How a School District Tested Cyber Response Decisions
A suburban school district serving more than 11,000 students used a cybersecurity tabletop exercise to test how its leaders would respond to an incident. The district already conducted audits and technical assessments, but hadn’t tested whether its leadership could make coordinated decisions under pressure.
The exercise brought together the superintendent, technology leadership, communications staff, and municipal emergency management partners. Scenarios reflected the district’s capability assessment and local risks, giving participants concrete situations in which to decide whether to shut down systems, interrupt instruction, or involve outside agencies.
Those discussions exposed assumptions about decision authority and communication. Participants examined when families and staff should receive updates, how often messages should go out, and who needed to approve them. Municipal involvement also showed how district decisions could affect the wider community and require coordination beyond school leadership.
After reviewing the findings, leaders identified governance and communication as priorities. Planned follow-up includes clearer escalation paths, stronger communication templates, and cabinet-level discussions about response authority. The district also wants annual tabletop exercises with different scenarios and participants, allowing it to test whether those changes improve coordination before a real incident forces public decisions.
Free Cybersecurity Assessments and Exercises for State and Local Governments
Fractional Source and Sourcewell Ventures are expanding their cybersecurity pilot to state and local governments, offering free assessments and exercises to help agencies prepare for cyber incidents.
Big Story: When Death Records Identify the Wrong Person
Key Takeaways
The Social Security Administration recorded 12,504 living people as deceased in 2025, out of roughly 5.6 million death records posted that year.
Death records begin at state vital records offices and move through federal systems to more than two dozen downstream agencies, so a state's matching decision carries into every connected system.
One state rebuilt its death registration matching to weigh nine attributes on each report and cut processing time for its toughest cases by 42%, from 34.7 days to 20 days.
National modernization goals for vital records cover data exchange standards, digital certificates, and secure sharing, but none set requirements for how states build matching logic.
Anthony Morales, a Houston resident, lost his Social Security payments after the Social Security Administration (SSA) mistakenly recorded him as dead. On his fourth visit to his local office, staff asked him to write the words "I'm still alive" on paper. At the time, he was two months behind on rent and groceries and could not afford repairs to his wheelchair.
His case is one of thousands identified in a July 2026 audit by the SSA Office of the Inspector General. The agency posted about 5.6 million death records to its Death Master File in 2025 and later found that 12,504 of them, or 0.22%, were wrong. The audit also found that employees did not always document why they removed incorrect death entries, and it recommended that SSA clarify its policies on recording those corrections. The error rate is low, but the effect on each person is significant because banks, insurers, and public agencies rely on SSA death data to confirm identity and legal status.
Aging federal technology is one contributing factor. A Government Accountability
Office review of federal legacy IT found systems still running on decades-old programming languages with known security gaps that remain unpatched. The article identifies a second, less-discussed factor: the matching logic that decides whether an incoming death report belongs to an existing person.
State vital records agencies send death records to federal systems, where each record is filed once and then distributed to more than two dozen downstream agencies, including Social Security, Medicaid, voter registration and the courts. Federal systems accept the state's data and pass it along.
Many state agencies rely on exact match logic, which performs poorly in common situations. A woman whose legal name changed through marriage or divorce may appear under different names at her bank, her insurer, the SSA, and on her death certificate. A system that matches on name alone will miss one or more of those links. The result can be a deceased person remaining active in a registry, or a living person receiving a condolence letter.
One state has spent the past two years rebuilding its death registration matching system. The earlier system compared only name and date. The new system weighs nine attributes on each incoming report, including Social Security number, county of death, gender, and record ownership status. Ownership carries the most weight because a death certificate is a legal document, and an incorrect match can create legal consequences for a living person. The design targets cases most likely to produce false matches, including legal name changes and unclear cause-of-death reports. Registrars still review uncertain cases by hand, and the system now directs them to the most likely correct match.
The state's death registration system connects to 26 downstream agencies, and a change in one connection can disrupt processes in others. The logic linking those agencies had never been fully documented, so the team reverse-engineered years of field mappings before rewriting them. The project also produced the state's first consolidated business requirements and architecture documentation for the death registration system.
After the new system went live, average processing time for the state's toughest cases fell 42%, from 34.7 days to 20 days.
States are preparing to invest in vital records modernization. In 2015, North Carolina authorized roughly $2 million to build its electronic death registration system. The National Association for Public Health Statistics and Information Systems lists three modernization goals for state vital records offices: adopting the Fast Healthcare Interoperability Resources (FHIR) data standard, moving to digital certificate issuance, and expanding secure data sharing across jurisdictions. The association notes that progress depends on consistent leadership and stable funding. The National Center for Health Statistics at the Centers for Disease Control and Prevention supports states that implement FHIR-based exchange. But none of these organizations specifies how states should design matching logic in new systems.
QUICK HIT NEWS
Thirty-seven of Philadelphia’s 216 public schools have adopted digital hall passes through Infinite Campus, the district’s existing student information system. Teachers approve requests through an app, see who is out of class, and set time limits or prevent selected students from leaving at the same time. At Baldi Middle School, which serves more than 1,500 students, bathroom passes typically allow five minutes, with adjustments when needed.
Arkansas has brought 15 state agencies under a single State Cybersecurity Office and one statewide security policy, a little over a year after the Arkansas Cybersecurity Act of 2025 took effect. State CISO Gary Vance said the next step is legislation setting minimum cybersecurity standards for local governments. He noted 10 to 12 ransomware events across Arkansas cities, counties, schools, and sheriffʼs offices last year. A 2022 attack on a vendor took services offline in about 55 counties for roughly three months.
A data security incident at Frontline Education, which provides administration software to K-12 schools, may have exposed employee names, email addresses, home addresses, and Social Security numbers at districts across the country. The incident occurred on August 14 and was contained the next day. The Fort Worth and Crowley school districts in Texas have notified staff. Frontline has informed law enforcement and will contact affected employees directly, but it has not said how many districts were affected.
California State University Dominguez Hills took four years to bring an EV charging project online after finding its campus lacked capacity for even one additional Level 2 charger. The university applied to Southern California Edison’s Charge Ready program in August 2022, and chargers became operational on September 2, 2026, after lengthy negotiations between the utility and the university. The project expanded from seven planned chargers to 200, supporting a car-share fleet of 43 EVs and hybrids.
FOR THE COMMUTE
The Ever-Changing Role of State CIOs (Priorities Podcast)
StateScoop reporter Keely Quinlan discusses the changing responsibilities of state chief information officers following NASCIO’s annual conference in San Diego. The conversation covers the Department of Justice digital accessibility deadline and how artificial intelligence is reshaping expectations for IT modernization and state technology leadership.
RESOURCES & EVENTS
We’re heading to ICMA 2026
State and local leaders are being asked to do more with less, modernize aging systems, navigate workforce challenges, manage emerging technology and still deliver for their communities.
Those are exactly the conversations we want to have.
Fractional Source connects public-sector organizations with experienced leaders who can step in when you need specialized expertise, additional capacity or a fresh perspective, without adding another full-time position.
If you’ll be at ICMA, come find us at Booth 1352. We’d love to hear what your organization is working through.
📊 Report Spotlight: The Water Compliance Gap (SwiftComply)
This report examines how water utilities and municipalities manage compliance programs for backflow prevention, stormwater, grease control, and industrial pretreatment. It notes that many of these programs are run by teams of two or three people, and sometimes by one person. Industry estimates cited in the report suggest compliance managers spend 50% to 70% of their hours on administrative tasks. A single pretreatment report can hold 90 or more data points, each checked against 20 to 30 permit specifications. The report recommends automating notices and reminders, combining program data on one platform, and benchmarking against peer programs.
INSIGHT OF THE WEEK
Household drinking water costs rose an average of 62% between 2015 and 2025, outpacing groceries, inflation, and household income, according to a Food & Water Watch report covering the country’s 500 largest water systems. Annual bills averaged $531, with increases exceeding 300% in Oregon’s Tualatin Valley Water District. Using an affordability threshold of 1.5% of low-income household earnings, the report classified water as unaffordable in 93% of the systems studied. Infrastructure upgrades and water quality compliance are contributing to higher bills as utilities pass those costs to customers.
