Homegrown cyber resources: Washington-specific ways to bolster your government’s cybersecurity

The cybersecurity mantra of “know what you have” means you must have a comprehensive inventory of assets before you’re able to protect them. The same saying could apply to cybersecurity resources in Washington—local governments need to know what’s available before they can use these free or low-cost services. In this article, the State Auditor’s Office has created a brief overview of some Washington-specific cyber services, including services from our own Office.

Resources for reviewing your current cybersecurity posture:

• The Municipal Research and Services Center (MRSC) – A nonprofit that helps Washington’s local governments better serve their communities. Part of that aid comes in the form of technology resources, ranging from guides about records managements, AI policymaking and cybersecurity resources.
• SAO’s cyber audits – An in-depth customized audit of your cybersecurity program. Our Office began offering cybersecurity audits in 2013. Since then, we’ve worked with over 150 local governments. The audit waitlist is long, so if you’re a Washington government seeking a cybersecurity audit, be sure to sign up promptly and plan accordingly.
• SAO’s cyber checkups – Waiting for a cybersecurity audit? Cyber checkups are a high-level overview of your current cybersecurity program. While cybersecurity audits may take six months to a year to complete, SAO’s cyber checkups can be completed between 4-6 weeks. To date, our Office has completed over 100 cyber checkups.
• Washington’s Technology Services (WaTech) guidance and resources – WaTech manages all things IT for state government. Additionally, WaTech has many resources related to privacy and data management. The agency also has a robust catalog of past presentations on topics like de-identifying personal information within datasets and AI use in government work.

Tools for preparing for and responding to an incident:

• Washington Military – Housed within the Washington Military is the Washington Emergency Management Division. The division runs a cybersecurity program aimed at safeguarding public services by ensuring strong cybersecurity measures are integrated into statewide infrastructure and emergency efforts. The division also operates the state’s Cyber Incident Response Team (CIRT) by preregistering cybersecurity volunteers who assist local governments as they plan and respond to cyber incidents.
• SAO incident response workshop – The State Auditor’s Office offers free, half-day incident response workshops to help local governments create an incident response plan tailored to their unique needs. During the workshop, participants learn how to make decisions before an incident occurs, assign roles in advance so they can be learned and rehearsed and walk through example scenarios.
• Pisces International – Pisces, in collaboration with Western Washington University, trains future entry-level cyber analysts to meet the cyber needs of municipalities and local governments. Through Pisces, students are trained to process data from partnering organizations. The students monitor and analyze the data to detect anomalies that could signal malicious activity.
• Other risk assessment tools – Organizations like the risk-sharing pool Enduris have resources to help members evaluate their cyber vulnerabilities and think about how to mitigate their risks. Consider the memberships of your local government and whether the groups you belong to offer similar tools or resources.

By now, you may have noticed that many state governments and organizations play a role in protecting Washington’s cybersecurity. This approach is common throughout the country, but it’s not the only option. The State Auditor’s Office plans to publish a performance audit in winter 2027 about the merits and drawbacks of a “whole of state cyber” model, or what a more centralized approach to Washington’s cybersecurity might look like. Read more about the audit here (PDF).