A minimum viable security program for cities and counties.
Most cities and counties are not under-secured because they do not care. They are under-resourced. A practical security cadence can help protect public services without burning out the people responsible for keeping everything running.
The answer is not to do everything at once. The answer is to build a realistic operating rhythm around the security activities that matter most.
City and county IT teams are asked to support public services, protect sensitive data, respond to users, manage vendors, maintain infrastructure, prepare for audits, and keep systems available for departments that cannot simply pause operations when something breaks.
At the same time, cybersecurity expectations keep increasing. Local governments must think about ransomware, phishing, identity protection, backups, cyber insurance, vendor access, compliance requirements, public safety systems, election systems, finance platforms, public records, and more.
That can feel overwhelming, especially for lean IT teams. That is where a Minimum Viable Security program can help.
What is Minimum Viable Security?
Minimum Viable Security is not minimal security. It is practical security.
It means identifying the handful of security habits that reduce the most risk and making sure they happen consistently. For cities and counties, this approach is especially useful because it respects the real constraints of local government: limited staff, limited time, competing priorities, and critical public responsibilities.
The goal is simple: create a security cadence your team can actually maintain.
A good Minimum Viable Security program helps answer practical questions.
Visibility
Are we seeing risky sign-ins, critical alerts, failed login patterns, or unusual admin activity?
Recovery
Are backups completing successfully, and can we prove that critical systems can be restored?
Access
Do the right people and vendors still have the right level of access, and is that access traceable?
A practical weekly, monthly, and quarterly cadence.
A Minimum Viable Security program does not need to be complicated. In fact, the simpler it is, the more likely it is to stick.
Security check
Review critical security alerts, suspicious sign-ins, failed login patterns, unusual admin activity, and backup completion status.
Security tune-up
Review admin accounts, stale users, high-risk patching, internet-facing systems, email security settings, backup health, and vendor changes.
Readiness review
Run a tabletop exercise, validate one Tier 1 restore, review vendor access, update priorities, and track progress against recommendations.
Weekly: the 30-minute security check
Once a week, set aside 30 minutes to review the signals most likely to reveal early trouble.
This is not meant to be a deep forensic review. It is a quick check to make sure obvious warning signs are not being missed.
For cities and counties using Microsoft 365, identity and email are especially important. Many incidents begin with compromised credentials, phishing, or unauthorized access.
Focus on
- Critical security alerts
- Suspicious sign-ins
- Failed login patterns
- New or unusual admin activity
- Backup completion status
Monthly tune-up checklist
- Admin accounts and privileged access
- Former employees, stale accounts, or role mismatches
- High-risk systems that need patching
- Internet-facing systems
- Email security settings
- Backup job health
- Recent vendor, department, or application changes
Monthly: the 60-minute security tune-up
A monthly cadence helps cities and counties catch configuration drift before it becomes a bigger issue.
This is also a good time to ask: what changed this month? New vendor? New department application? New user with elevated access? New remote access need? New compliance requirement?
Small changes can quietly introduce risk if no one reviews them.
Quarterly: the 90-minute readiness review
Once a quarter, cities and counties should step back and test readiness before a real incident forces the question.
Run a tabletop exercise
Start with a simple scenario: what if ransomware hits on a Friday morning? Then walk through who notices first, who makes decisions, who contacts leadership, who contacts cyber insurance, which systems come back first, and which vendors need to be involved.
Validate one Tier 1 restore
Choose one critical system or data set, document the test, record what worked, and note what needs improvement. A backup that has never been tested is not a recovery plan. It is an assumption.
Review vendor access
Confirm which vendors have access, what systems they can access, whether access is still needed, whether MFA is required, and how access is removed when a vendor relationship ends.
Update the priority list
Review progress against previous recommendations and keep unresolved items in one place so leadership can see what is improving and what still needs attention.
How cities and counties can start without burning out staff.
The hardest part of cybersecurity is often not knowing what to do. It is building a rhythm that survives competing priorities.
Make it repeatable
Pick one recurring day each month, use the same checklist, and document what was reviewed.
Keep one list
Track unresolved items in one place and prioritize the highest-risk gaps first.
Report plainly
Share progress in plain language so leadership understands what is improving and where support is needed.
When to bring in help
A Minimum Viable Security cadence is a strong starting point, but some cities and counties may need help identifying what to prioritize first.
Technology Assessments
Identify security gaps, licensing waste, cloud readiness concerns, cyber risk, and network issues.
Explore Technology AssessmentsMicrosoft 365 Secure Score Assessment
Identify risks and misconfigurations across identity, email, collaboration, devices, data, and administrative controls.
Explore Secure ScoreFortify
Move from assessment to action with structured Microsoft cyber-hardening across identity, email, devices, data, and governance.
Explore FortifyQuestions cities and counties often ask about Minimum Viable Security
Is Minimum Viable Security the same as minimal security?
No. It means focusing first on the security habits that reduce the most risk and making sure they happen consistently.
Can a small IT team really maintain this cadence?
Yes, if the cadence is realistic. Weekly, monthly, and quarterly checks create progress without turning security into a massive new project.
Why is backup validation so important?
Having backups is not the same as knowing you can recover. Restore validation helps prove that at least one critical system or data set can come back when needed.
Why review vendor access quarterly?
Vendor access often sits between IT, procurement, departments, and outside providers. A quarterly review keeps accountability clear and reduces lingering access risk.
The bottom line: start with a rhythm your city or county can maintain.
Cybersecurity does not have to start with a massive project. Weekly visibility, monthly tune-ups, and quarterly readiness checks help reduce risk, protect public services, and make progress without burning out the people responsible for keeping everything running.
