Cybersecurity for County Governments
Cybersecurity for County Governments
Security programs spanning health, human services, justice, elections, and public works, each with its own regulatory obligations.
Counties carry the widest regulatory surface in local government. One organization holds criminal justice information in the sheriff's records system, protected health information in behavioral health and correctional clinics, federal tax information in child support services, and election systems under intense public scrutiny. Each has a different rulebook and a different auditor.
What county environments look like
- Sheriff and probation systems under the CJIS Security Policy, with state audits
- Health, behavioral health, and correctional health records under HIPAA and federal substance use confidentiality rules
- Human services eligibility systems connected to state platforms, some touching federal tax information under IRS Publication 1075
- Assessor, recorder, and treasurer-tax collector systems holding property and financial records
- Elections infrastructure with its own isolation requirements
- Dozens of departments with independent budgets and their own vendor relationships
Where HQT helps
- Scoping which systems fall under which regime, so controls are applied where required rather than everywhere at uniform cost
- Gap analysis and remediation for CJIS, HIPAA, and IRS Publication 1075 obligations, with the evidence packages auditors ask for
- Identity consolidation across departments, including access reviews that department heads can actually complete
- Segmentation between justice, health, business, and election networks
- Security monitoring design and incident response plans that account for public records obligations and state notification requirements
- Vendor security review for the many platforms a county buys
How an engagement usually starts
A county typically engages HQT for one department's compliance problem, then extends the work enterprise-wide once the scoping approach proves useful. We work with the county's information security officer rather than around them, and we write findings so that they can be shared with a department head without exposing technical detail that should be withheld from public release.