Mitigating fiscal risk through municipal cybersecurity

Municipal governments are frequently targeted by cybersecurity attacks, including ransomware attacks, data theft, and social engineering attacks. Recovery from a cybersecurity incident is expensive. Recovering data and securing compromised systems can cost millions of dollars, creating a significant and unexpected fiscal shock to local government budgets. This chapter provides guidance to reduce this fiscal risk. A cybersecurity risk assessment will identify internal vulnerabilities and external threats, guiding risk mitigation. Municipalities can then reduce the likelihood of a cybersecurity incident through administrative attention on cybersecurity, employee education, appropriate cybersecurity policies and procedures, and vendor management. In addition to reducing the risk of a cybersecurity incident occurring, the fiscal risk of a successful attack should also be mitigated. This is accomplished through incident response planning, disaster recovery procedures designed to protect data, and cyber insurance. State governments and private associations provide a variety of services to assist municipalities improve their cybersecurity.