At 6:40 on a Friday morning, the desk phones at city hall give you a dial tone and nothing else. Outlook won’t open, and the utility payment portal shows an error page residents are already screenshotting for Facebook. Your IT team, all three of you, knows what to do with the servers. The harder question is who can authorize shutting down the entire network, and how you reach 40 employees whose contact list lives on the server that just got encrypted.
A ransomware response plan for local government is a written, pre-approved set of decisions that tells a city or county who has authority to act, how staff communicate when systems are down, what gets restored first, and who must be notified and by when. It sits on top of the technical steps in CISA’s guidance (isolate, preserve evidence, report, restore) and settles the choices around them before an attack forces them.
Below are the seven decisions that usually aren’t on paper when the phones go dark.
What Happens When a Town Has No Ransomware Response Plan?
When a municipality has no decided ransomware response plan, the first hours go to arguments instead of containment. Nobody knows who can shut down the network, who calls the insurer, or how to reach staff when VoIP and email fail. Meanwhile, dispatch goes manual, payments stop, and state reporting clocks keep running.
Recent incidents show what that looks like. St. Paul, Minnesota detected attackers on July 25, 2025, and shut down its networks three days later. By July 29, the governor had activated the National Guard’s cyber protection forces because the incident exceeded the city’s response capacity. The Interlock group posted stolen data after the city refused to pay. In Dallas in 2023, Royal ransomware took down computer-aided dispatch, so fire-rescue dispatched manually and municipal courts closed. The city council later approved an $8.5 million recovery budget.
Attacks on government climbed through 2025. Comparitech logged 208 ransomware attacks on government entities worldwide in the first half of 2025, up 65% from the same period in 2024, and 72 of them hit US agencies.
Dallas took until June 13 to finish restoring the systems Royal encrypted on May 3. A plan won’t make the rebuild painless, but it does change the first day, which otherwise goes to the decisions nobody gave anyone the authority to make.
Find your gaps first
Decision 1: Who Decides During a Ransomware Attack on a City or County?
In local government, ransomware decisions belong to whoever your plan names in advance. That typically means the city manager or county administrator as incident lead, the IT director for containment, legal counsel for notification and ransom questions, the insurer for vendor approval, and the council or board for anything that needs a vote.
Councils move slowly by design. Ransomware doesn’t. Pre-delegate the time-sensitive calls by ordinance or resolution at a regular council meeting, months before anyone needs them. Your IT director should have standing authority to take affected subnets offline at the switch level at 2 a.m. without working through a phone tree, as CISA’s ransomware checklist recommends when several systems are hit. The city manager should hold emergency purchasing authority for forensics and recovery vendors. Every role needs a named backup, too, because attackers don’t check the vacation calendar.
According to NIST SP 800-61 Revision 3 (April 2025), incident response belongs inside an organization’s broader cybersecurity risk management, organized around the CSF 2.0 functions. Translated for city hall: the plan can’t live only in the IT office.
Who Decides What During a Ransomware Incident
| Decision | Owner | Pre-delegate? |
|---|---|---|
| Isolate or shut down networks | IT director | Yes, standing authority |
| Declare a local emergency | Mayor, county executive or board chair, per local code | Confirm the authority in code now |
| Engage forensics and approve emergency spending | City manager or county administrator | Yes, by ordinance or resolution |
| Notify insurer and legal counsel | Risk manager or legal counsel | Yes, hotline numbers in the plan |
| Report incidents involving criminal justice information | Local Agency Security Officer (LASO) | Yes, required by CJIS policy |
| Pay or refuse a ransom | Council or board, per state law and local policy | Yes, settle the policy now |
| Public statements | Public information officer or communications director | Yes, pre-approved holding statements |
Decision 2: Municipal Ransomware Response When the Phones and Email Are Down
Assume city VoIP, email and Teams are compromised or offline. A municipal ransomware response plan should name out-of-band channels in advance: a printed call tree, personal cell numbers, a group text, a physical meeting point, and a separate channel for residents such as social media or local radio.
Print the call tree. A contact list stored on the encrypted file server is a decoration. According to CISA’s #StopRansomware Guide, organizations should keep a hard copy and an offline version of both the incident response plan and its communications plan, a practice CISA ties to its Cross-Sector Cybersecurity Performance Goals (CPG 2.S). Keep copies at home and in department vehicles, and set a default rally point and time (the emergency operations center at 7:30 a.m., say) so people show up even if no message reaches them.
For residents, draft holding statements now: what’s down, what still works, and how to pay. Wichita’s 2024 notice telling residents to pay water bills and court fees by cash or check is a good model, because it answered the one question most residents had.
Google’s AI summary for municipal ransomware response tells cities to switch to personal phones and email (as of October 2026). That works for logistics, but if your agency handles criminal justice information (CJI), CJIS Security Policy control AC-20 prohibits using personally owned devices to access, process, store or transmit it. Coordinate on personal phones, and keep CJI off them.
Decision 3: Restoration Order, Ranked Before the Attack
Rank restoration before an attack. Most local governments should restore Active Directory domain controllers, DNS and firewalls first, then life-safety systems such as 911 call handling and CAD, then utility billing and payroll, then courts and records, and finally permits and other resident services.
Ask each department head how long they can run on paper, and write the answer down. You’ll get more honest answers on a quiet Tuesday than in the middle of an outage.
Rank the backups, too. According to Sophos’s State of Ransomware in State and Local Government 2024, 99% of state and local government organizations hit by ransomware said attackers tried to compromise their backups, and just over half of those attempts succeeded.
In a typical remediation engagement with a small municipal IT team, the first thing we see is a backup console showing green checkmarks while the service account that runs it lives in the same Active Directory domain the attacker now controls. The restore jobs exist. The credentials to launch them don’t. That’s why tier 0 includes offline admin credentials and a backup copy the domain can’t reach.
Sample Restoration Priority for a City or County
| Tier | Systems | Manual fallback to plan now |
|---|---|---|
| 0 | Active Directory or Entra ID, DNS, firewalls, immutable or offline backup copies | Offline admin credentials, printed network diagram |
| 1 | 911 call handling at the public safety answering point (PSAP), CAD, police and fire records | Paper run cards, radio-only dispatch |
| 2 | Utility billing, payroll and finance | Cash or check payments, paused shutoffs, prior-period payroll file held offline |
| 3 | Courts, clerk and records, email and phones | Continuances, paper dockets, out-of-band channels |
| 4 | Permits, licensing, libraries, recreation | Paper applications, extended deadlines |
Decision 4: Can a Local Government Pay a Ransom?
It depends on the state. North Carolina bans local governments from paying or even communicating with attackers. Florida bars counties and municipalities from paying. Ohio requires a council or board resolution explaining why paying serves the public interest. Tennessee’s ban covers state entities only, and most states have no specific rule.
Each statute draws the line differently:
- North Carolina (G.S. 143-800): cities and counties may not pay a ransom or otherwise communicate with the attacker.
- Florida (Fla. Stat. 282.3186): counties and municipalities may not pay or comply with a ransom demand, and a companion statute requires reporting ransomware within 12 hours.
- Ohio (ORC 9.64): since September 30, 2025, political subdivisions may pay only after the legislative authority passes a resolution or ordinance explaining why it’s in the public’s best interest. The Ohio Auditor of State’s bulletin walks through what that means for counties and cities.
Even where paying is legal, Treasury’s Office of Foreign Assets Control warns that payments reaching sanctioned groups can violate federal sanctions law, and the FBI doesn’t support paying at all. The practical move is to settle your position in policy now, so the council’s first conversation about ransom doesn’t happen on day two of an outage. State laws change, so confirm the details with your attorney.
Settle the hard calls early
Decision 5: Who Does a Local Government Report Ransomware To, and How Fast?
Report ransomware to CISA and the FBI as soon as possible, then check state law: Florida requires reporting within 12 hours, Ohio within 7 days. If the attack may have touched criminal justice information, CJIS policy requires reporting within one hour of discovery. Your cyber insurance policy adds its own notice deadline.
Put the numbers in the plan, not in someone’s head. CISA takes reports around the clock through its online incident reporting form or at 1-844-729-2472. The FBI takes them through your local field office or the Internet Crime Complaint Center (IC3).
MS-ISAC changed in 2025, too. Federal funding ended September 30, 2025, and the service now runs on paid membership. If your plan says “call MS-ISAC”, confirm you’re still a member. If not, swap in CISA, your state fusion center and your state’s cyber office. CISA still offers local governments no-cost help, including vulnerability scanning and regional cybersecurity advisors.
CIRCIA, the Cyber Incident Reporting for Critical Infrastructure Act, is also coming. CISA sent its final rule to the White House for review on October 1, 2026, and as of late October 2026 the rule hasn’t appeared in the Federal Register. CISA’s proposed rule covered local governments serving 50,000 or more residents, with 72 hours to report a covered incident and 24 hours to report a ransom payment. If your jurisdiction is over that line, build both clocks into the plan now.
Ransomware Reporting Deadlines for Local Governments
| Who you notify | Deadline | When it applies |
|---|---|---|
| Local Agency Security Officer, then the state CJIS Systems Agency ISO | Within 1 hour of discovery | Criminal justice information may be affected |
| Florida Cybersecurity Operations Center, FDLE Cybercrime Office and local sheriff | Within 12 hours | Florida counties and municipalities |
| North Carolina Department of Information Technology | Within 24 hours of confirmation (state guidance) | North Carolina local governments |
| Ohio Cyber Integration Center, then the Auditor of State | 7 days, then 30 days | Ohio political subdivisions |
| CISA under CIRCIA | 72 hours (incident), 24 hours (ransom payment) | Proposed for jurisdictions of 50,000 or more residents, once the final rule takes effect |
| CISA and the FBI | As soon as possible | All local governments, voluntary today |
| Your cyber insurer | Per your policy | Check the notice clause before an incident |
Decision 6: Contracts to Sign Before You Need Them
Sign four things before an incident: an incident response and forensics retainer, outside breach counsel, a confirmed cyber insurance notice procedure, and a RACI matrix that spells out your IT provider’s role. Otherwise you’ll be comparing forensics firms’ hourly rates while the attacker’s deadline counts down.
Read your cyber policy first. Check whether it requires you to use the carrier’s approved vendor panel and how fast it expects notice, before you hire anyone. Then ask counsel whether engaging forensics through their office will keep the findings privileged.
The RACI covers who is responsible, accountable, consulted and informed for containment, evidence preservation (disk images and memory captures), rebuilds from known-clean images, restore testing, and who talks to the forensics firm. Deciding what stays in-house and what goes to a partner is the core question in choosing government IT solutions for municipalities, and your ransomware plan inherits whatever answer you land on. Any contractor with access to unencrypted CJI also has to sign the CJIS Security Addendum and pass fingerprint-based background checks.
Decision 7: What Are the CJIS Incident Response Requirements for Counties?
If ransomware may affect criminal justice information, the CJIS Security Policy requires reporting immediately, and no later than one hour after discovery, to your Local Agency Security Officer. The LASO then notifies your state CJIS Systems Agency’s Information Security Officer. The current version is CJIS Security Policy 6.1, dated June 25, 2026.
For a county with a sheriff’s office, or a city whose police department shares the network, that clock (control IR-6) runs from discovery, not from the forensic report. Build these into the plan:
- Name the LASO and a backup, and print the state ISO’s contact number.
- Isolate every system that stores or accesses CJI, including CAD and records management (RMS) servers, and coordinate with your state CJIS help desk before reconnecting to state networks.
- Plan to resume essential functions within 24 hours of activating your contingency plan, as control CP-2(3) requires.
- Test your contingency plan every year under control CP-4 (a tabletop exercise qualifies), and test your incident response capability under IR-3. CISA’s free Tabletop Exercise Packages include a ransomware scenario you can adapt.
- Check which policy version your state audits against. Texas DPS, for example, audits against version 5.9.5 through March 31, 2027.
Put the Seven Decisions on Paper
A usable ransomware response plan for local government fits on a few printed pages: named decision-makers and backups, out-of-band contacts, a ranked restoration list, your state’s ransom rules, reporting contacts with deadlines, signed retainers, and CJIS reporting steps. Test it with a tabletop exercise every year.
Back to Friday at 6:40 a.m. Same dead phones, same error page. This time, everyone already knows who decides, where to meet, and what comes back first. The servers still take days. The confusion takes minutes.
Frequently Asked Questions
Can a city or county legally pay a ransomware demand?
It depends on the state. North Carolina and Florida prohibit local governments from paying, and Ohio requires a council or board resolution first. Most other states have no specific ban, but federal sanctions rules still apply. Confirm with counsel before any payment discussion.
Do local governments have to report ransomware to CISA?
Not under federal law yet, because the CIRCIA final rule was still under White House review in late October 2026. The proposed rule would cover local governments serving 50,000 or more residents. Some states already require reporting, and voluntary reports to CISA and the FBI help now.
