Municipal Cyber Forward helps Georgia cities, counties and local authorities see where they stand, put owners and dates on the next steps, and be ready when something goes wrong. It is built with the IT leaders of GMIS Georgia.
Report to GEMA/HS by 11:12The federal report is filed. The same information is due to the state within two hours.
Patch
Firewall flaw on CISA's exploited listIt matches the edge device in your inventory. Owner: IT manager.
Council
Quarterly cyber brief is readyThe closed-session version is kept apart from the public packet.
Elections
Voter registration access reviewThree accounts inactive for 60+ days. Confirm or disable.
Illustration with a fictional government. No real data.
6
NIST CSF 2.0 functions
22
categories in the Municipal Cyber Rubric
2 hours
Georgia's state reporting clock, built in
0
criminal justice or voter records stored
About the program
One shared path for Georgia's local governments.
Municipal Cyber Forward is a cybersecurity improvement program for Georgia cities, counties and local authorities, offered through GMIS Georgia, the Georgia chapter of GMIS International for public-sector IT. Each government builds a baseline with the Municipal Cyber Rubric, built on the six functions of the NIST Cybersecurity Framework 2.0 with CISA's Cybersecurity Performance Goals and Georgia requirements included. It then turns gaps into owned, dated work, keeps its evidence in one place and reports progress in plain language to its manager and elected officials.
Supportive, not punitive: a government's results are never ranked publicly, and a score is where the conversation starts.
For the people who keep services running
Cyber risk reaches every department.
The 911 center, the clerk's office, utility billing, elections and payroll all depend on it. Bring the right people into one plan, and keep clear who owns each part.
IT leaders
CIOs · IT directors · one-person IT shops · managed service providers
Set the baseline once, see the gaps by function and department, and assign practical actions with dates. It works the same for a large county IT department and a small city with one IT manager and a managed service provider.
Guided baseline with CSF 2.0, CISA performance goal and CIS Controls references
Alerts when a flaw on CISA's exploited list matches your inventory
Domain, email and certificate checks for your .gov and .org names
Managers & elected officials
City and county managers · mayors · commissioners · council members
Get a short, plain-language picture of where the government stands, what comes next and what it needs from leadership: budget, policy decisions or time from department heads.
A council or commission brief, with a separate closed-session version
Owners and dates for every improvement, not just a score
Progress over time, so budget requests rest on evidence
Finance, clerks & HR
Finance directors · clerks · human resources · purchasing
Most incidents start with an account, a payment change or a vendor. Keep account changes, vendor agreements, payment-verification steps and insurance evidence with the people who own them.
Readiness evidence for insurance and risk-pool conversations
Vendor and data-sharing agreements with renewal reminders
A grant workspace for the State and Local Cybersecurity Grant Program
Departments that handle criminal justice information or run elections have their own rules and auditors. The program tracks readiness for those rules without ever holding the protected data.
CJIS Security Policy readiness for each agency
Elections readiness for access, training and account reviews
Department views, so each team sees its own scope
The Municipal Cyber Rubric
Six functions, in local government terms.
22 categories rated from Initial to Optimized. Each answer records why it was chosen, and each category lists the CISA performance goals, CIS safeguards and Georgia rules it touches.
01
Govern
Decide who owns cyber risk, which policies the council or commission adopts, and what vendors and managed service providers must do.
02
Identify
Know which systems keep services running, from dispatch and utility billing to permitting and payroll, and who answers for each.
03
Protect
Multi-factor sign-in, prompt removal of access, patching, backups attackers cannot reach and staff who spot a fake invoice.
04
Detect
Keep the logs that matter, know who watches them, and decide in advance when an alert becomes an incident.
05
Respond
Agree on roles, outside contacts and the Georgia reporting steps before an attack, so nobody looks them up during one.
06
Recover
Practice restoring the services residents notice first, record what worked and fix what did not.
Georgia requirements, built in
The rules that apply here, in one place.
National frameworks do not mention GEMA/HS, the Secretary of State's rules or Georgia's grant process. The program does.
HB 156 · O.C.G.A. § 38-3-22.2
The two-hour state report
When a qualifying cyber attack is reported to a federal agency, local governments must send the same information to GEMA/HS within two hours. The incident desk starts that clock and keeps the report confidential.
Open records · Open meetings
Closed-session briefings
Security plans and assessments should not end up in a public meeting packet. Council and commission briefs come in two versions: a public summary and a detailed version for closed session.
SLCGP · GEMA/HS and GTA
Grant readiness
The State and Local Cybersecurity Grant Program runs through GEMA/HS and the Georgia Technology Authority. The funding workspace links gaps to eligible projects and tracks the local cost share.
FBI CJIS · Secretary of State rules
Public safety and elections
Readiness checklists follow the FBI's CJIS Security Policy and the Secretary of State's rules for election systems. Each department's evidence stays separate.
A guided approach
From joining to practical progress.
Every government follows the same five steps at its own pace.
Join
GMIS Georgia confirms the government and its contact, then sets up named accounts with multi-factor sign-in.
Baseline
IT and department leads answer the guided questions together and record the reason for each answer.
Plan
Gaps become actions with owners and dates. Quick wins come first; larger projects are linked to funding.
Evidence
Policies, screenshots and exercise results are kept with the action they support, ready for insurers and auditors.
Report
Plain-language briefs for the manager and elected officials, and progress that shows over time.
How your information is handled
Readiness records only.
No protected dataThe portal never stores criminal justice information, voter records or residents' personal data. It records readiness and evidence about controls, not the data the controls protect.
Your records stay yoursResults are visible only to your named users and the program staff you allow. Nothing is shared with other governments unless you choose to.
Strong sign-in from day oneEvery account uses multi-factor authentication, and departments see only their own scope.
A separate systemThe program runs on its own servers and database, apart from any other program.
Built with the people who will use it
Help shape the first release.
GMIS Georgia is forming a review panel of local government IT leaders and a small group of pilot governments: large and small, cities and counties, with in-house IT or a managed service provider.
