Executive Summary

Cities and other local governments are the core service providers for citizens and businesses. Ensuring the security of municipal systems is essential to ensuring basic safety, quality of life, and economic prosperity. Increasing digitization means some city services are now managed and/or delivered using technology. In the past, cities have established relationships with public and private sector partners to prepare for and respond to catastrophic events such as natural disasters or terrorist attacks, both of which can threaten the viability of normal operations and the security of the community.

At this juncture, however, efforts to build similar partnerships to respond to cyberattacks are still early stage in most jurisdictions, leaving cities around the country significantly less than well protected. This paper highlights ways in which cities are currently working with their federal and state partners, private sector companies, and nonprofit agencies and foundations to improve their cybersecurity and resiliency efforts.

There is great work being done now, but there are additional opportunities and policy changes that would increase the propensity, efficiency, and effectiveness of such cyber-partnerships going forward.

Recommendations for Municipal Leaders

Integrate and prioritize regular exercises and supporting activities into resiliency planning. This is a recommendation for city officials, their governments, and supporting organizations, but extends also to the federal and state officials working with local governments. This type of planning and activity is essential; it must be built in and prioritized in the support offered to municipalities.

Think regionally. Many cities lack the resources to handle cybersecurity challenges on their own. Even larger cities will be able to benefit from working with other governments and their related institutions in their region to pool resources.

Reform governance of cybersecurity issues. Cybersecurity should be a priority for city officials who should institutionalize that reality. There may be different models for doing so, depending on the type of city government and budgetary reality, but leadership should strive to decrease conflict of interest issues and increase high level visibility as much as possible.

Recommendations for Federal and State Policymakers:

Related to the recommendation above for local governments, federal and state policymakers should codify, exercise, and institutionalize federal resources with authorities to support SLTT organizations. Although there has been ongoing work in this area, more needs to be done, and many of the lessons learned need to be reflected in documentation, new or existing.

Provide better guidance around and address shortcomings in federal funding for cybersecurity. Existing funding mechanisms challenge local governments because of red tape, confusion, and competition with other homeland security-related threats. Federal efforts should be reformed to allow for and direct funding specifically to efforts for cybersecurity resilience and response.

Structure and prioritize federal and state outreach efforts to local governments. This activity needs to be strategic in nature and utilize the federal system of government; the federal government cannot do everything, but needs to link the outreach, service provision, and ongoing relationships between federal agencies and with sub-federal parts of government. State programs aiding municipalities need to be properly resourced, both in terms of outreach and execution.