The information contained in this article is not intended as legal advice and may no longer be accurate due to changes in the law. Consult NHMA's legal services or your municipal attorney.
When we want to improve our health, we already know what works: Eat well. Move your body. Sleep. Drink water. Manage stress. None of those habits are exciting, but pursued and achieved together they are effective. Most people don't need a revolutionary new wellness trend to be healthy; they need consistency with the fundamentals.
Cybersecurity works the same way. Municipal leaders are understandably hearing a lot about artificial intelligence, ransomware, and increasingly sophisticated cyber threats. The headlines make it sound as though protecting a community requires equally sophisticated solutions. But the reality is simpler.
The strongest communities aren't always the ones with the biggest budgets or the newest technology. They're the ones that consistently do the basics well. They know what technology they have. They keep systems updated. They control access to critical resources. They back up important data. They train staff to recognize threats. They prepare for disruptions before they happen. These aren't glamorous investments, but they're the ones that matter most.
This matters now more than ever. AI is making cyberattacks faster, cheaper, and more convincing. Yet attackers continue to succeed for the same reason they always have: organizations neglect the fundamentals. That's good news for municipal leaders who are already being asked to do more with less. Cybersecurity doesn't have to become another overwhelming initiative competing with every other priority. Like improving your health, resilience is built one good decision at a time.
The goal isn't perfection. It's progress. In health, the basics don't become less important as medicine advances—they become even more important. The same is true in cybersecurity. Work towards multi-factor authentication and complex passwords (or explore password managers to reduce cognitive burden on your staff). Teach staff to be vigilant with the websites they visit and the links they click on or places they enter their password. Invest in the foundational network equipment you need to make it harder for bad actors to get access to your community's systems. Bring all your key stakeholders together to talk about what to do if you lose internet or access to core operational systems. Know who to call for help in the event of a cyber emergency. Stick to these fundamentals, and your community will be better prepared for whatever comes next.
This is a topic The Overwatch Foundation is so passionate about that we are leading a session at the upcoming NHMA annual conference. We’d love to see you there! We'll discuss practical, achievable ways to strengthen your organization's cyber resilience, integrate cybersecurity into existing operations and budgets, and help your community become more resilient—without overwhelming your staff or resources.
The strongest defense isn't always the newest tool. It's the discipline to consistently do the simple things well.