When a Cyber Incident Hits, Who Gets the Call?
Something unusual has happened.
An employee account may be compromised. Files may be unavailable. A vendor has reported suspicious activity. At first, no one knows how serious the situation is.
The immediate question is usually technical:
What happened?
Another question follows quickly:
Who needs to be involved?
Your IT team or technology provider may need to investigate and contain the problem. Municipal leadership may need to make operational decisions. Depending on the circumstances, cyber insurance, legal counsel, law enforcement, vendors, or other outside resources may also need to become involved.
There isn’t one call sequence that fits every cyber incident.
What matters is that your municipality isn’t deciding who does what for the first time while the incident is already unfolding.
That is why incident response planning is as much about roles, authority, and coordination as it is about technology.
A Cyber Incident Quickly Becomes an Operational Problem
A cyber incident may begin with a technical symptom: a suspicious login, inaccessible files, unusual email activity, or an alert from a monitoring system. But when that issue affects employees, systems, public services, or departmental operations, it can quickly become a leadership and operational problem, not just an IT problem.
The technical response matters. Someone needs to determine what happened, what may be affected, and what actions are appropriate to limit additional impact.
Why Technical Resources Alone Are Not Enough
But that work doesn’t happen in isolation.
A department may be unable to perform an important function. A vendor may need to participate. Employees may need instructions. Leadership may have to make decisions about service availability, recovery priorities, communication, or outside assistance.
This is where municipalities can run into trouble even when capable technical resources are available.
The technology team can investigate the incident. It should not have to invent the municipality’s decision process at the same time.
Current NIST incident response guidance reflects this broader view. Incident response is part of cybersecurity risk management and involves responsibilities that extend beyond the people performing the technical work.
The practical question for municipal leadership, then, isn’t simply whether IT knows how to respond.
It is whether everyone else knows how they fit into that response.
Who May Need to Be Involved in a Municipal Cyber Incident?
The goal isn’t to memorize a call order. It’s to establish who owns each part of the response and when an issue moves from a technical problem to a leadership decision.
The answer depends on what happened.
A compromised email account and a widespread system outage may require very different responses. That’s why a municipality should be cautious about relying on a generic call list that says to contact the same people in the same order every time.
Instead, an incident response plan should define the roles that may need to participate and establish how those roles are brought into the response. Defining incident response roles and decision authority in advance helps ensure that technical responders and municipal leadership understand where responsibilities begin, where authority changes hands, and when an issue needs to be escalated.
Technology and Cybersecurity Response Team
Depending on how the municipality manages technology, this may involve internal IT staff, an outside IT provider, a cybersecurity provider, or some combination of them.
Their responsibilities may include investigating alerts, identifying affected accounts or systems, limiting further exposure, preserving relevant information, coordinating with technical vendors, and supporting remediation and recovery.
Technical responders also need a clear escalation path.
If they discover that an incident could affect municipal operations or requires a decision outside their authority, they should already know who needs to be brought into the conversation.
Municipal Leadership and Decision Authority
Some decisions cannot—and should not—be made by the technology team alone.
Leadership may need to establish operational priorities or authorize actions that affect important municipal services, employees, finances, communication, or recovery.
That makes decision authority part of incident preparedness.
If taking a critical system offline could interrupt a public service, for example, the technical question may be clear while the operational decision requires leadership involvement.
The time to determine who has that authority is before the decision is needed.
Department Leaders and Operational Context
Department leaders provide context that technical responders may not have.
They understand what a system means to day-to-day operations.
Which functions are affected? Is there a manual workaround? Which service needs to be restored first? What do employees need in order to continue working?
Those questions become especially important when several systems or departments are affected at once.
Cybersecurity response and operational continuity have to work together.
Cyber Insurance Requirements and Contacts
Cyber insurance may also become part of the response.
Policies can contain notification requirements, response procedures, or provisions involving specific outside resources. Those requirements vary, which is why municipalities should understand their own policy before an incident occurs rather than making assumptions during one.
The incident response plan should identify where current insurance information is maintained, who is responsible for reviewing applicable requirements, and how the appropriate contacts are reached.
When to Involve Legal Counsel
Depending on the circumstances, legal counsel may need to advise the municipality regarding legal obligations, communications, preservation of information, or other response considerations.
Again, there is no universal point at which every municipality should make that call.
The control is having an established process for determining when and how counsel becomes involved instead of leaving the question undefined until an incident occurs.
Law Enforcement and Government Cybersecurity Resources
Certain incidents may also warrant reporting to or assistance from law enforcement or government cybersecurity resources.
The appropriate path will depend on the circumstances.
A prepared municipality knows where those decisions sit within its response process and has current contact information available if those resources are needed.
Why Decision Authority Is the Most Overlooked Incident Response Gap
Municipalities can invest in security technology and still lose valuable time during an incident because nobody is sure who can make a necessary decision.
Consider the questions that can surface quickly:
• Who can authorize taking an important system offline?
• Who determines which municipal operation should be restored first?
• Who coordinates the technical response?
• Who can approve unexpected incident-response expenses?
• Who contacts insurance, counsel, or other outside parties?
• Who coordinates multiple technology vendors?
• Who provides employees with instructions?
• Who keeps the appropriate municipal leaders informed?
• Who approves external communication?
• Who documents significant decisions and actions?
These aren’t firewall questions.
They are governance questions.
NIST’s Cybersecurity Framework 2.0 specifically addresses cybersecurity roles, responsibilities, and authorities as part of governance. That matters because good incident response depends on people understanding both what they are responsible for and where their authority ends. This is also why clear cybersecurity ownership matters long before an incident occurs. When ownership is unclear during normal operations, decision-making becomes even harder when something goes wrong.
For municipalities, there is an important operational lesson here:
A slow cyber response is not always a technology failure. Sometimes the technical team is waiting for a decision that no one realized needed an owner.
During an incident, municipal leaders do not need a stream of technical detail. They need to understand what is affected, what decisions are required, what the operational consequences may be, and what happens next. That same principle applies when communicating technology risk to a village board: leadership needs the information required to make a decision, not enough technical detail to become technology experts.
Key Decisions Every Municipality Should Make Before a Cyber Incident
A useful incident response plan should do more than identify cyber threats or list technical procedures.
It should establish how the municipality will coordinate its response.
Leadership should be able to answer questions such as:
• Who coordinates the technical response, and who is the backup?
• Who has leadership decision authority?
• How does an issue get escalated from IT to municipal leadership?
• Which department leaders may need to participate?
• Where are current insurance, legal, vendor, and other response contacts maintained?
• Who handles employee, leadership, and public communication?
• How are outside resources engaged when needed?
• How are important response decisions and actions documented?
• How are recovery priorities determined?
• When was the response process last reviewed or exercised?
The goal isn’t to predict every incident.
It is to reduce the number of important decisions that have to be invented while one is happening.
A response plan sitting in a folder is also only part of the answer. The people named in it need to understand their roles, and the information in it needs to remain current.
How Security Technology Supports—But Doesn’t Replace—Your Response Plan
Security tools are essential, but they solve a different part of the problem.
Incident response planning establishes the structure. Security controls give responders the visibility and capabilities needed to act within that structure.
Security Controls That Support Municipal Incident Response
For example, 24/7 monitoring and detection can help identify unusual activity and provide information responders can investigate.
Identity and access controls, including MFA, conditional access, least privilege, and appropriate access reviews, can reduce exposure and give responders greater control when accounts are involved.
Microsoft 365 configuration control can improve visibility into identity, permissions, email, and collaboration risks.
Zero Trust enforcement can help limit what compromised accounts, applications, or devices are able to reach.
And tested backup and restore gives the municipality a known recovery capability when systems or data are affected.
Those controls matter.
But none of them determines who has the authority to make a municipal decision, who communicates with a department, or who coordinates several outside parties during an incident.
Tools help responders act. A response plan establishes who acts, who decides, and how the municipality coordinates the response.
One Question Every Municipal Leader Should Ask Before an Incident
You don’t need to become a cybersecurity expert to learn something important about your municipality’s preparedness.
Ask your IT team or technology provider this:
“If we discovered a compromised employee account tomorrow morning, who would you contact here, what decisions would you need from us, and who else might need to become involved?”
Pay attention to the answer.
A strong response shouldn’t depend entirely on one person’s memory.
The technology team or provider should understand the escalation path. Leadership should know where its decision authority begins. Important outside contacts should already be known or documented. Recovery and communication responsibilities should not have to be invented from scratch.
If answering the question requires searching for insurance documents, figuring out which vendor owns a system, deciding for the first time who has authority, or discovering that the only knowledgeable person is unavailable, you have learned something valuable.
The gap may not be your technology.
It may be your response process.
Test the Process Before You Need It
A written incident response plan is a starting point.
Testing it is how you find out whether it works.
What a Tabletop Exercise Can Reveal
A tabletop exercise or structured incident response review can uncover issues that aren’t obvious when reading a document:
Does the backup decision-maker know they are the backup?
Are vendor contacts current?
Does leadership understand what information the technology team may need?
Can insurance and response information still be accessed if normal systems are unavailable?
Do department leaders know what they would do while an important system is down?
Are recovery priorities understood?
Who records the decisions made during the incident?
These are exactly the kinds of details that become difficult to solve under pressure.
They also matter from a defensibility standpoint.
A documented plan shows intent. A reviewed and exercised plan gives leadership greater confidence that the process can actually work, and provides stronger evidence when someone eventually asks for proof that cybersecurity safeguards are actually in place.
Know the Roles Before You Need Them
Cyber incident response will never be completely predictable.
Different incidents require different technical actions, operational decisions, and outside resources.
What can be established in advance is the structure around the response.
Municipal leadership should know who coordinates the technical work, who has decision authority, how issues are escalated, which outside parties may need to participate, and how important decisions will be documented.
That preparation reduces the number of decisions that have to be made for the first time under pressure and gives the people responding a clearer path forward.
Questions Leaders Are Asking
Who needs to be involved when a municipality has a cyber incident?
Your IT team or technology provider may need to investigate and contain the problem. Municipal leadership may need to make operational decisions. Depending on the circumstances, cyber insurance, legal counsel, law enforcement, vendors, or other outside resources may also need to become involved.
Why isn't having a capable IT team enough to handle a municipal cyber incident?
A department may be unable to perform an important function. A vendor may need to participate. Employees may need instructions. Leadership may have to make decisions about service availability, recovery priorities, communication, or outside assistance. The technology team can investigate the incident. It should not have to invent the municipality's decision process at the same time.
Why do municipalities lose time during a cyber incident even when they have security technology in place?
Municipalities can invest in security technology and still lose valuable time during an incident because nobody is sure who can make a necessary decision. A slow cyber response is not always a technology failure. Sometimes the technical team is waiting for a decision that no one realized needed an owner.
What decisions should a municipality make before a cyber incident occurs?
Leadership should be able to answer questions such as: Who coordinates the technical response, and who is the backup? Who has leadership decision authority? How does an issue get escalated from IT to municipal leadership? Which department leaders may need to participate? Where are current insurance, legal, vendor, and other response contacts maintained? Who handles employee, leadership, and public communication?
How can a municipality test whether its cyber incident response plan actually works?
A tabletop exercise or structured incident response review can uncover issues that aren't obvious when reading a document. A documented plan shows intent. A reviewed and exercised plan gives leadership greater confidence that the process can actually work, and provides stronger evidence when someone eventually asks for proof that cybersecurity safeguards are actually in place.