Counties, cities, towns and villages
A security program that a small IT team can run, and that leadership can explain
Already have an IT provider? Here's how we work together.
An example
Consider a town of 20,000 residents. Its technology is run by one staff member and an outside IT company. Late on a Friday, a ransom message appears on a computer in the clerk’s office.
New York now requires a municipality to report a cyber incident to the State Division of Homeland Security and Emergency Services (DHSES) within 72 hours, and to report a ransom payment within 24 hours. The supervisor asks three questions: who makes the report, what does it say, and who decides whether to pay? Nobody has written the answers down.
The Problem
Local IT teams keep systems running. That is a full-time job. The security program around those systems often has no owner: the written policies, the incident plan, the review of outside vendors, and the report to the board or council.
At the same time, more is asked of local government. Reporting deadlines are set in law. Federal grants expect cybersecurity to be part of internal controls. Police, courts and 911 centers must meet the FBI’s criminal-justice security policy. Insurers ask detailed questions at every renewal.
The work is rarely missing effort. It is missing an owner, a plan and proof.
What we do
A NIST CSF 2.0 assessment: where the government stands today, where it should be (current and target profiles), and the gaps between them.
An incident response plan that answers the reporting questions in advance, then a tabletop exercise so the people who will use it have practiced it.
A policy library written for how the government actually works, not copied from a template.
A risk register and a plan of action with an owner and a date for every item.
Security review of vendors and of new technology purchases.
Plain-language reports to the board, council or legislature, and, if wanted, ongoing leadership as a virtual chief information security officer (vCISO).
Who does what
Security Medic
Leads the security program: assesses, writes the plan and the policies, specifies the controls that must be put in place, reports to leadership, and checks that the work was done.
Your IT staff or IT provider
Install, configure and run the technology. We tell them what must be in place and check the result; we never replace them.
Elected officials and department heads
Set priorities, approve policies and budgets, and make the decisions the plan assigns to them, such as who reports an incident.
Your attorney and your insurer
Give legal advice and make coverage decisions. We are not legal counsel, and we work alongside both.
What must be met, and how it is met
An obligation is what the organization must meet: a law, a regulation, a contract or a grant condition. A standard is how it is met and checked. The NIST Cybersecurity Framework (CSF) 2.0 connects them, so one program and one body of proof serve every obligation.
Obligations that commonly apply
- NY General Municipal Law Article 19-c. Every New York county, city, town, village, school district and public authority must report a cyber incident to DHSES within 72 hours, and a ransom payment within 24 hours.
- Federal grant conditions (2 CFR Part 200, § 200.303). Any government spending federal awards must keep internal controls that include reasonable cybersecurity. The Single Audit checks it.
- FBI CJIS Security Policy. Applies to police departments, courts, corrections and 911 centers, and to the IT vendors that support them.
- Cyber insurance questions. A contract obligation: the insurer’s renewal questionnaire asks about multi-factor sign-in, backups, incident plans and more.
Standards we use to meet them
- NIST CSF 2.0. The framework we use to govern the whole program and connect every obligation above.
- CISA Cross-Sector Cybersecurity Performance Goals (CPGs) 2.0. A free, practical minimum baseline from the federal Cybersecurity and Infrastructure Security Agency, aligned to CSF 2.0.
- NIST SP 800-53 Rev. 5 with SP 800-53A. The detailed controls, and the methods to check them: examine the documents, interview the people, test that the control works.
- NIST SP 800-61 Rev. 3. The federal guide to incident response, used to build and test the incident plan.
Which obligations apply depends on the organization; the free assessment and the first call sort that out.
Security Medic is independent. We assess against these laws, standards and frameworks as a reference. We do not certify, we are not legal counsel, and we are not affiliated with the agencies and bodies that publish them.
The first step is free
Before anything is bought, the organization should know where it stands. The free assessment shows that, at no cost and with no obligation.
- 1
Free 30-minute call (optional)
Talk through the rule, the grant or the deadline, and what the organization needs.
- 2
Free assessment
Answered online, in plain language. No technical knowledge is needed.
- 3
Gap report
Where the organization stands, the gaps that matter most, and the path to close them.
- 4
Free results review
We walk through the report together and answer questions.
If more work makes sense, it is scoped in writing against the named obligation: a scoped assessment, then audit preparation rounds where a formal review or deadline is coming. When the work has to go through procurement, the gap report helps write a scope that fits the need.
When to talk to us
The best time is before an RFP is written. By the time a solicitation is posted, the scope is set. Earlier, a free assessment can show what the organization actually needs, so the work that follows is the right work.
- When a state or federal cybersecurity grant is awarded and the work has to be scoped.
- When an IT, security or audit contract is six to twelve months from ending.
- Before next year’s budget is set, so the security work is funded.
- Before writing an RFP, so it asks for what the government actually needs.
How public bodies can work with us
Through an RFP
We respond to solicitations as the prime contractor or as a named subcontractor on another firm’s team.
Direct purchase
Where the organization’s procurement policy allows a direct purchase or quotes, we provide a written proposal for the scope.
Grant-funded work
When a grant pays for an assessment or plan, we scope the work to the grant’s conditions and reporting.
Procurement officers will find our company details and what to expect in a response in the bid kit.
Start with a free 30-minute call
Bring the rule, the grant or the deadline. We will talk through where the organization likely stands and what a first step would cover.
Book a free call