The Public Entity Checklists for Managing Your Cyber Risk

A woman wearing glasses is writing in a notebook while looking at a laptop in a bright, modern workspace.

March 3, 2026 | Alex Terlecky

Government entities like special districts are among the top three industries targeted by cybercriminals, in addition to the manufacturing and technology sectors. What sets special districts apart from private sector counterparts is they are constrained by budgets and staffing limitations. Although this creates challenges when developing a comprehensive risk management program, it does not make managing cybersecurity impossible.  

Although the cyber risk landscape is constantly evolving with new tactics, tools, and threats, the ways to address the issues have remained generally stable.  

To help public entities understand how they can prepare their organizations for—and defend themselves from—a cyberattack, we’ve put together a few checklists of best practices, resources, and informational materials to help ensure you and your staff are ready for the worst. 

Cybersecurity for Employees 

When it comes to cybersecurity, your best defenses are your employees. When looking at the top causes of loss for small- and medium-sized enterprises, ransomware—malware that prevents you from accessing your IT systems until a ransom is paid—is far and away the leader in total number of claims and total losses, according to NetDiligence’s 2025 Cyber Claims Study.  

From a dataset of over 8,000 claims, this category accounted for $1.6B in total incident costs incurred and made up 69% of all cyber-related claims across the top five causes, followed by business email compromise ($182M, 8%), hacker ($161M, 7%), theft of money ($32M, 1.4%), and wire transfer fraud ($46M, 2%). 

According to the Cybersecurity & Infrastructure Security Agency (CISA), these are the four easiest ways to stay safe online and prevent a ransomware attack. Which of the following steps have you taken with your organization and staff? 

  • Provide phishing and ransomware training  
  • Use strong passwords and a password manager 
  • Turn on multi-factor authentication on all accounts 
  • Complete all software updates 

Knowing what to do is one thing, but finding the correct tools, trainings, and resources to help can be a whole different challenge. Here are the top resources to share with your staff: 

*Note: To access the eRisk Hub links above, visit csdpool.org/erisk-hub for free  enrollment.) 

According to a 2020 study by Stanford University and security firm Tessian, 88% of data breaches are caused by mistakes made by employees, and that employees were more likely to make mistakes when stressed, tired, or distracted. This means that if there is one place to shore up your cyber defenses, it’s through employee training, education, and frequent discussion.  

Resources for Management and Board of Directors 

As managers and board members, the responsibility of protecting your district’s assets falls on your shoulders. This means it’s up to you to understand your network vulnerabilities, how your data is stored and accessed, and what your response will be if you fall victim to a cyberattack. 

Whether you’re having a discussion on cybersecurity at a board meeting, working with your IT department, or putting together a business continuity plan, here are a few resources to make sure you review or include: 

*Note: To access the eRisk Hub links above, visit csdpool.org/erisk-hub for free  enrollment.) 

When in the midst of a cyberattack, it can be a stressful and chaotic time. Bookmarking these resources and preparing a breach plan can make the difference between mitigating your risk and making a major business mistake when your organization’s data and finances are on the line. 

Insurance Coverage and Appropriate Limits  

The final piece to cyber risk preparedness is to make sure your organization has the appropriate coverage in place. In case a cybercriminal breaches your employees’ defenses or outmaneuvers your network security, maintaining high enough limits for your organizational size and understanding when coverage kicks in, can take your finger off the panic button when the inevitable happens. 

These are the major components of an effective cyber insurance policy. How many do you have covered? 

  • Coverage limits of $500,000 to $1 million 
  • Reimbursement for data compromise expenses  
  • Reimbursement if a cybercriminal publishes personally identifiable information (PII) or transmits a malicious code  
  • Reimbursement to recreate or restore electronic data or damaged systems 
  • Reimbursement for ransom payments incurred as a result of a cyber extortion threat 
  • Reimbursement for any loss of business income 
  • Reimbursement for the services of a public relations consulting firm 

While a sublimit of $500,000 might seem high, according to NetDiligence’s Cyber Claims Study, the average incident cost of a ransomware claim is $631,000. For small- and medium-sized enterprises, 395 claims in their study were more than $1 million. 

Beyond that, areas for reimbursement vary from policy to policy. If you are unsure what your policy covers, be sure to reach out to your agent or underwriter.  

If you are a CSD Pool Member, your policy covers all the items listed above, except for the coverage limit. CSD Pool Members have $200,000 in limits, but this number can be increased through the completion of a cyber assessment for no cost. If you would like to talk to an underwriter about your coverage, send us a message at csdpool.org/connect. 

Next Steps 

Now that you are armed with the few tools to get started, you can begin refining your organization’s cybersecurity. Regardless of if you are a small operation with few employees and no IT staff, or a large business with a team who lives and breathes cyber, there are measurable steps to take.  

Whether you start with a simple email outlining best practices, add a line item to the next board meeting agenda on cybersecurity, or roll up your sleeves and commission a network cyber assessment, any step is a step in the right direction.