants to explain.

For governments that receive federal awards, protecting sensitive information is also a compliance expectation. Federal grant rules require reasonable cybersecurity measures as part of an organization’s internal controls, which puts these habits squarely in the finance office’s lane as well as IT’s. 

Build the Right Support Around Your Team

Many local governments can’t staff a full security team, so the real question is how to get coverage without adding headcount. Florida local governments have a head start through the Local Government Cybersecurity Protection Program, which state law places with the Florida Digital Service. The program provides cybersecurity tools and services directly instead of cash, gives preference to fiscally constrained counties and awards grants by December 1 each year. Tools only go so far, though, and someone still has to configure them, watch systems day to day and respond when something goes wrong. 

A managed IT and cybersecurity partner fills that role by handling updates, backups, monitoring and incident response as ongoing work, so the finance office isn’t chasing technology problems between budget cycles. On the financial side, municipal finance support can strengthen the internal controls and grant compliance that federal awards require.

Protect the Services Your Community Counts On

Keeping services running and resident information safe is central to public trust. Planning for an attack before it happens protects both the services and that trust, which is hard to rebuild once it’s lost. Cybersecurity Awareness Month in October is a natural time to put that planning on the agenda.

James Moore Technology Services helps local governments protect the services, data and budgets their communities depend on. Contact us when you’re ready to talk through where your organization stands. 

All content provided in this article is for informational purposes only. Matters discussed in this article are subject to change. For up-to-date information on this subject please contact a James Moore professional. James Moore will not be held responsible for any claim, loss, damage or inconvenience caused as a result of any information within these pages or any information accessed through this site.