In Tuesday’s issue, the link for Free Cybersecurity Assessments and Exercises for State and Local Governments went to the wrong page. Here’s the right one. Apologies.
Capabilities Behind Resilient Local Infrastructure
Utilities that maintained service during this summer’s cyberattacks had practical capabilities that also apply to municipal buildings, traffic systems, and power infrastructure. The first was knowing what equipment was connected. Plymouth, Minnesota, disconnected cellular equipment at its towers and lift stations to stop the attack. An equipment inventory lets operators identify exposed controllers and isolate them when necessary.
The second was the ability to operate manually. Braham restored its plant in about two hours, while Clayton County restored service within hours. These responses depended on staff who understood the equipment and had contingency procedures available. Written instructions and trained backup staff reduce dependence on one person being available.
The third was coordination established before an incident. Minnesota brought together state IT, public safety, public health, federal partners, and local utilities. Those relationships help agencies obtain support quickly, but the local response still depends on knowing who has authority to act and who will contact outside partners.
The fourth was sufficient capacity to sustain those preparations. In 2024, the EPA reported that more than 70% of the water systems it inspected were not fully meeting federal requirements for risk assessments and emergency response plans. Small systems often depend on a few employees with limited cybersecurity resources. Equipment inventories, documented manual procedures, response partnerships, and shared operational knowledge give those employees a stronger basis for maintaining service during an attack.
Free Cybersecurity Assessments and Exercises for State and Local Governments
Fractional Source and Sourcewell Ventures are expanding their cybersecurity pilot to state and local governments, offering free assessments and exercises to help agencies prepare for cyber incidents.
Big Story: AI Adoption Is Growing. Can Government Budgets Keep Up?
Key Takeaways
AI vendors are moving government customers from fixed annual pricing to token-based pricing, where cost depends on the volume of data the AI system processes.
Georgia, San Francisco, and Colorado are applying lessons from cloud consumption billing to manage AI spending.
Employee training is one of the simplest controls against unplanned token consumption.
Many AI software providers now charge government agencies by tokens, which are units of data processed by an AI system. Technology services have traditionally been sold at a flat fee, but token pricing ties cost directly to usage. For agencies working within fixed annual budgets, this can lead to costs of two to three times the original estimate.
Indiana's Office of the Secretary of State encountered the shift firsthand. A vendor first sold the office an AI solution with fixed annual pricing, then moved it to token pricing at renewal. CIO Robert Fulk said a doubling of costs would put the office over budget. Fulk could estimate future costs because the office had a record of past AI consumption. Agencies that adopted AI later lack that history. Fulk said closing the gap will require vendor transparency on how tokens are calculated, and that vendors should show token costs for similar deployments at other agencies as a reference point.
State agencies have experience monitoring cloud consumption and are applying that knowledge to AI. Georgia also partnered with Darwin AI to improve visibility into usage. Each agency will have AI champions overseeing use, and the Georgia Technology Authority will monitor use across the state.
Nikhil Deshpande, Georgia's chief digital and AI officer, said the state uses personas to understand how different roles use AI and to inform future budgets. The focus has moved from the cost of a single application to the full cost of achieving a successful business outcome. San Francisco has managed usage-based pricing for years through its cloud program. The city begins with demand projections and then works with vendors, emphasizing transparency.
Jane Yang, Colorado’s principal director of AI architecture, said AI costs are more volatile because new models launch frequently and may consume tokens at different rates. CIO Sarah Tuneberg noted that cloud spending involves a small group of people, while a large share of employees use AI tools. Colorado uses a role-based distribution, so staff can access approved tools when they need them and within budget limits.
The pricing shift also affects how governments classify AI spending. State and local governments are accustomed to capital expenditures, while cloud and AI align more closely with operating expenses. Contract renewals now require close review for potential cost increases, including in tools with embedded AI features. John Matelski, CIO of the National Association of Counties, said the vendor that solves predictability is likely to win government trust.
He identified employee training as an effective way to prevent excessive token consumption. San Francisco has delivered responsible AI training through its learning management system and is now examining which models fit which tasks, how usage needs differ by role, and which FinOps and governance tools can help. Georgia includes role-based training in its AI literacy program, and Colorado is building practical judgment among employees through training and hands-on experimentation. Jane Gong, San Francisco's director of emerging technologies, said governments should first build a foundation with guardrails, then test, and then make budgeting decisions based on what that testing shows.
QUICK HIT NEWS
Illinois is the first Great Lakes state to pass a law targeting plastic pellet pollution. Governor JB Pritzker signed the law on August 7, and it takes effect January 1, 2027. Facilities that apply for or renew federal pollution discharge permits must include stormwater pollution prevention plans that identify where pellets can escape and set control measures. About 22 million pounds of plastic enter the Great Lakes each year from the U.S. and Canada, and seven of the eight Great Lakes states have at least one pellet facility.
Amazon's plan for drone delivery from its North Haven, Connecticut, warehouse drew more than 500 comments during a short state review period. The proposal calls for up to 1,000 daily flights over 16.5 hours a day, every day of the year, with an initial fleet of 10 to 12 electric drones carrying packages weighing 5 pounds or less within a 7.5-mile radius. The local planning commission approved the application in May, but several officials said they learned of its full scope late.
Nvidia has paused its AI Ambassador program before training any new ambassadors in Oregon under an April 2025 agreement with the state. The program was intended to help faculty bring AI instruction into schools and colleges, but $1.5 million reserved for faculty participation remains unspent. Nvidia confirmed the pause without explaining why or providing a restart date. Separately, Oregon has awarded about $8.5 million to universities, community colleges and a nonprofit for semiconductor education and workforce training.
Catawba County, North Carolina, sent 128,000 notification letters after a September 2025 ransomware attack that exposed names, birth dates, Social Security numbers, financial account details, and medical and health insurance information. Attackers had access from September 12 to 19, 2025. The county paid no ransom, as state law bars local governments from paying or communicating with attackers. Cyber insurance covered all costs except a $50,000 deductible, and the county reports no evidence of data misuse.
New York, Oklahoma, and Texas are running public programs for Cybersecurity Awareness Month. New York's Office of Information Technology Services is holding a poster contest open to students from second grade through high school, with a December 18 deadline. Oklahoma's Information Sharing and Analysis Center published a checklist with one security action for each day of October. Texas Cyber Command is offering seven public webinars and two in-person events organized around weekly themes.
FOR THE COMMUTE
Proposed Census Changes with Doreen Garlid (CitiesSpeak Podcast)
Clarence Anthony speaks with Doreen Garlid, a Tempe, Arizona councilmember and Second Vice President of the National League of Cities, about proposed rules that would change who is counted in the 2030 census and where and how they are counted. Garlid says the changes are expected to undercount city residents. She explains that a lower count would weaken cities' political representation and reduce state and federal funding tied to population figures.
RESOURCES & EVENTS
We’re heading to ICMA 2026
State and local leaders are being asked to do more with less, modernize aging systems, navigate workforce challenges, manage emerging technology and still deliver for their communities.
Those are exactly the conversations we want to have.
Fractional Source connects public-sector organizations with experienced leaders who can step in when you need specialized expertise, additional capacity or a fresh perspective, without adding another full-time position.
If you’ll be at ICMA, come find us at Booth 1352. We’d love to hear what your organization is working through.
📊 Report Spotlight: Frontline Network Slice Solution Brief (Verizon)
This brief describes Verizon Frontline Network Slice, a 5G service that reserves dedicated network resources for first responders so their traffic stays separate from public use during congestion. The service gives public safety communications priority and preemption, applies quality of service scheduling with low latency, and adjusts resources as field conditions change. It supports smartphones, tablets, and laptops for evidence sharing, voice calls, live video, drone feeds, patient data transmission, and field applications.
INSIGHT OF THE WEEK
Some large private employers are adopting cash balance pensions alongside existing 401(k) plans, offering a model public employers could also consider. These plans pool investments while crediting individual employee accounts with a guaranteed minimum return and potential additional gains. They can cover new hires or supplement existing retirement benefits, with an option for lifetime income at retirement. The financial tradeoff depends on the guarantee. A conservative minimum return can limit employer risk while giving workers protection against market losses.
