Security Assessments
Prioritized findings against the NIST Cybersecurity Framework and CIS Controls.
Capability
Cybersecurity
Assessments, security engineering, compliance support, and monitoring for agencies that hold sensitive public data.
Overview
State and local agencies are frequent targets. They hold criminal justice information, health records, personal data, and financial systems, and they often run with small security teams. HQT's cybersecurity specialists help agencies understand their exposure, close the gaps that matter most, and meet the compliance obligations that come with the data they hold.
We favor practical, prioritized work over shelfware. Multi-factor authentication, backups, patching, logging, and access control resolve most real-world incidents. Frameworks such as the NIST Cybersecurity Framework and the CIS Controls give that work structure and let an agency show progress to auditors, insurers, and elected officials.
Where we help
- Security assessments against the NIST Cybersecurity Framework and CIS Controls
- CJIS, HIPAA, PCI, and IRS Publication 1075 compliance support
- Zero Trust architecture and implementation
- Vulnerability management and penetration testing
- Security monitoring and incident response planning
- Security awareness programs for agency staff
How we approach it
We begin with an assessment scoped to the agency's actual systems and data, produce a prioritized roadmap, and then help implement it. Findings are written in plain language for leadership and in technical detail for the staff who fix them.
Services
CJIS & Regulatory Compliance
Meeting CJIS, HIPAA, PCI, and IRS 1075 requirements for systems that hold regulated data.
Zero Trust Architecture
Moving from perimeter-based security to verified access for every user and device.
Vulnerability Management & Penetration Testing
Finding and fixing weaknesses before someone else does.
Security Monitoring & Incident Response
Logging, detection, and a practiced plan for when something goes wrong.
Security Awareness Programs
Training that staff actually remember, measured by behavior rather than attendance.
Risk Management Framework Support
RMF, NIST SP 800-53, and authorization support for federal work through teaming partners.
NIST 800-171 & CMMC Readiness
Preparing to handle controlled unclassified information for federal subcontracts.
Cybersecurity by agency type
- Cybersecurity for Cities and TownsPractical security programs for municipal IT teams that support finance, public works, police, and fire with limited staff.
- Cybersecurity for County GovernmentsSecurity programs spanning health, human services, justice, elections, and public works, each with its own regulatory obligations.
- Cybersecurity for Public Safety AgenciesProtecting dispatch, records, and mobile systems under the CJIS Security Policy without compromising availability.
- Cybersecurity for Water, Power, and Public UtilitiesSegmenting and defending control systems and the business systems that surround them.
- Cybersecurity for School Districts and CollegesRansomware-resistant security for districts with thousands of devices, small teams, and student privacy obligations.
- Cybersecurity for Special Districts and AuthoritiesSecurity fundamentals for fire, water, park, library, and regional agencies without in-house IT security staff.
- Cybersecurity for State AgenciesSecurity assessments, compliance evidence, and Zero Trust planning for departments answering to both state enterprise standards and federal auditors.
- Cybersecurity for Transit and Transportation AgenciesSecurity programs for agencies that run signals, train control, fare payment, and public services without taking any of it offline.
- Cybersecurity for Corporations and Private Sector CompaniesSecurity assessments, compliance readiness, and Zero Trust work for companies whose government customers, regulators, and insurers set the security bar.
- Cybersecurity for Federal Programs Through Teaming PartnersRisk Management Framework support, NIST SP 800-171 readiness, and continuous monitoring design provided as a subcontractor to prime contract holders.
Frequently asked questions
What does a security assessment involve?
Interviews, review of policies and configurations, technical validation such as vulnerability scanning, scoring against the NIST Cybersecurity Framework and CIS Controls, and a prioritized roadmap. The executive summary is written for a council or board; the technical detail is for the staff who fix things.
Will assessment results be public records?
They may be subject to requests. We structure reports so that sensitive technical details can be withheld under applicable exemptions while the summary remains shareable. Agency counsel makes the final determination.
Do you perform penetration testing?
Yes, under written rules of engagement agreed with the agency, covering scope, timing, and emergency contacts. Reports include reproduction steps and evidence, and we retest to confirm remediation.
Can you help with CJIS compliance?
Yes. We scope which systems and people fall under the CJIS Security Policy, perform gap analysis, implement controls, and prepare audit evidence. HQT staff assigned to public safety work complete the required background screening and training.
Where should an agency with limited budget start?
Multi-factor authentication on everything internet-facing, tested and isolated backups, patching, centralized logging, and an incident response plan that has been exercised. These address the majority of real incidents and are prerequisites for cyber insurance.