It’s no secret that disruptions caused by cyberattacks are occurring with increasing frequency in both the private and public sectors. Cyberattacks can close down local government communication systems, threaten public services, and compromise personal and other confidential information.

For this reason, cybersecurity was identified as one of the top challenges in a National Issues Brief released earlier this year by the National Homeland Security Consortium. Cybersecurity has also been identified year after year as one of the top ten priorities for the National Association of State Chief Information Officers (NASCIO), which recently published a Cyber Disruption Response Planning Guide.

Although geared to states, the guide provides a wealth of content that is equally applicable at the local level. It calls on governments to develop cyber disruption response plans that include a structure clearly designating who’s in charge in a given event or phase of an event; development of a risk profile for government assets; collaboration among the various staff and departments that have cyber responsibility; and a communication plan to ensure that the right people have the right information as early as possible so they can respond effectively.

The key messages are that a cyber disruption response strategy and operations need to be addressed before an event occurs, starting with measures that can prevent disruption in the first place, and that key systems and services need to be resilient—built to survive a crisis.

Recommendations

The guide provides 18 recommendations, and each one is fleshed out with extensive coverage supplemented by a checklist for quick reference. Here are the key recommendations, which apply not only to disruptions caused by cyberattacks but also to cyber disruptions caused by natural disasters:

• Identify current vulnerabilities and risks.
• Develop a strategy for continuity of communications in the event of a loss of telecommunications, including backup systems that are ready to launch and can be sustained.
• Develop communication and coordination procedures to ensure timely and effective response and contingency plans to deal with secondary effects.
• Consider your local and regional partners: What resources can they provide and how can you coordinate preparedness and response activities?
• Incorporate resiliency considerations into the processes, systems, data and information assets, hardware, cloud services, and shared services of every project, program, and management initiative.

NASCIO represents the chief information officers of the states. The Cyber Disruption Response Planning Guide was supported by a grant from the Bureau of Justice Assistance, U.S. Department of Justice.