Public Sector
Cybersecurity and privacy programs for state and local government, schools, colleges and public utilities
An example
Consider a county IT director in the spring. Three things arrive in the same month. A new state rule sets a reporting deadline for cyber incidents. A federal grant the county receives now expects cybersecurity to be part of its internal controls. And a legislator asks, after a ransomware attack on a neighboring county, whether “that could happen here.”
Each question is fair. Each lands on a small team that is already busy keeping systems running.
The Problem
Public bodies hold information about everyone they serve: residents, students, patients, ratepayers. The rules for protecting it keep growing, many with fixed dates. Budgets and staff do not grow at the same pace.
What is usually missing is not technology. It is a security program with an owner: a plan, written policies, a tested incident response, proof that the controls work, and a clear report to the people who govern.
Who we serve
Counties, cities, towns and villages
Incident reporting rules, grant conditions and a security program for a small IT team.
School districts and BOCES
NY Education Law § 2-d and Part 121, vendor data privacy, and a program aligned to the NIST Cybersecurity Framework.
Water and wastewater utilities
New York’s new drinking-water and wastewater cybersecurity rules (drinking water from January 1, 2027; wastewater controls from March 11, 2027, first certification by March 28, 2027), and EFC SECURE grants.
Community colleges
A risk register, a yearly NIST CSF 2.0 assessment and clear reporting to the Board of Trustees.
Health and human services agencies
HIPAA, 42 CFR Part 2 and privacy for county health, mental hygiene and social services departments.
For procurement officers: the bid kit
Company details, how we respond to solicitations, and what to expect.
Our home region is New York. We also work in New Jersey, Connecticut, Pennsylvania, Massachusetts and Vermont, remotely and on site as needed.
What we do, and who does what
We lead the security and privacy program. The organization’s IT staff or IT provider keeps running the technology. Leadership makes the decisions the plan assigns to it.
We do
Assess against the rules that apply, write the plan and the policies, prepare and test the incident response, review vendors, specify the controls the IT team must put in place, check the result, and report in plain language to the board, council or trustees.
We do not
Replace the IT staff or IT provider, install or operate tools, give legal advice, or certify, attest or sign on the organization’s behalf. Officials sign their own filings and reports.
The work runs on our own GRC (governance, risk and compliance) platform, which becomes the organization’s single record of risks, plans, evidence and reports. The organization owns its data and receives a full export when the engagement ends.
What must be met, how it is met, and how it fits together
- The obligation is what the organization must meet: a law or regulation, such as New York’s water and wastewater cybersecurity rules or Education Law § 2-d; a contract; or the conditions on a grant.
- The standard is how the obligation is met and checked: a published set of controls, such as NIST SP 800-53 with its SP 800-53A assessment methods.
- The NIST Cybersecurity Framework (CSF) 2.0 connects them. Each obligation and standard is mapped to it, so one program and one body of proof serve them all.
Each buyer page above lists the obligations that commonly apply and the standards we use to meet them. More on the method: Audit preparation.
Security Medic is independent. We assess against these laws, standards and frameworks as a reference. We do not certify, we are not legal counsel, and we are not affiliated with the agencies and bodies that publish them.
The first step is free
Before anything is bought, the organization should know where it stands. The free assessment shows that, at no cost and with no obligation.
- 1
Free 30-minute call (optional)
Talk through the rule, the grant or the deadline, and what the organization needs.
- 2
Free assessment
Answered online, in plain language. No technical knowledge is needed.
- 3
Gap report
Where the organization stands, the gaps that matter most, and the path to close them.
- 4
Free results review
We walk through the report together and answer questions.
If more work makes sense, it is scoped in writing against the named obligation: a scoped assessment, then audit preparation rounds where a formal review or deadline is coming. When the work has to go through procurement, the gap report helps write a scope that fits the need.
When to talk to us
The best time is before an RFP is written. By the time a solicitation is posted, the scope is set. Earlier, a free assessment can show what the organization actually needs, so the work that follows is the right work.
- A grant is awarded: a state or federal cybersecurity grant, a water-system SECURE grant, or a school technology grant.
- An IT, security or audit contract is six to twelve months from ending.
- A new rule sets a date, such as New York’s water and wastewater cybersecurity requirements in 2027.
- A request for information or a sources-sought notice is published, and the scope is still being shaped.
- The budget for next year is being set.
How public bodies can work with us
Through an RFP
We respond to solicitations as the prime contractor or as a named subcontractor on another firm’s team.
Direct purchase
Where the organization’s procurement policy allows a direct purchase or quotes, we provide a written proposal for the scope.
Grant-funded work
When a grant pays for an assessment or plan, we scope the work to the grant’s conditions and reporting.
Procurement officers will find our company details and what to expect in a response in the bid kit.
Start with a free 30-minute call
Bring the rule, the grant or the deadline. We will talk through where the organization likely stands and what a first step would cover.
Book a free call