Cybersecurity for cities, counties, and the systems that run them.
CyNtell provides OT security, Fractional CISO leadership, gap assessments, and penetration testing to municipalities and the utilities, public safety agencies, and public works systems they operate, from water treatment SCADA to police records systems, without requiring a full-time security department.
Who this is for
Cities, counties, water and wastewater utilities, and public safety agencies, typically without a dedicated security team
Frameworks
AWIA Section 2013, CJIS Security Policy, IEC 62443 and NIST SP 800-82, and CISA and MS-ISAC guidance
Core services
OT security, Fractional CISO, gap assessments, and penetration testing
Delivered by
CyNtell's own in-house team, never subcontracted or white-labeled
What is municipal cybersecurity?
Municipal cybersecurity is the set of technical and administrative controls a city or county government maintains to protect its operational technology (water, power, and traffic), its public safety systems, and its general IT infrastructure. CyNtell works across all three layers, building the security program without requiring the municipality to staff a full in-house security team.
Why now
What's driving municipal cybersecurity right now
AWIA's cybersecurity mandate is already in force
Since America's Water Infrastructure Act of 2018, any community water system serving more than 3,300 people must certify a Risk and Resilience Assessment and an Emergency Response Plan that address cybersecurity, including automated (OT and SCADA) systems and threat detection. Both must be recertified every five years.
CJIS Security Policy now requires MFA and a full compliance date
The FBI's CJIS Security Policy governs any system that stores, processes, or transmits criminal justice information. Version 6.0 (December 2024) realigned it with NIST SP 800-53, and version 6.1 (June 2026) is the current baseline. Multi-factor authentication has been enforceable since October 2024. Local police departments and courts are covered whether or not they have a full-time security officer.
Grant funding may already be available to pay for it
The federal State and Local Cybersecurity Grant Program (SLCGP) passes funds to local governments through each state. Many municipalities can use this funding, rather than their general fund, to pay for a gap assessment, OT security, or Fractional CISO engagement. Availability and application windows vary by state.
Frameworks
Which framework applies to your municipality?
Municipal cybersecurity isn't one requirement. It depends on which systems and services a municipality operates. CyNtell's assessors confirm which frameworks actually apply before proposing a scope of work.
| System or agency type | Primary framework | Key requirement | Status as of October 2026 |
|---|---|---|---|
| Water or wastewater utilityCommunity water system serving more than 3,300 people | AWIA Section 2013 (EPA) | Risk and Resilience Assessment and Emergency Response Plan that address cybersecurity, recertified every five years | In forceOngoing five-year recertification cycle |
| Power, traffic and transit, or facilities OTElectric distribution, ITS, and building systems | IEC 62443 and NIST SP 800-82 | OT and ICS risk assessment, network segmentation, and monitoring | Industry practiceWidely referenced, not a single binding federal mandate |
| Police, courts, or any agency handling criminal justice information | CJIS Security Policy (FBI) | Mandatory MFA, encryption, and a designated Local Agency Security Officer | Deadline 2027Version 6.1 current; full compliance by October 1, 2027 |
| General city or county ITAdministrative systems and resident data | CISA and MS-ISAC guidance, plus state breach notification law | Voluntary baseline, often a condition of cyber insurance or grant funding | Voluntary baselineGrant availability varies by state |
| K-12 public school district | FERPA and CISA K-12 guidance | Student data privacy and ransomware resilience | Separate engagementScoped separately from city or county work |
Not sure which applies? and we'll map it on the first call.
CyNtell provides assessment and advisory services and does not provide legal advice. Municipalities should confirm which requirements apply with counsel and with their state or regulatory agency.
Who CyNtell serves
Municipal clients CyNtell works with
Water and wastewater utilities
CyNtell helps utilities meet AWIA's Risk and Resilience Assessment and Emergency Response Plan requirements, and secures the SCADA and automated systems those plans have to address.
- OT asset inventory, monitoring, and risk assessment for SCADA and ICS
- Gap assessment against AWIA Section 2013
- Vulnerability testing scoped for safety-critical, always-on systems
Police, courts, and public safety
CyNtell helps police departments, court systems, and other public safety agencies meet CJIS Security Policy requirements, including MFA and encryption, without a dedicated in-house security officer.
- Gap assessment against the CJIS Security Policy
- Fractional CISO support for the Local Agency Security Officer role
- Penetration testing of records and case management systems
City and county government operations
CyNtell helps general government, including administrative IT, electric distribution, traffic and transit, and public buildings, build a security baseline, often paid for with grant funding rather than the general fund.
- OT security for power, traffic and transit, and facilities systems
- Gap assessment against a CISA and MS-ISAC aligned baseline
- Engagement scoping sized for grant funding
How CyNtell helps
Services mapped to what municipalities actually operate
Each core service lines up with a specific system or requirement, not a generic security package.
OT security
CyNtell inventories, monitors, and risk-assesses the operational technology municipalities depend on, including water and wastewater SCADA, electric distribution, traffic and transit (ITS), and building systems.
FrameworksIEC 62443 · NIST SP 800-82 · AWIA
See OT securityFractional CISO
CJIS expects a designated Local Agency Security Officer, and an AWIA Emergency Response Plan needs a named owner. CyNtell's Fractional CISO supports that leadership at a fraction of a full-time hire's cost.
FrameworksCJIS Security Policy · AWIA
See Fractional CISOGap assessments
CyNtell's assessors evaluate your controls against the frameworks that actually apply, one or several at once, and deliver a prioritized roadmap sized to fit grant-funded budgets.
FrameworksAWIA · CJIS · CISA and MS-ISAC baseline
See gap assessmentsPenetration testing
CyNtell's testers validate that controls hold up, from police records systems to city and county IT, using safety-scoped methods for OT environments where an uncontrolled test could cause an outage.
ScopeIT systems · OT and ICS environments
See penetration testingReady to scope a gap assessment? Tell us which systems you operate and we'll size it to your budget or grant.
Why municipalities choose CyNtell
One team for the systems a municipality actually runs
OT and IT under one roof
Most cybersecurity firms handle traditional IT only. CyNtell covers both operational technology (SCADA and ICS) and conventional IT security, the combination a municipality needs, from a single vendor.
Assessment discipline from C3PAO work
CyNtell is an Authorized C3PAO conducting CMMC certification assessments against a federal standard. Municipal clients get the same evidence discipline: a documented basis for every finding that another assessor could repeat.
In-house delivery
OT security, Fractional CISO engagements, gap assessments, and penetration testing are delivered by CyNtell's own analysts and assessors, never subcontracted or white-labeled.
Municipal cybersecurity questions, answered
Does AWIA require my water utility to address cybersecurity?
Yes, if your community water system serves more than 3,300 people. America's Water Infrastructure Act requires both the Risk and Resilience Assessment and the Emergency Response Plan to address the security of automated systems and the detection of security threats, and both must be recertified every five years. CyNtell can scope an assessment against this specific requirement.
What is the CJIS Security Policy, and does it apply to my police department or court?
The CJIS Security Policy is the FBI's security standard for any system that stores, processes, or transmits criminal justice information. It applies to local police departments, courts, corrections facilities, and their IT vendors, not just federal agencies. Version 6.0 (December 2024) realigned the policy with NIST SP 800-53, version 6.1 (June 2026) is the current baseline, and multi-factor authentication has been enforceable since October 2024. Full compliance is required by October 1, 2027.
Is there grant funding available to pay for a municipal cybersecurity program?
Often, yes. The federal State and Local Cybersecurity Grant Program (SLCGP) passes funds to local governments through each state, and availability and application windows vary by state. CyNtell can scope a gap assessment, OT security, or Fractional CISO engagement sized to what a specific award or application supports.
What's the difference between OT security and a gap assessment?
A gap assessment reviews a municipality's policies, procedures, and controls against a specific framework and produces a prioritized list of fixes. OT security is the hands-on work of inventorying, monitoring, and hardening the operational technology itself, such as the SCADA and ICS systems that control water treatment or traffic signals. Most municipalities with utility or public works systems need both.
Is penetration testing safe to run on live water, power, or traffic systems?
CyNtell scopes OT and ICS testing differently from a standard IT penetration test because these are safety-critical, always-on systems where an uncontrolled test could cause a real outage. That means non-disruptive methods, careful scheduling, and close coordination with your operations staff before any testing begins.
Does CyNtell handle K-12 school districts as part of municipal work?
CyNtell serves K-12 school districts, but as a separate engagement. Districts have their own framework (FERPA) and typically operate independently of city or county IT, even when publicly funded. If your municipality includes both a general government function and a school district, how to scope each.
Ready to find out where your municipality stands?
A free, no-obligation call with a CyNtell security specialist. No pressure, no commitment.
or call 1 (833) CYNTELL (296-8355)