“IT Handles Our Cybersecurity.” Does That Coverage Meet Your 9-1-1 Center’s Needs?

At OTM Cyber, when we ask organizations what they do for cybersecurity, we often hear, “IT handles our cybersecurity.” That answer can be reassuring, but it leaves important questions unanswered. Do leaders understand what that coverage includes? Does it meet the needs of your 9-1-1 center? Taking time to confirm the answers helps leadership and IT build a shared understanding of how cybersecurity supports the center’s mission.

IT may manage valuable safeguards, including firewalls, security software on computers, and employee training. Still, a list of tools does not explain what happens when something suspicious occurs at 2:00 a.m. on a holiday.

Leaders need a clear picture of how security concerns are detected, evaluated, and addressed before an incident puts operations under pressure. A 9-1-1 center relies on technology to carry out its mission around the clock, so the people responsible for that mission need a shared understanding of the plan.

Cybersecurity often involves separate tools and providers. A firewall may block unwanted traffic. Security software may identify suspicious activity on a device. A vendor may protect an application, while IT manages the network around it. Each part can be useful. The important question is how the parts work together when something needs attention.

A productive conversation with IT starts by defining the current approach. Ask what systems and services are covered, what each safeguard is designed to do, and where responsibility begins and ends. These questions help leadership understand the current situation. They also give IT a chance to explain how systems depend on one another and what resources support them.

Coverage also needs to account for the hours when the center is serving the public. A 9-1-1 center does not stop answering calls at the end of the workday. Leaders should understand how cybersecurity coverage works at night, on weekends, and on holidays.

The arrangement will differ from one organization to another. A center may rely on internal staff, outside providers, or both. Whatever the model, leadership should be able to follow what happens after an alert. Is monitoring active at all hours? If a security tool generates an alert overnight, who receives it? Who determines whether action is needed? If that action could affect operations, how are IT and leadership contacted?

Automated monitoring and human response are related parts of that process. A tool can detect suspicious activity and generate an alert, but leaders still need to understand how the findings reach someone responsible for investigating and acting. Having monitoring in place does not, by itself, explain who handles the next step.

An alert does not always mean an active cyberattack, and every alert does not need a separate manual investigation. Automated analysis can help evaluate activity, while related alerts may become part of a broader investigation. The process should distinguish harmless activity from a threat and lead to a decision about what needs to happen.

The resulting action can vary. An investigation might show that no change is needed. It might identify a security setting that needs attention or a service that should no longer be exposed to the internet. An active compromise could require isolating a device or part of the network. The appropriate response depends on what happened and which systems may be affected.

Security response decisions can have operational consequences for a 9-1-1 center. A change that improves security can still disrupt a service if the environment is not fully understood. Leaders do not need to prescribe technical responses. They do need to know who investigates, who recommends a course of action, who can authorize it, and who carries it out.

These responsibilities may be divided among IT, leadership, internal security staff, and outside providers. IT may have the access needed to make changes. A cybersecurity provider may investigate alerts and recommend action. A technology vendor may support a specific system. Leadership may need to weigh in when a response could affect the center’s mission. The exact division should be clear before those people need to work together under pressure.

A vendor’s role should never be assumed. Providing a product or service does not automatically mean the vendor will handle incident response. Leaders and IT should review what each vendor agreed to do, confirm duties directly, and record the answer in writing. Everyone should understand who to call, what help to expect, and who can authorize the work.

An incident response plan makes those responsibilities usable during a difficult situation. It should identify the people involved, their roles, and how a decision moves from investigation to action. It should include primary and alternate contacts, along with ways to communicate if normal channels are unavailable.

A cybersecurity policy establishes the organization’s broader expectations for protecting its systems and information. Together, the policy and the incident response plan help turn an informal understanding into a documented approach. If the center identifies a gap, the written record should include a practical plan to address it.

The conversation with IT should begin with the shared mission. Leadership can explain that it wants to better understand cyber risk and how current protections support operations. Ask IT to walk through the current approach, including coverage hours, provider roles, and how concerns reach the people who need to act.

This gives IT room to explain resource needs and areas where additional support may help. Before the meeting ends, agree on the next step. That may mean clarifying vendor commitments, documenting responsibilities, or updating the incident response plan.

An incident is a difficult time to discover that people have different expectations about who will respond. Establishing those responsibilities in advance gives leadership and IT a clearer basis for making decisions together.

OTM Cyber can help you prepare for that conversation with your IT department. A readiness discussion is a starting point for reviewing your current coverage, after-hours response, and decision-making responsibilities. Together, we can identify the questions to bring to IT and what needs clarification next.

Schedule a readiness discussion with OTM Cyber.