Trump order put states at the forefront of cyber and natural disaster response

President Donald Trump earlier this week signed an executive order that puts the onus on state and local governments to prepare for natural disasters and cyberattacks, as part of his wider push to overhaul the Federal Emergency Management Agency.

The order calls on states and localities to make “common sense approaches and investments” in infrastructure and planning to help prepare for cyberattacks, wildfires, hurricanes and other disasters that they deal with. The order does not specify what those commonsense approaches are or how to fund them.

“Federal policy must rightly recognize that preparedness is most effectively owned and managed at the state, local, and even individual levels, supported by a competent, accessible, and efficient federal government,” the order says. “Citizens are the immediate beneficiaries of sound local decisions and investments designed to address risks, including cyberattacks, wildfires, hurricanes, and space weather.”

The order mandates that, within 90 days, federal agencies publish a National Resilience Strategy, which lays out how to advance national capacity to withstand such risks. It also calls for a review of national critical infrastructure policy within 180 days to recommend ways to “achieve a more resilient posture; shift from an all-hazards approach to a risk-informed approach; move beyond information sharing to action,” the order says.

A fact sheet accompanying Trump’s order said it will help state and local governments plan for and understand the needs of their residents as it reduces the complexity of federal preparedness and response policies.

“This order empowers State, local, and individual preparedness and injects common sense into infrastructure prioritization and strategic investments through risk-informed decisions that make our infrastructure, communities, and economy resilient to global and dynamic threats and hazards,” the order says.

The order comes on the heels of the Department of Homeland Security slashing federal funding for two information-sharing centers, including one focused on cybersecurity. Putting more onus on states and localities to prepare for cyberattacks and other resiliency efforts will likely mean more financial burden, especially if the federal government steps back.

“No matter what, most of the direction that we're looking at is going to cost additional county dollars from their budgets, which they may not even have budgeted right now,” Rita Reynolds, chief information officer at the National Association of Counties, said in a previous interview. “It also could have an impact on the projects that they have in place or that they were putting in place to improve their cyber defenses and continue to retain cyber insurance.”

Having local governments play an even bigger role in preparing for and responding to cyberattacks could benefit them, Boston Chief Information Security Officer Greg McCarthy said during a recent panel discussion.

“When there's a cyber disruption, local government is where the hugest impact actually is on the residents,” McCarthy said during the Billington State and Local Cybersecurity Summit earlier this month in Washington, D.C. “Local government is not always brought to the table during the decision making processes by the federal or state governments. There's an opportunity here to potentially have a better voice for the local governments that are impacted by a lot of decisions at the federal and state level and build those better relationships with our partners.”