Website Security for Cities, Counties and Special Districts: A Practical Guide

A city, county or special district can secure its website with a short list of steps: know every site and system you run (including the ones vendors host), keep the server software patched, require two-factor sign-in, keep tested backups, and put security terms in every vendor contract. Then use the help that is free to you. As of October 2026, CISA's Cyber Hygiene scanning, including web application scanning, costs nothing for state, local, tribal and territorial (SLTT) governments, and .gov domains are free.

Some support has changed. The MS-ISAC has charged membership fees since October 2025, after federal funding ended. The State and Local Cybersecurity Grant Program's original four-year funding ended with FY2025, and its status after that should be checked with your state. Accessibility deadlines under the ADA Title II web rule now fall in April 2027 and April 2028.

This guide is for IT staff, clerks, communications teams and managers in small and mid-size local governments, special districts and school districts. If you are dealing with the PHP2Shell flaws right now, start with our PHP2Shell guide for local governments, which covers the agency advisories, taking sites offline and emergency purchasing.

Why Government Websites Are Different

A local government site is not just marketing. Residents pay bills, apply for permits, read meeting notices and get emergency updates there. That brings a few specific pressures:

• Trust. A defaced or redirected government site does damage beyond the site itself, because people rely on it for official information.
• Vendors run much of it. Payment portals, agenda systems, permit software and the website itself are often hosted by different companies. You are still accountable to residents for all of them.
• Small teams. Many towns and districts have one IT person or none, and a communications staffer who edits the site.
• Procurement. Changes go through purchasing rules, board approvals and budget cycles.
• Accessibility law. Security work and accessibility work often touch the same templates and vendors.

Our shared responsibility model guide explains how to split duties between you, your host and your platform vendors.

Free Federal Help From CISA

CISA says it "partners with SLTT governments across the nation" (CISA SLTT page). For website security, three services matter most.

Cyber Hygiene scanning

CISA Cyber Hygiene services "are available at no cost" to federal, state, local, tribal and territorial governments and to critical infrastructure organizations. Two services fit websites:

• Vulnerability Scanning monitors internet-facing assets on public, static IPv4 addresses, with weekly reports and ad-hoc alerts for urgent findings such as known exploited vulnerabilities.
• Web Application Scanning looks at publicly accessible web applications, including the vulnerabilities in the OWASP Top Ten, with monthly reports.

CISA says services typically begin within three business days of sign-up, with reports expected within two weeks of the scanning start date. To enroll, email vulnerability@cisa.dhs.gov with the subject line "Requesting Cyber Hygiene Services." CISA also has Cybersecurity Advisors working out of its 10 regional offices.

A free .gov domain

CISA runs the .gov registry, and get.gov says .gov domains are free. Eligible organizations include counties, cities, towns, townships and villages, special districts ("an independent government that delivers specialized, essential services") and school districts that are not part of a local government. A request must be authorized by someone with significant executive responsibility, such as a mayor, city manager, executive director or senior technology officer. A .gov address helps residents tell your site from a fake one.

Incident reporting

CISA asks organizations to report "anomalous cyber activity and/or cyber incidents 24/7." Use report@cisa.gov, 1-844-Say-CISA or the online form at cisa.gov/report. Cybercrime can also be reported to the FBI's Internet Crime Complaint Center (IC3). Mandatory federal reporting under CIRCIA will not be required until CISA's final rule takes effect, and as of October 2026 there is no final rule. Your state may have its own reporting rules. Our incident response retainer guide covers who to call first.

MS-ISAC and CIS: What Is Still Free

For years the MS-ISAC (Multi-State Information Sharing and Analysis Center) was free to local governments through a federal cooperative agreement. That ended. According to the MS-ISAC membership FAQ, the Department of Homeland Security decided "to end federal support for the SLTT community through the MS-ISAC beyond Sept. 30, 2025," and organizations without a paid membership began losing access after 1 October 2025.

• Pricing is tiered by budget. A CIS post from mid-2025 said Tier 1 membership tops out at $1,495 a year for organizations with operating budgets under $25 million, and that Tier 1 organizations can request a hardship waiver for a free first year. Prices may have changed, so confirm with CIS.
• Still free: "Access to CIS Benchmarks are provided to the global community including U.S. SLTTs at no cost," and "The no-cost CIS SecureSuite Membership that CIS provides to SLTTs will continue independently of MS-ISAC membership."
• Public advisories continue. MS-ISAC still published a free public advisory on PHP2Shell (advisory 2026-119), rating the risk HIGH for large and medium governments and MEDIUM for small governments.

Paying for It: SLCGP Status as of October 2026

The State and Local Cybersecurity Grant Program was created under the Infrastructure Investment and Jobs Act of 2021 and, in CISA's words, "allocates $1 billion over four years." The FY2025 funding notice (DHS-25-GPD-137-00-99, about $91.75 million) states: "FY 2025 is the final year of funding" (Grants.gov listing). It opened on 1 August 2025 and closed on 15 August 2025.

What happened next is not settled. The county association NACo reported that the program's 30 September 2025 expiration was extended to 30 January 2026 by a continuing resolution. A reauthorization bill (H.R. 5078) passed the House in November 2025 and, as of October 2026, sits in a Senate committee. No FY2026 SLCGP opportunity appears on Grants.gov. Don't assume the program has ended, and don't assume new money is coming. Ask your State Administrative Agency for current SLCGP status.

One useful clarification: according to CIS, a FEMA information bulletin issued on 16 June 2026 says SLCGP recipients can use grant funds to buy CIS services purchased individually under federal procurement standards, but not membership fees that bundle services.

Buying Cloud and Web Services: GovRAMP, TX-RAMP and Secure by Demand

When a vendor hosts your website, payment portal or records system, you are buying its security too.

• GovRAMP (formerly StateRAMP). stateramp.org now redirects to GovRAMP, which describes itself as "a nonprofit community providing a clear, risk-based pathway for governments and providers to verify, adopt, and maintain secure cloud solutions." Its framework is built on NIST controls. GovRAMP's news page lists Georgia adopting it as a statewide framework for cloud service security on 9 September 2026. Check whether your state requires or recognizes it.
• TX-RAMP. In Texas, the Department of Information Resources says TX-RAMP provides "a standardized approach for security assessment, certification, and continuous monitoring of cloud computing services that process the data of Texas state agencies."
• CISA Secure by Demand. CISA's Secure by Demand guide gives buyers questions to ask before, during and after procurement. Useful ones for a web vendor: Does it publish a vulnerability disclosure policy? Are logging and single sign-on included in the base product? "How does the manufacturer make it simple for customers to install security patches?"

Our vendor security review guide turns these into a short questionnaire.

Questions to Ask Your Website Vendor or Host

Make sure staff accounts are covered too. Our access control and 2FA guide explains why logins matter more than most technical flaws.

School Districts: CISA's K-12 Advice and the FCC Cybersecurity Pilot

CISA's January 2023 report "Protecting Our Future: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats" recommends that schools "Deploy multifactor authentication," "Mitigate known exploited vulnerabilities," "Implement and test backups," "Regularly exercise an incident response plan" and "Implement a strong cybersecurity training program." It also tells schools to expect technology providers "to enable strong security controls by default for no additional charge." That applies to website and app vendors too.

The FCC's Schools and Libraries Cybersecurity Pilot Program is a three-year pilot that "provides up to $200 million in universal service support," according to USAC. Participants were selected on 16 January 2025, and the FCC Form 471 window ran from 18 March to 15 September 2025. A Federal Register notice in August 2026 shows participants still filing annual reports. Confirm any recent changes to the pilot with USAC or the FCC.

ADA Title II: Plan Security and Accessibility Together

The Justice Department's web rule makes WCAG 2.1 Level AA "the technical standard for state and local governments' web content and mobile apps." After an interim final rule published on 20 April 2026, the compliance dates are 26 April 2027 for entities with a total population of 50,000 or more, and 26 April 2028 for those under 50,000 and for any special district government (ADA.gov fact sheet). The rule covers pages a vendor builds and updates for you.

If a security review shows your site needs new templates, a new host or a new CMS, do the accessibility work in the same project. Our ADA Title II guide explains the rule, and our secure rebuild planning guide helps you decide whether to patch, harden or rebuild.

A Starting Checklist for Small Jurisdictions

1. List every public website and web app, who hosts it and who can log in.
2. Enroll in CISA Cyber Hygiene scanning.
3. Move to a .gov domain if you don't have one.
4. Require two-factor sign-in for every admin and vendor account, and remove old ones.
5. Get written confirmation from each vendor of the server software versions they run and their patch timelines.
6. Test a backup restore.
7. Write down who to call in an incident, including CISA's 24/7 line.
8. Schedule a security assessment before your next budget cycle, and fold in accessibility.

Conclusion

Local governments don't need a large security budget to make real progress. Use what is free (CISA scanning, .gov domains, CIS Benchmarks), check the funding that has changed (MS-ISAC fees, SLCGP status), write security and accessibility terms into vendor contracts, and plan around the ADA Title II dates. For help with assessments, vendor reviews and rebuild planning built for public bodies, see our government website security services. More in our website security consulting guides.

Frequently Asked Questions