Guide to Cybersecurity as Risk Management for Elected Officials

Too often, elected officials fail to prioritize cybersecurity until after a breach — when it’s too late. Such failure to properly plan for and provide adequate cybersecurity resources can result in the exposure of large numbers of constituent records, potentially damaging the livelihoods of citizens and businesses, costing millions of dollars in unplanned expenses to remediate, spawning lawsuits and eroding public trust. To avoid this, cybersecurity should be integrated into the overall risk management process of every government organization.

This guide helps elected leaders address cybersecurity risks by:

• Spelling out cybersecurity risks and providing information to help public officials fulfill their responsibilities and safeguard their communities
• Suggesting strategies for integrating cybersecurity into an organization’s risk management framework, and developing and adapting cybersecurity and cyber disruption response policies and plans
• Discussing the private sector’s role in government cybersecurity efforts; although governments are often leery of collaborating and sharing with third parties, when it comes to cybersecurity, the private sector’s involvement is imperative
• Offering practical and actionable information to support the cybersecurity risk management efforts of elected officials