Protecting Public Services & Taxpayer Trust: Cybersecurity Responsibilities of County & Municipal Governments.

Cyber threats are pervasive, and our county and municipal government agencies bear a crucial responsibility in safeguarding taxpayer dollars and sensitive citizen data.  In 2023, ransomware attacks on U.S. municipalities surged by 51%, costing taxpayers millions. Without action, West Virginia counties face the same risks: financial loss, service disruptions, and diminished public trust. Cybersecurity isn’t just about IT—it’s about protecting taxpayer services and communities.

 

Legal & Regulatory Responsibility for Cybersecurity Due Care

The absence of a state-mandated cybersecurity framework leaves West Virginia's counties, municipalities, and school systems highly vulnerable to cyberattacks.  Without effective cybersecurity laws, West Virginia counties and municipalities across the state must independently determine best practices—often leading to inconsistent protections. A statewide cybersecurity framework compliance law will provide for uniform cybersecurity standards, preventing millions in taxpayer losses from cyberattacks. By codifying a clear cybersecurity framework with strict compliance requirements supported by grants, training, off-set funding, or technology resources, taxpayers across the state can have a high degree of trust in their elected officials and agencies that are charged with providing protections against cyber-threats.

 

Establishing a Harrison County Cybersecurity Working Group

To combat growing cyber risks, Harrison County should take the lead by forming a cybersecurity task force to coordinate risk assessments, implement best practices, and improve cyber-resilience across municipalities. This approach will bring together municipal leaders, agency officials, and cybersecurity professionals to develop a coordinated cybersecurity strategy, helping local agencies anticipate and respond to cyber-threats more effectively.

 

 

The Growing Cost of Cybersecurity Incidents on Local Governments

Cyberattacks on municipal governments are costly. The average ransomware attack costs approximately $2.3 million in recovery, downtime, and legal fees. A single cybersecurity event in West Virginia, affecting any of its 55 counties or 234 municipalities, could result in the following;

Proactively investing in a state-led approach to cybersecurity resilience using existing cybersecurity frameworks [periodically assessed], counties and municipalities can reduce the risk of a successful cybersecurity event.

 

Cyber Hygiene Education for Public Employees & Officials

Human error is the weakest link in cybersecurity—95% of cybersecurity events result from mistakes like clicking on phishing emails or using agency email for personal use. Ensuring a cyber-aware workforce is essential for maintaining taxpayer trust. Public employees and elected officials must receive structured, measurable cybersecurity training to safeguard public assets. Cybersecurity awareness isn’t just an IT responsibility—it’s a collective duty to protect the taxpayer and public services.

 

A Call for Action

The digital era demands that municipal governments take cybersecurity seriously.  West Virginia, alongside Harrison County and its municipalities, must lead by example to implement structured cybersecurity policies, measurable cybersecurity training programs, and collaborative efforts to safeguard taxpayer resources. A codified state cybersecurity strategy will provide oversight, direction, and policy guidance—ensuring a cyber-resilient workforce and safeguarding taxpayer resources, municipal assets, and citizens' personal data.