Government / Public Sector Compliance

Regulations That Apply

Regulation	What It Covers
FISMA	Federal Information Security Modernization Act — NIST CSF 2.0 commonly referenced for state/local agencies
NIST SP 800-53 Rev 5	Security controls for federal information systems
FedRAMP	Cloud authorization for federal agencies
StateRAMP	State-level cloud authorization (modeled on FedRAMP)
CJIS Security Policy v6.0	Law enforcement data — v6.0 phased compliance through Oct 1, 2027
IRS Pub 1075	If handling federal tax information (FTI)

What You Need In Place

• System Security Plan against NIST 800-53 baseline
• Continuous monitoring program
• FedRAMP-authorized cloud where applicable
• FIPS-validated encryption
• CJIS background checks for personnel
• Multi-factor authentication
• POA&M for any control gaps
• Annual independent assessment

Common Threats In This Sector

Local and county government has been the canonical ransomware target for almost a decade — Atlanta, Baltimore, Albany, Riviera Beach, and many smaller municipalities. The combination of legacy systems, federated authority, and limited budget makes the sector consistently exposed.

• Ransomware against critical municipal systems (permitting, tax collection, court records, 911 dispatch)
• Critical-infrastructure attacks against water utilities, transit, and traffic systems
• Phishing for elected officials and senior administrators
• Compromise of credentials with CJIS or law-enforcement system access
• Tax record exposure subject to IRS Publication 1075
• Election-infrastructure attacks targeting local boards of elections

Documentation You’ll Be Asked For

Federal funding, state oversight, and law-enforcement information sharing each add distinct documentation expectations. NIST SP 800-53 Rev. 5.2.0 is the current control catalog for federal systems; state and local entities increasingly map to it as well.

• FISMA compliance package if receiving federal funding (System Security Plan, ATO, POA&M)
• NIST SP 800-53 Rev. 5.2.0 control implementation evidence
• StateRAMP authorization for cloud services used by state and local government
• CJIS Security Policy compliance documentation for any law-enforcement data
• IRS Publication 1075 controls for federal tax information
• Title 13 compliance for census data, if handled
• Public-records retention and security policies aligned to state open-records law

Where Most Small Local Governments Fall Short

CISA, MS-ISAC, and state IT directors consistently document the same structural gaps in small-municipality cybersecurity. These are systemic, not technical.

• No formal CJIS audit despite a law-enforcement function being present
• Cloud services adopted without StateRAMP authorization
• End-of-life systems still in production because budget cycles do not allow refresh
• No documented FISMA package despite receiving federal funding
• Phishing-resistant MFA not deployed for senior officials or system administrators
• Public records workflows that mix personal devices and personal email accounts with official duties