Local Government Cybersecurity: A Checklist for Municipalities Facing Ransomware and Zero-Days

Local Government Cybersecurity: A Checklist for Municipalities Facing Ransomware and Zero-Days

A city of 40,000 doesn't have a security operations center. It has an IT director, two technicians, a pile of legacy software, and a phone that rings at 2 a.m. Ransomware crews know this, which is why small municipalities stay on their target lists: the defenses are thin and the services — permits, payroll, dispatch, water billing — can't stay offline for a week. The most useful work in a small shop isn't expensive. It's boring, repeatable, and mostly about knowing your own network.

Know What You Have Before You Try to Defend It

You can't patch, back up, or segment a system nobody wrote down. Most municipal surprises come from the machine under a desk in the parks department, the camera recorder in a closet, or the HVAC controller a vendor installed years ago and never mentioned again.

A spreadsheet is fine; tooling can wait. For each system, capture:

• What it does and who depends on it
• Who owns it — a person's name, not a department
• Where it runs and on what operating system
• Whether it's reachable from the internet or another network
• What data it holds, and whether that data is public, personal, or regulated
• Who holds admin rights, vendors included

Then ask each department one question: what do you need to keep working for three days if everything else went dark? Dispatch, utilities, and payroll usually rise to the top. The conference room booking system does not.

That inventory becomes your map. Without it, every incident starts with a scavenger hunt. With it, you can answer the first three questions a ransomware negotiator or an insurance adjuster will ask: what is affected, what is critical, and what can be rebuilt from scratch?

Patch Fast, Isolate the Rest

A zero-day is a race on a short track. You can't defend what you don't know about, but you can shorten the gap between a vendor's patch and your deployment. Set a cadence: internet-facing systems and anything that authenticates users first, endpoints second, internal servers and appliances third, ideally inside the same maintenance window.

Pre-approve the emergency change. If a critical patch needs three signatures and a committee meeting, it sits for two weeks. Give one person authority to push an out-of-band fix and log it afterward.

For systems you can't patch, stop pretending they're safe. Isolate them. Put the HVAC controller on its own VLAN with no route to the finance server. Let the camera recorder reach only its vendor's cloud endpoint. If a legacy permit system must run on an unsupported OS, restrict who can log in, disable USB ports where possible, and take a nightly image. You are not fixing it; you are buying time and limiting blast radius.

Use a simple risk rule: if a system has a known critical vulnerability, no supported patch, and network access to something that stores personal data, it is an emergency. Document the compensating control and move on. Perfection is not the goal; containment is.

Backups You Can Actually Restore

Ransomware is not just an encryption problem. It is a recovery problem. Many municipalities discover too late that their backups were on the same domain, with the same admin credentials, and the same network share that the attacker just encrypted. A backup that cannot be restored without the infected network is not a backup; it is a hope.

Follow the 3-2-1-1 idea: at least three copies, two different media, one offsite, and one offline or immutable. For small teams, the offline copy is often the most practical: a rotating external drive locked in a different building, or an immutable cloud bucket with separate credentials and MFA.

Test restores on a schedule. Pick one system each quarter — payroll, utilities billing, the file share where the city clerk keeps minutes — and restore it to a clean environment. Time how long it takes. A backup you have never restored is a science experiment, not a recovery plan.

If the ransom note appears, the first question is not "Should we pay?" It is "What can we bring back, and how long will it take?"

Identity and Access: The Keys to the City

Most ransomware enters through stolen credentials or a single unpatched remote-access point. In a small municipality, the same IT admin may have domain admin, cloud admin, and the password to the backup system. That is convenient until it is catastrophic.

Separate accounts. Use a normal user account for email and web browsing, and a separate admin account for changes. Turn on multi-factor authentication everywhere it is supported, especially for remote access, email, finance systems, and cloud backups. If MFA is not supported on a critical system, treat that system as internet-facing even if it is not, and restrict it hard.

Remove stale accounts aggressively. Former employees, seasonal staff, vendors who finished a project — every unused account is a door someone forgot to lock. Review admin rights quarterly, and make vendors use named accounts, not shared "vendor" logins.

Segment the Network and the Vendors

Flat networks are how a compromise in the parks department becomes a citywide outage. Segmentation does not require a full zero-trust project. Start with the highest-value targets: finance, payroll, dispatch, and utilities. Put them on separate VLANs with firewall rules that allow only the traffic they need.

Vendors are part of your network whether you like it or not. The HVAC contractor, the badge system installer, the GIS consultant — each may have remote access. Require them to connect through a VPN with MFA, log their sessions, and use unique credentials. When a contract ends, disable access the same day. If a vendor refuses basic controls, that is a risk decision for leadership, not a secret for IT to absorb.

Train People, But Don't Blame Them

Phishing still works because it targets humans, not firewalls. Annual slideshow training is not enough. Run short, realistic simulations: a fake invoice from a known vendor, a fake password-reset notice, a fake delivery notification. Follow up with a two-minute explanation, not a punishment.

Make reporting easy. One button in the email client, one phone number, one person to call. Thank people for reporting, even false alarms. The goal is to shorten the time between "I clicked" and "IT knows."

Also train the front desk and the finance office on voice phishing. An attacker who sounds like the mayor's office asking for a gift card or a wire change is not a technical problem; it is a process problem. Require callbacks to known numbers for any payment or bank detail change.

Write It Down: Incident Response and Communications

During an incident, no one has time to invent a plan. Write a one-page playbook and keep a printed copy off the network. It should list who to call, in what order, and what to preserve. Include the city attorney, the insurer, the cyber insurance hotline, the managed security provider if you have one, and the public information officer.

Decide in advance who talks to the public and the media. A vacuum fills with rumor. A short, honest statement — "We are aware of a network disruption, services X and Y are affected, and we are working with experts" — is better than silence. Do not speculate about data theft until forensics confirms it.

Preserve evidence. Do not wipe machines before asking for help. If you have cyber insurance, call the hotline early; many policies require you to use their approved vendors for incident response and legal counsel.

Practice the Bad Day

Run a tabletop exercise once a year. Gather department heads, the city manager, the attorney, and IT. Present a scenario: "At 6 a.m., staff cannot log in. The water billing system is encrypted. A ransom note demands payment in 72 hours." Walk through the first 24 hours.

You will find gaps: no printed call tree, no offline copy of the continuity plan, no agreement on who can shut down a server, no way to notify residents. Fix one gap per quarter. A tabletop costs a few hours and exposes more than a vulnerability scan ever will.

The First 60 Minutes of a Suspected Ransomware Attack

1. Isolate the affected systems from the network — unplug the cable or disable the switch port, but do not power off if you can avoid it, because memory may hold evidence.
2. Notify the incident lead and the city attorney. Do not send details over the possibly compromised email system; use phone or a separate channel.
3. Disconnect backups from the network. If they are immutable or offline, verify they are safe. If they are on the domain, assume they are at risk.
4. Change critical passwords from a clean device, starting with email, domain admin, and backup accounts.
5. Document what you see: ransom note text, file extensions, timestamps, systems affected. Take photos if needed.
6. Call your cyber insurance hotline and approved incident response firm. Let them guide forensics and negotiation decisions.

Make the Case to Leadership

Cybersecurity competes with roads, parks, and salaries. The argument that works is not fear; it is service delivery. Dispatch cannot run on paper for a week. Payroll cannot miss a cycle. Water billing cannot stop for a month. Frame each control as protecting a specific service and a specific number of residents.

Ask for a small, sustained budget: MFA licenses, backup storage, a few hours of a consultant, and training time. Then track the basics: percentage of systems inventoried, percentage with MFA, time to patch critical vulnerabilities, and backup restore test results. Report those numbers to the council once a year. Progress is easier to fund than panic.

The Checklist Still Works

No small municipality will outspend ransomware crews. But most crews are looking for the easiest target, not the hardest. A city that knows its assets, patches quickly, isolates what it cannot fix, tests backups, enforces MFA, segments its network, and practices the bad day is a much less attractive victim. That is not a perfect defense. It is a practical one — and in local government, practical is what keeps the water running and the paychecks clearing.

Photo: Greg Thames / Pexels