October is Cybersecurity Awareness Month

Every issue this month will focus on cybersecurity for state and local government.

October is Cybersecurity Awareness Month, and The Fractional Leader is going to spend the whole month featuring cybersecurity content written for the people who lead and run state and local government. Cybersecurity affects the whole community, and local government’s role in preparing for, responding to, and recovering from cyber incidents has never been more critical.

We start next Tuesday with the attacks on municipal water systems this summer and what they mean for cities, counties, and utilities everywhere. From there we will share what we learned running cyber tabletop exercises with a school district and a city, talk through how an agency prepares for, responds to, and recovers from an incident, and close the month with a practical look at how cooperative purchasing can help put a cybersecurity strategy in place.

If there is a question you would like us to take on along the way, simply contact us at [email protected].

BIG STORY

Maryland Brings Civic Tech Partners Into Medicaid Operations

Key Takeaways

  • Maryland has partnered with Code for America, Civilla, and Public Policy Lab to redesign Medicaid notices, applications, and caseworker workflows before new federal rules take effect in January 2027.

  • About 320,000 of the roughly 1.47 million people enrolled in Maryland Medicaid will be affected by the new rules.

  • The partners will map processes to find repetitive tasks that can be automated or simplified. Code for America warns that missed notices and unclear paperwork could cause eligible residents to lose coverage.

Maryland is bringing in external civic technology expertise to its Medicaid operations three months before new federal eligibility rules take effect. The Maryland Health Benefit Exchange, which administers the state's health insurance marketplace, Maryland Health Connection, announced a partnership with Code for America. It aims to streamline eligibility and enrollment for Medicaid members and the caseworkers who serve them as the state prepares for the requirements under H.R. 1.

Beginning in January, many adults covered through Medicaid expansion will have to document at least 80 hours a month of work, school, volunteering, or other qualifying activities to keep their coverage. States will also have to check eligibility twice a year. Residents will need to submit proof more often, while caseworkers will have to review it.

Maryland Medicaid covers about 1.5 million people, roughly one in five state residents, and supports more than 120,000 providers. About 320,000 members will be affected by the new rules and are at risk of losing coverage. The organization says tight deadlines, unclear federal guidance and outdated technology will make the changes harder to implement.

Under the partnership, Code for America will work with the exchange to upgrade technology and workflows, drawing on expertise from Maryland Medicaid. Two other civic technology non-profits are part of the effort. Civilla will support a redesign of the state's mobile application, and Public Policy Lab will work on the notices members receive so that required actions and deadlines are clear.

The project covers three areas. The first is mapping how caseworkers handle cases and designing tools with them that reduce manual steps. The second is rewriting confusing notices so members understand what they need to do and when. The third is simplifying the application so residents can access benefits more easily and caseworkers spend less time resolving preventable errors.

Rebecca Piazza, executive director of safety net strategy at Code for America, said that people who meet the work requirement could still lose coverage if they miss a notice or do not know they must report their hours. The partners will identify where residents and caseworkers run into problems, develop solutions with Maryland officials, and test them before expanding their use. Piazza said the goal is to prevent backlogs and delays, keep eligible people enrolled, and give caseworkers more time for cases that need their judgment.

The Congressional Budget Office estimates that millions of people could lose coverage because of reporting requirements and other administrative barriers. An April report from the Center on Budget and Policy Priorities warned that federal deadlines may outpace upgrades to state eligibility systems. Without more time and clear guidance, states may have to launch systems before they are fully ready.

Arizona and Minnesota plan to improve existing systems rather than add new tools. Others are expanding automatic renewals that use tax and wage data to confirm eligibility. Code for America has warned that adding new tools to aging systems can create more work for caseworkers and strain the technology.

Modernizing public services under tight deadlines takes more than new technology—it takes the right expertise to turn complex requirements into workable solutions. Fractional Source connects public agencies with experienced leaders who can streamline operations, improve citizen experiences, and help teams turn modernization initiatives into measurable progress. Book a quick call with the Fractional Source team.

QUICK HIT NEWS

  • Skylar Capital Opportunities has withdrawn its application for a 1,000-megawatt data center and natural gas plant on federal land near Henderson, Nevada. The company said it made the decision after consulting with the city and the Bureau of Land Management. The project would have cost between $1.5 billion and $2 billion, and NV Energy estimates that this amount of power could serve 700,000 to 1 million homes. The developer's separate Boulder City data center on federal land remains on hold while an appeal is processed.

  • Oregon Gov. Tina Kotek signed Executive Order No. 26-26, which requires state agencies to buy and use only those frontier AI models that have passed an independent third-party safety review. State CIO Terrence Woods has 90 days to deliver an implementation proposal. The proposal must set criteria for an adequate safety review and assess the viability of a kill switch.

  • FEMA awarded more than $47 million to fire departments and emergency response organizations in Delaware, Maryland, Pennsylvania, Virginia, and West Virginia. Nearly $40 million came through the Assistance to Firefighters Grants program for protective equipment, response vehicles, and responder wellness programs. More than $5 million went to staffing, recruitment, and retention, and $1.6 million funded fire prevention research and technology.

  • Chattanooga and the Hamilton County Water and Wastewater Treatment Authority warned residents not to use the sewer payment link on their websites after it began redirecting users to an unrelated adult site. City officials traced the problem to a lapsed DNS certificate held by ENCO Utility Services, the California vendor that runs the payment platform. The site was restored the next day.

FOR THE COMMUTE

Who's really responsible for AI regulation (Priorities Podcast)

Michael Pastor, New York Law School's Dean of Technology Law, examines who should hold authority over AI regulation as the technology advances faster than federal policy can keep up. He weighs the benefits and drawbacks of states setting their own rules in the absence of national oversight, and explains what the claim that regulation stifles innovation means in practice. Pastor compares the current moment to earlier turning points, such as the rise of the internet and social media, while noting the ways AI differs.

RESOURCES & EVENTS

How Cloud Is Reshaping 911 and the Future of Public Safety (Virtual - October 15, 2026)

This webinar explores how cloud platforms can move 911 data beyond the initial call to dispatchers, officers, firefighters, paramedics, and crime centers.

Hawaii Public Sector Cybersecurity Summit 2026 (Waikiki, HI - December 2, 2026)

Hawaii Public Sector Cybersecurity Summit 2026 takes place on December 2 at Prince Waikiki. The event brings together state and local government IT security leaders, risk managers, and public officials to examine the cyber threats facing public agencies.

Report Spotlight: Public Sector AI Adoption Outpaces Governance and Visibility (SolarWinds)

SolarWinds surveyed 810 public sector IT professionals in the U.S. and U.K. and found that 79% said AI governance was keeping pace with adoption, while only 37% reported having an actively enforced framework.

INSIGHT OF THE WEEK

States built offshore wind training programs for a projected surge in construction jobs, but new U.S. projects have stalled. About 6 gigawatts of offshore wind capacity is operating or under construction, and no new wind farm has broken ground since January 2025. Programs are now teaching skills that also apply to grid infrastructure, shipbuilding, and other energy work. New York’s $20 million Offshore Wind Training Institute, for example, has broadened its high-voltage training beyond wind projects.