Topic · municipal

Municipal cyber programs

Municipal cyber programs — city/county incidents, ransomware impacts, local-government compliance posture.

RSS feed ↗

trade-press
Nobody tracked the cellular modems on water controllers
The devices showed up on carrier invoices but never in an IT asset inventory. Matching the two costs nothing and can start Monday.
In July, intruders compromised water and wastewater controllers across multiple states through an exposure no asset inventory caught: the devices were connected to public cellular networks, not the city LAN. The modems appeared on carrier invoices but nowhere on network scans. The former CIO of Waco, Texas, writing from direct experience, argues the core problem isn't technical. No single person owns accountability for the whole municipal network. Matching carrier invoices to actual devices costs nothing in tools or headcount and can start this fiscal year with money already in a budget request.
TUE
trade-press
Minnesota extends cybersecurity baseline to local governments
The state's whole-of-state plan layers assessments, enterprise tools, and cyber navigators onto municipalities and critical infrastructure, but adoption is voluntary, and the entities getting hit aren't using the capabilities.
Minnesota CISO John Israel's office is expanding a statewide cybersecurity baseline program to local governments and critical infrastructure. The effort, built on a 2023 plan and backed by DHS grant funding, runs on three pillars: baseline assessments to help entities build a security program, enterprise-class tools offered at no or low cost through the state's buying power, and a team of cyber navigators who build ongoing relationships with local governments. Israel said the data shows that entities hit by ransomware and other attacks are the ones that haven't adopted the capabilities. The plan doesn't mandate use of state services, the goal is baseline controls, however sourced.
THU
trade-press
CRS maps three paths for water-sector cyber standards
Voluntary coordination failed, the 2023 EPA memo got sued out of existence, and now Congress is staring at three bills with no shared theory of how to set standards, fund compliance, or enforce either.
A new Congressional Research Service report catalogs the legislative options for water-sector cybersecurity after July 2026 attacks hit utilities in seven states. Three competing approaches are on the table: Capito's WRDA bill funds technical assistance under existing SDWA authorities; the Schiff-Klobuchar package directs EPA to set baseline cybersecurity standards through rulemaking; and the Trahan-Markey bill creates a wastewater cyber grant program. The CRS report flags unresolved questions on whether standards would apply uniformly to the roughly 170,000 U.S. water systems (many already struggling with existing SDWA requirements) and whether EPA or state regulators have the expertise to oversee them.
AUG 28
trade-press
CISA grant program stares down Sept. 30 lapse, states told to triage
Former state cyber officials are telling states to act like the money's already gone, because Congress hasn't moved, and the authorization clock doesn't care about bipartisan agreement.
The State and Local Cybersecurity Grant Program's authorization expires Sept. 30, 2026, and former state cyber officials are advising governments to adopt risk-based prioritization now rather than wait for reauthorization. The program, funded at $1 billion over four years by the 2021 infrastructure law, saw a short-term extension in January but faces an uncertain path forward in the Senate despite bipartisan House support. Former North Carolina CIO James Weaver called the sentiment among states "anxiety, the fact is there is no extension of it."
AUG 13
trade-press
Suisun City 911 dispatch taken down in ransomware attack
Suisun City is one of at least five municipalities across four states that lost public-safety and government services to cyberattacks in the same week, and the pattern isn't new.
Suisun City, California, shut down its entire IT network Friday after ransomware hit critical systems including 911 routing, police dispatch, and city records. The city declared a state of emergency. The same week, Coweta, Oklahoma; Mitchell, South Dakota; Coryell County, Texas; and Washburn County, Wisconsin disclosed cyberattacks disrupting government services. Emergency calls in Suisun City are now routed through the county dispatch center, and the FBI is investigating.
AUG 11
trade-press
Water Cyber Shield Act Gives EPA $300M for Water Utility Cyber Rules
The bill bakes state flexibility and industry consultation into its design, answering the litigation that killed the Biden EPA's 2023 regulatory push.
Sens. Schiff and Klobuchar introduced the Water Cyber Shield Act, which would authorize $300 million annually from Drinking Water and Clean Water State Revolving Funds for EPA-led cybersecurity assessments, corrective-action mandates, and CIRCIA incident reporting at water and wastewater utilities. Systems would be tiered by size, with states deciding whether to self-regulate or let the EPA step in. It's the second major federal attempt to regulate water-sector cybersecurity after the Biden EPA's effort was sued and abandoned, and its drafters consulted those same groups to head off a repeat.
AUG 10
trade-press
Coast Guard monitors North Carolina ports cyberattack
The Ports Authority hasn't disclosed which systems were hit, what the attack vector was, or whether cargo operations were affected, three days in, the silence is the story.
A cyberattack disrupted gate operations at all three North Carolina port facilities this week (Wilmington, Morehead City, and Charlotte Inland Port) forcing the Ports Authority to delay gate openings and shift to manual processing. The Coast Guard and CISA are coordinating with state partners on the investigation. As of Friday morning, normal gate schedules were back in effect, but the agency hasn't disclosed the nature of the attack, which systems were compromised, or whether vessel, rail, or cargo-handling operations were affected. No attribution has been made.
AUG 7
trade-press
NIST finalizes transit CSF 2.0 profile with OT guidance
The first CSF 2.0 sector profile to explicitly fold operational technology alongside IT reflects broadening regulatory attention to converged infrastructure risks in critical infrastructure.
NIST published the final Transit Cybersecurity Framework Community Profile (IR 8576) on August 5, expanding CSF 2.0 guidance to cover operational technology systems (not just IT) that transit agencies own and operate. The voluntary profile targets public transit owners and operators plus the federal, state, and municipal entities that oversee or fund them. It's the first CSF 2.0 sector profile to explicitly center OT/IT convergence, arriving as digitized and networked operations widen transit agencies' attack surfaces. NIST hosts a September 1 webinar to walk through the final version.
AUG 6
trade-press
Water utility attacks intensify Hill push to renew CISA state grants
The House reauthorized the program through 2033 without appropriating a dollar, and the Senate hasn't moved, with the September 30 expiration weeks away.
Iran-linked attacks on water utilities in at least seven states have injected urgency into Congressional efforts to reauthorize the State and Local Cybersecurity Grant Program before it expires September 30. More than 30 Minnesota systems were hit. The House passed Rep. Andy Ogles's (R-TN) bill extending the program through 2033 in November, but it appropriates nothing. House appropriators separately proposed $50 million for FY 2027, a fraction of the $1 billion distributed over the program's initial four years. The Senate hasn't moved. CISA is responding to ongoing exploitation of programmable logic controllers at water facilities claimed by Iran-linked CyberAv3ngers.
AUG 4
regulator
Fishers First City to Adopt GovRAMP Procurement Preference
The Indianapolis suburb is the first municipality to adopt the nonprofit's "verify once, serve many" model, testing whether state-level momentum translates to city procurement.
The City of Fishers will give preferential awards to cloud service vendors that comply with GovRAMP certification for all contracts entered or renewed on or after January 1, 2024. Vendors selling cloud services to Fishers must enroll in GovRAMP's Progressing Snapshot Program at minimum to remain competitive. The adoption marks the first municipal procurement preference for GovRAMP, signaling whether the nonprofit's "verify once, serve many" credential reciprocity model, already in use at the state level, can reshape vendor behavior at the city scale.
JUL 26
regulator
Chandler mandates GovRAMP authorization within 18 months for cloud contractors
Chandler is the first municipal government to make GovRAMP authorization a binding contract term, Ready in 12 months, Authorized in 18, or the deal's off.
The City of Chandler now requires cloud service contractors handling city data to achieve GovRAMP Ready status within 12 months of contract execution and full Authorized status within 18 months. Contractors without either designation at signing must submit a Security Snapshot within three months and provide monthly progress reports. Chandler sponsors contractors through the process, but missing the 18-month deadline means breach of contract, and likely termination. Chandler, a GovRAMP participant since 2022, is the first municipality to mandate the framework across all cloud products at category-level specificity.
JUL 26
trade-press
Arizona launches regional SOC for local governments, students
The useful test is whether counties and cities get real defense capacity, not another workforce-development ribbon cutting.
StateScoop reports that Arizona has added a regional security operations center, run from two community college locations, to support under-resourced local governments and build a student talent pipeline. The affected agencies are the local governments least able to staff cyber defense on their own; the students are part of the operating model, not just the audience.
JUL 14
trade-press
Conti developer pleads guilty over $150M ransomware conspiracy
The plea narrows a real accountability gap, while Tennessee public-sector victims remain unnamed and exposed to the case machinery.
Oleksii Oleksiyovych Lytvynenko pleaded guilty to wire fraud conspiracy after admitting he developed malware used by Conti, which the FBI ties to more than $150 million in ransom payments worldwide. Prosecutors say Tennessee victims paid about $634,000 in Bitcoin, including an undisclosed government entity whose compromise reached a sheriff’s department, emergency medical services and police. Sentencing is set for Sept. 10, with other Conti defendants still in the system.
JUN 12
trade-press
Warner bill would revive $50M MS-ISAC funding
The fight is less about one nonprofit contract than whether CISA still subsidizes cyber defense for governments that cannot buy it alone.
Nextgov/FCW reports that Sen. Mark Warner, D-Va., is introducing legislation to restore permanent Cybersecurity and Infrastructure Security Agency funding for the Multi-State Information Sharing and Analysis Center after DHS ended support in 2025. The bill would authorize $50 million annually beginning in fiscal 2027 and require free threat intelligence and cyber services for state, local, tribal and territorial governments. Roughly 19,000 entities use MS-ISAC; the exposed ones are the smaller jurisdictions already short on security staff.
JUN 5