Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
States can help protect critical infrastructure by hardening their own systems, coordinating public agencies and private operators, and helping smaller organizations improve prevention, response, and recovery. They cannot secure every asset themselves: responsibility is shared among state, local, tribal, territorial, federal, and private-sector actors.
Why does critical-infrastructure security require coordination?
Critical infrastructure includes the assets and services whose disruption can affect national security, the economy, public health, and safety. The Cybersecurity and Infrastructure Security Agency (CISA) describes 16 interconnected sectors, so a cyber incident at one organization may have consequences beyond its own network.
States are well placed to convene agencies and operators, share information, coordinate continuity planning, and help organizations with limited staff or funding reach a practical security baseline. That coordinating role is different from owning or controlling every critical asset. Many utilities and other operators are privately owned, while local governments and school districts also manage essential services.
The U.S. Government Accountability Office (GAO), in its April 29, 2025 report GAO-25-107313, said state and local governments provide essential services including public utilities, healthcare, and public safety. It also reported that attacks on locally owned utilities and school districts had become more frequent and severe. That makes smaller organizations important partners in statewide preparedness—not peripheral concerns.
#1 Best Overall
What security basics should states help put in place?
CISA’s August 29, 2025 fact sheet, Four Cybersecurity Essentials for SLTTs, identifies four foundational practices for state, local, tribal, and territorial governments. They are useful starting points for agencies and for assistance programs aimed at resource-constrained partners.
Train people to recognize phishing
Phishing can expose sensitive information or install malware. Regular, practical training can help employees recognize suspicious messages and know how to report them. Training should be treated as an ongoing operational practice, not a one-time presentation.
Use strong passwords
Set and enforce sound password practices for accounts that rely on passwords. Where an organization uses a password manager or centralized identity service, include those systems in its security and recovery planning.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enable multifactor authentication
Require multifactor authentication (MFA) for accounts and services that support it, prioritizing access with significant privileges or access to sensitive systems. A FIDO2 security key is one possible physical MFA device for compatible systems; compatibility varies, and CISA’s guidance endorses MFA as a control rather than a particular device.
Keep software updated
Apply software updates through a managed process that identifies affected systems, evaluates operational impact, and verifies installation. For systems that cannot be updated promptly, document the exposure and identify appropriate compensating protections rather than treating the system as secure by default.
CISA’s fact sheet states, “Cybersecurity isn’t just best practice—it’s civic duty.” The message is especially relevant where public services depend on systems operated across organizational boundaries.
Rank #3
How should a state prioritize cybersecurity work?
A state should not use one checklist to make every organization’s priorities identical. Start by understanding who owns and operates the system, what service depends on it, and what an incident could do. CISA’s Cross-Sector Cybersecurity Performance Goals provide a voluntary, prioritized baseline covering information technology (IT) and operational technology (OT). They can help organizations focus on high-value practices, but they are a starting point—not a replacement for sector-specific risk management.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Priority area | Best fit | Key questions |
|---|---|---|
| State agency IT | Systems and services operated by state agencies | Are accounts protected, software maintained, important data backed up, and incident responsibilities clear? |
| Local government and school systems | Organizations with essential services and limited cybersecurity capacity | Can the state provide shared training, assessments, exercises, or practical implementation support? |
| Privately operated critical assets | Utilities and other infrastructure operators outside direct state ownership | Who owns the system, who has authority to act, what information can be shared, and how will service continuity be coordinated? |
| Operational technology | Systems that monitor or control physical processes | What could a disruption or unauthorized change do to physical operations, and how would the operator maintain or restore safe service? |
For each candidate project, assess the likely operational consequence, the organization’s readiness, and the cost and technical fit. Readiness includes asset visibility, staffing, incident response, recovery capability, and vendor access. Procurement should account for lifecycle costs and compatibility with existing identity and OT environments—not just the initial purchase.
What should utilities do differently for operational technology?
OT systems monitor or control physical processes, so their security has a direct connection to service continuity and safe operations. Measures designed only for office IT may not fit equipment that supports treatment, storage, or other industrial processes. OT security needs to be planned with the people responsible for operating and maintaining those processes.
Build an accurate asset inventory
Operators need to know which industrial control systems and connected assets they have, where those assets are, and how they relate to operational processes. NIST’s SP 1800-23, published in May 2020 for electric utilities and oil and gas, identifies accurate OT asset inventory as a critical part of cybersecurity strategy and connects ICS asset monitoring and management with continuity of operations. It is a useful reference for that durable principle, not a current account of threats.
Control and review remote access
Remote access can be necessary for maintenance and support, but it creates a path into operational environments that should be understood and controlled. NIST’s SP 1800-45, announced June 24, 2026, demonstrates secure remote-access architectures for water and wastewater OT, with sample implementations in a lab environment using commercially available technologies. It is an example architecture and implementation resource, not proof of a deployment at every utility or an endorsement of vendors. Operators should evaluate any design against their own equipment, operations, and constraints.
Plan around operations and recovery
NIST’s October 1, 2026 Cybersecurity Insights post says recent attacks on water and wastewater systems have targeted OT devices used to manage physical treatment and storage processes. It emphasizes enterprise-wide risk management across people, processes, and technology, and notes that effective protections can help utilities limit impact and restore operations faster. States can support this work by bringing utility operators, emergency managers, and relevant agencies together to clarify how essential services will be maintained and restored during an incident.
Best Value
How can states turn coordination into an actionable program?
A statewide effort works best when each organization knows its role and the state tailors support to the organization’s authority and capacity. A practical sequence is:
- Map critical services and ownership. Identify the agencies, local governments, utilities, and other operators involved in essential services, along with the systems and dependencies they rely on. Confirm who owns each system and who can authorize changes.
- Find the most consequential gaps. Assess service impact alongside basic readiness: asset visibility, identity and access controls, staffing, incident response, recovery, and vendor access. Prioritize gaps that could interrupt important services or impede a safe recovery.
- Set a baseline and assign owners. Use CISA’s Cross-Sector Cybersecurity Performance Goals as a voluntary starting point, then identify the organization or operator responsible for each action. Add sector-specific requirements and operational needs where relevant.
- Practice coordination before an incident. Use tabletop exercises to clarify who shares information, who makes operational decisions, how affected services are communicated, and how recovery will be coordinated across owners.
- Track progress and revise plans. Review whether agreed actions were completed and whether organizations can identify critical assets, contact the right responders, and carry out their recovery responsibilities. Revisit priorities as systems, ownership, and operating conditions change.
Information sharing should have a purpose and clear boundaries. Participants need to know what information is useful, how it can be shared, and who is authorized to receive it. A state can make coordination easier without claiming authority over systems it does not own.
Can grants and outside expertise help close gaps?
Yes, but funding and services are implementation aids rather than automatic solutions. GAO-25-107313 describes State and Local Cybersecurity Grant Program projects that included risk assessments, training, tabletop exercises, and policy work. Such projects can build capacity, especially where local organizations lack dedicated cybersecurity staff.
Free tools Windows power users keep installed
One-click scans. No signup required.
Before relying on a grant, check the requirements and deadlines for the applicable fiscal year and jurisdiction; availability and eligibility are not universal. Match any funded work to a defined need, the organization’s authority, and a plan for maintaining the result after the project ends. For outside technical services, assess procurement requirements, compatibility with existing systems, vendor access, and operational fit. A funded assessment or tool does not by itself ensure that an organization can respond to an incident or restore service.
States can make meaningful progress by strengthening their own systems and making it easier for public and private partners to reduce risk together. The right mix of controls depends on who operates a system, the consequences of disruption, and the organization’s ability to sustain and recover its services.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
