A Cyber Incident Plan Your Municipal Team Can Actually Use

Write for the people making decisions

An incident plan should help people act when information is incomplete and the office is under pressure. For a municipality, that includes staff reporting the problem, the IT team investigating it, leadership deciding service priorities, and the person communicating with residents. A lengthy document is not automatically a usable plan. Start with the decisions your team would need to make first.

Use an ordinary scenario to begin: several employees cannot access shared files, an unusual message appears on a workstation, and the counter is about to open. Who receives the first call? Who can authorize a service interruption? How do staff obtain instructions if email is unavailable? Answer those questions before adding technical detail that belongs in the IT team’s response procedures.

Keep a contact list that works during an outage

Identify primary and backup contacts for leadership, IT support, critical software vendors, communications, and relevant advisers. Record how to reach them through approved channels if the usual office systems are unavailable. Verify the list periodically and after personnel changes. A directory that exists only on an inaccessible server cannot help the person trying to coordinate the response.

Name an incident coordinator and define how decisions are recorded. The coordinator does not need to perform every technical task; the role is to keep responsibilities and communication clear. Ask your IT provider to explain its escalation path and how it will keep municipal leadership informed. The municipality also needs to understand any incident-support limits in its service agreement.

Tell staff what to report and what happens next

Provide a simple reporting instruction with a phone number or approved reporting method. Staff should describe what they observed, when it started, and what action they already took. Make early reporting straightforward, including when someone clicked a suspicious link. The next steps should follow the municipality’s approved response process and the directions of the responsible technical team.

Avoid putting employees in the position of inventing their own investigation. Your IT team should establish safe instructions for handling suspicious devices and preserving useful information. The office’s role is to report promptly, follow those instructions, and keep affected work visible to the coordinator. Practicing that handoff helps staff understand it before there is an urgent event.

Plan service continuity and public communication

List the services affected by an outage and the approved temporary methods for handling requests. A clerk’s office may need to record inquiries for later follow-up, while another department may need a vendor-supported alternative workflow. State who can approve these arrangements and how temporary records are reconciled. An improvised workaround can otherwise create a second problem when the systems return.

Choose who approves external updates and how the team distinguishes confirmed facts from matters still being investigated. Residents need useful information about service availability and the next update. Leadership, counsel, insurers, and other responsible parties should guide any reporting or notification obligations for the specific situation. Build their involvement into the plan rather than making assumptions during an incident.

• Identify the incident coordinator and backup contacts.
• Agree on staff reporting and technical escalation.
• Document approved temporary service methods.
• Assign responsibility for decisions and public updates.

Run a short tabletop and fix what it reveals

A tabletop exercise is a discussion of a scenario, not a live attack on your systems. NIST’s incident response preparation resources point to planning, training, and exercise materials, including CISA’s tabletop packages. Use that structure to walk your own team through the first decisions in a realistic municipal interruption. Include the staff whose work would actually be affected.

Record unclear responsibilities, missing contacts, and decisions that took too long to resolve. Assign each improvement to an owner and schedule a follow-up. Try another discussion after significant system or staffing changes. Practical IT support for municipalities includes preparing the people around the technology, so that a difficult day has an organized response rather than a room full of unanswered questions.