Most municipal leaders assume their IT team has a plan for when systems fail. They probably do, some kind of recovery procedure, a backup schedule, maybe a contact list. So leadership assumes that when pressure arrives, IT will know what to do and leadership’s job is to communicate the delay to the board and residents.
Then systems actually go down, and leadership discovers the plan doesn’t exist where it matters most: in the decisions only leadership can make.
The Real Problem Isn’t Technical Recovery
Here’s what happens: A critical system goes offline at 9 AM. Finance. Permitting. Utility billing. Pick one. Within 30 minutes, IT says they’re working on it. Within an hour, they still don’t know when it will be back. Within two hours, leadership is asking questions IT can’t answer:
“How long will we be down?”
“Do we keep paying staff who can’t work?”
“Does Finance need to process anything manually?”
“Can Permitting issue emergency permits while we’re offline?”
“Who tells residents when their bills won’t post?”
“If this takes until tomorrow, what do we tell the board?”
These aren’t IT questions. A private company asks them to protect revenue. A municipality asks them to maintain public trust. And they’re not being asked by the IT department. They’re being asked by leadership under pressure, often for the first time.
That’s the real exposure.
The Invisible Gap
The gap isn’t whether backups exist. Most municipalities have them. The gap is between having an IT recovery plan and having a leadership plan for what happens when recovery takes longer than expected.
Here’s what that usually looks like:
Nobody decided who owns the first hour. When systems go down, who makes the first call? Who decides whether to try a restart or immediately escalate to the vendor? Who has authority to say “we’re waiting” vs. “we’re moving to manual processes”? Usually nobody decides this in advance. So it gets decided during a crisis, by whoever picks up the phone first.
Nobody decided what gets restored first. If everything is down, does Finance come back before Permitting? Does Email get restored before shared drives? That’s not a technical question—it’s a business question. IT can implement whatever order leadership chooses. But if leadership doesn’t choose before the outage, IT guesses. And IT’s guess might not match what actually keeps the municipality operating.
Nobody defined who has authority when IT can’t give a timeline. Vendor says “we don’t know.” IT says “we’re still investigating.” An hour passes. Two hours. The board is asking. Residents are calling. Who has authority to decide “we’re escalating to the vendor’s executive team” or “we’re pivoting to manual processes” or “we’re extending this to the public”? Usually nobody. So leadership improvises under pressure.
Nobody decided how communication works. If email is down, how does leadership communicate with the board? If the permitting system is down, how do residents find out? Who writes the message? Who approves it? Who sends it? If that wasn’t decided in advance, it gets decided while everyone is stressed and the situation is still unfolding.
Nobody defined what “service continues” looks like. A utility can’t bill residents for a week if their system is down. But what’s the contingency? Manual billing? Extended due dates? Waived late fees? Do you have authority to make that decision in real time, or does it require a board vote? If the latter, when does the board meet? That matters. A lot.
These are all leadership decisions. Not IT decisions. Not vendor decisions. Leadership decisions.
And many municipalities have never made those decisions explicitly.
Why This Is Different From a Disaster Recovery Problem
Even when IT has a recovery process, leadership still has a separate problem: deciding what happens while restoration is underway.
Cyber insurers are increasingly asking the same governance questions leadership should already be asking internally. They used to ask “Do you have backups?” Now they ask “Who owns the recovery decision?” and “What’s your escalation path if recovery takes longer than expected?” and “How does your municipality communicate when systems are down?”
Those questions exist because insurers have seen what happens when leadership doesn’t answer them. The technology may eventually get fixed. But the ownership gaps that were invisible before the outage are now visible to leadership, staff, and sometimes the public
Before the Next Outage, Leadership Should Answer These Questions
Pick the three systems that would cause the most immediate operational or public impact if they went down. Then answer:
- Who owns the first hour? One person. Documented. They have authority to make the first decision about whether to wait, escalate, or shift to contingency operations.
- What order should systems come back in? Have that conversation now—with Finance, Operations, HR, whoever runs a critical department. If everything is down, which one gets restored first? Why? That decision, made now, saves hours of argument during an outage.
- Who has authority to make operational tradeoffs? If recovery is delayed, can Finance manually process transactions? Can Permitting issue emergency permits? Can you extend a payment deadline? Who decides, and do they have authority to do it without a board meeting?
- Who communicates with the board and public? During an outage, someone has to write a message. Who? Are they authorized to do it, or does it need approval first? If it needs approval, from whom? And how fast can you reach them?
- What happens if the vendor can’t give you a timeline? You escalate. To whom? Do you have a contact? Can you reach them after hours? What’s your threshold for going public?
Answer those five questions for three systems, and leadership has a much clearer foundation for the rest of the recovery plan. You still need IT to restore the systems. You still need backups and vendor commitments. But you won’t be making critical business decisions for the first time while systems are down. Once service is restored, the next question is whether leadership takes time to understand what the outage revealed before everyone moves on.
Questions Leaders Are Asking
What decisions does municipal leadership actually need to make when a critical system goes down?
These aren't IT questions. A municipality asks them to maintain public trust. And they're not being asked by the IT department. They're being asked by leadership under pressure, often for the first time. Questions like: 'Do we keep paying staff who can't work?' 'Does Finance need to process anything manually?' 'Who tells residents when their bills won't post?' and 'If this takes until tomorrow, what do we tell the board?'
What is the gap between having an IT recovery plan and being prepared for a system outage?
The gap isn't whether backups exist. Most municipalities have them. The gap is between having an IT recovery plan and having a leadership plan for what happens when recovery takes longer than expected.
Who should have authority to make operational decisions when systems are down and IT can't give a timeline?
Nobody defined who has authority when IT can't give a timeline. Vendor says 'we don't know.' IT says 'we're still investigating.' Who has authority to decide 'we're escalating to the vendor's executive team' or 'we're pivoting to manual processes' or 'we're extending this to the public'? Usually nobody. So leadership improvises under pressure.
What five questions should municipal leadership answer before the next system outage?
Pick the three systems that would cause the most immediate operational or public impact if they went down. Then answer: Who owns the first hour? What order should systems come back in? Who has authority to make operational tradeoffs? Who communicates with the board and public? What happens if the vendor can't give you a timeline?
Why are cyber insurers now asking governance questions about system recovery, not just whether backups exist?
Cyber insurers are increasingly asking the same governance questions leadership should already be asking internally. They used to ask 'Do you have backups?' Now they ask 'Who owns the recovery decision?' and 'What's your escalation path if recovery takes longer than expected?' Those questions exist because insurers have seen what happens when leadership doesn't answer them.