Government

Build the security plan around service delivery: emergency communications, benefits, permitting, courts, public records, and payment processing. Identify which services require immediate continuity and which can operate temporarily through approved manual procedures. Include dependencies on shared identity platforms, telecommunications, and outsourced applications.

Ask department leaders to define acceptable disruption and recovery priorities. The Infosec Lead can help organize findings and recommendations into a shared work queue. Agency officials must approve consequential actions, especially where containment could interrupt emergency operations, statutory duties, or access to public services.

• Maintain an offline contact list for department and supplier escalation.
• Exercise a service outage that also affects the agency's usual communications channel.

Review remote-support tools, privileged accounts, contractor identities, and integrations between departments. A supplier should not receive broad standing access simply because its service is essential. Require individual accounts, strong authentication, session records where appropriate, and a practical way to revoke access quickly.

Use Librarian to organize assets and ownership, and begin Relay connections with narrowly scoped permissions. Treat external credential alerts from Argus as investigation leads rather than automatic proof of compromise. For legacy applications, document compensating controls and the accountable owner instead of accepting an indefinite exception.

• Separate administrative identities from everyday email accounts.
• Reassess access when contracts end or employees move between departments.

Map obligations to the agency, system, information type, and contract involved. Federal cloud authorization, criminal justice requirements, state privacy duties, and local records rules are not interchangeable. Do not describe a deployment as authorized or certified without confirming the specific service and authorization boundary.

Judge can support evidence organization, while Growler and Dewey can assist with investigation records and recovery planning. Counsel, records officers, security leadership, and authorized officials retain responsibility for disclosure, preservation, procurement representations, and external reporting. Track lessons from exercises through funded remediation rather than closing them with a policy update alone.

• Test restoration of a high-priority resident service.
• Retain approvals and exceptions with named owners and review dates.