Cyber Threat Continuity
Regional emergency communications centers (RECCs), which often manage connections across multiple agencies and systems, operate at the intersection of public safety and information technology (IT). Every 9-1-1 call, dispatched ambulance, police pursuit and fire response depends on the systems that work quietly behind a telecommunicator’s console.
When a cyberattack disrupts those systems, the consequences are not measured in lost productivity or quarterly earnings, but in response times, patient outcomes and lives. As ransomware groups, nation-state actors and opportunistic criminals increasingly target public safety infrastructure, RECC directors must treat cybersecurity as a core mission function on par with radio operations and call processing.
How cyberattacks impact recc services
A successful cyberattack against a RECC can degrade or eliminate nearly every service the center provides. Computer-aided dispatch (CAD) outages may force telecommunicators to revert to manual card systems, slowing dispatch times and creating gaps in unit tracking.
When geographic information system (GIS) layers go dark, dispatchers lose automated location plotting and routing recommendations. Phone system compromises can cause 9-1-1 calls to drop, queue improperly or fail to display automatic number identification (ANI) and automatic location information (ALI).
Records management system breaches expose victim data, ongoing investigations and protected health information. Radio console disruptions can sever the link between dispatchers and field units. Ransomware attacks targeting shared county infrastructure have forced some centers to operate on paper for days or even weeks, affecting access to fire preplans, hazardous materials references, and mutual aid coordination.
The impact extends well beyond the ECC. Hospitals may lose pre-arrival notifications. Fire departments may lose access to building floor plans. Law enforcement officers may need to run warrants by voice over already congested radio channels. In the worst cases, citizens dialing 9-1-1 may encounter busy signals or failed connections.
Prevention: building a defensible center
Prevention starts with treating the RECC as critical infrastructure and applying the controls that designation demands. The Cybersecurity and Infrastructure Security Agency (CISA) Cybersecurity Performance Goals and the National Institute of Standards and Technology (NIST) Cybersecurity Framework provide a strong foundation. Meanwhile, APCO International has published public safety-specific guidance that translates those frameworks into the dispatch environment.
Practical prevention measures include network segmentation that isolates CAD, Next Generation 9-1-1 (NG9-1-1), radio and administrative networks from one another and from broader county or municipal networks. Because phishing remains the most common attack vector, multi-factor authentication (MFA), security awareness training and email filtering with attachment sandboxing should be standard practice.
Endpoint detection and response tools should be deployed on all workstations and servers, with monitoring provided either internally or through a managed security services provider. Patching cycles must be aggressive, but changes should be tested carefully. Emergency communications systems cannot tolerate a failed update during peak demand.
Vendor management deserves special attention. RECCs often rely on software and services from numerous providers, and every vendor connection represents a potential entry point for attackers. Agencies should request system and organization controls 2 (SOC 2) reports, establish written incident notification requirements and review security controls before contracts are finalized.
Recent cyberattacks targeting public safety software vendors have demonstrated the risks of supply chain compromise. Even centers with strong internal security programs can be affected when a trusted vendor experiences a breach.
What to do when an attack occurs
The first moments after discovering a cyber incident often determine its impact. Initial actions should focus on containment without panic. Telecommunicators working active incidents should not be responsible for isolation decisions. Still, supervisors and IT personnel should have a pre-approved response plan that allows compromised systems to be disconnected immediately when necessary.
Evidence preservation is equally important. Memory captures, system logs and other forensic artifacts should be collected before systems are rebooted whenever possible. These records are often critical for investigations, recovery efforts and insurance claims.
Partner notification should happen quickly. The FBI, CISA, state fusion centers and state 9-1-1 administrators may all need to be brought into the loop. ECCs used for mutual aid should be advised whether overflow calls may need to be routed to their centers. Field responders should know whether CAD information remains reliable.
Legal counsel and cyber insurance providers should also be engaged early, as insurance policies often specify which incident response firms may be retained.
Communication with the public requires transparency and discipline. Agencies should acknowledge service impacts, provide alternative contact methods when appropriate and avoid speculation about attribution or ransom demands before facts are confirmed.
The first moments after discovering a cyber incident often determine its impact.
Continuity of operations
A continuity of operations plan (COOP) often determines whether a center experiences a temporary disruption or a major operational crisis. Every RECC should maintain manual dispatch procedures and practice them regularly rather than relying solely on written documentation.
Preprinted run cards, paper unit status boards and laminated reference materials should be stored in locations that remain accessible without network connectivity. Backup radios operating on separate power sources and written call-taking procedures for non-CAD operations are equally important.
Geographic redundancy is another critical safeguard. A partner ECC that has agreed in writing to accept rerouted 9-1-1 traffic, with technical testing performed regularly, may provide greater operational resilience than any single cybersecurity product.
Cloud-based or offsite CAD backups with verified recovery timelines can significantly reduce downtime. Backup data should also be immutable and air-gapped whenever possible, since modern ransomware often targets backup repositories specifically.
Managing security across multiple platforms
The typical RECC environment spans federal databases such as the National Crime Information Center (NCIC) and the National Law Enforcement Telecommunications System (NLETS), state criminal justice information systems, CAD and records management platforms, regional radio networks, NG9-1-1 services and numerous third-party integrations.
Managing security across this landscape requires clear accountability. Many agencies designate a chief information security officer (CISO) or security manager who works directly with center leadership to oversee cybersecurity strategy and compliance.
Standardization can simplify security management. Agencies should establish consistent security requirements across systems, and, where applicable, use the Criminal Justice Information Services (CJIS) security policy requirements as a baseline. Centralized identity management and single sign-on platforms can improve consistency while reducing administrative burden.
Maintaining an accurate inventory of applications, vendors, data classifications and patch status is equally important. Organizations cannot effectively protect assets they have not identified and documented.
Finally, agencies should practice regularly. Tabletop exercises involving ransomware attacks, CAD outages and vendor compromises should occur at least annually and involve communications personnel, field responders, IT staff, leadership and partner agencies.
The center that has rehearsed its worst day is the one most prepared to continue answering 9-1-1 calls when that day arrives.
