Government agencies face four recurring threat types: nation-state intrusion, ransomware and data extortion, exploitation of known vulnerabilities, and credential and phishing attacks. We cannot rank them with verified statistics, but CISA publishes defensive guidance for each, and the actions overlap.
What do nation-state actors want?
CISA's Shields Up page says nation-state actors and state sponsored entities pose an elevated threat to national security, and describes advanced persistent threat activity as well resourced, targeted and aimed at prolonged intrusion. Objectives it lists include espionage, data theft and network disruption or destruction. It names activity attributed to China, Iran, North Korea and Russia, and notes that vendors name the same actors differently, with no ultimate arbiter of APT names.
For a defender, attribution matters less than behavior. The response to prolonged access is the same: reduce exposure, watch logs and limit privilege.
Why is ransomware a government problem?
The joint CISA and MS-ISAC ransomware guide covers ransomware and data extortion that leave organizations unable to access data needed to operate and deliver critical services. Its audience includes state, local, tribal and territorial entities, and it directs eligible public bodies to MS-ISAC for information sharing. Initial access vectors it covers include phishing, remote desktop and VPN weaknesses.
Are old known flaws really that important?
CISA maintains the Known Exploited Vulnerabilities catalog, which it calls the authoritative source of vulnerabilities exploited in the wild, and says organizations should use it as an input to vulnerability prioritization. Shields Up tells defenders to prioritize mitigation of known exploited vulnerabilities and to fix common network misconfigurations.
This changes the question from "which flaws score highest" to "which are being used right now".
What about identity?
CISA's October 2022 fact sheet says not all MFA is equally secure: some forms are vulnerable to phishing, push bombing, SS7 flaws and SIM swap. It calls phishing resistant MFA the gold standard and notes the Office of Management and Budget requires federal agencies to adopt it. Shields Up also recommends least privilege by defining privileged administrator actions and their locations.
What does it look like at a small agency?
A constructed example: a county government runs a permit portal, an email system and a water utility control network, with a two person IT team. They cannot do everything. They start with CISA's free vulnerability scanning on internet facing assets, enroll in MS-ISAC, move administrators to phishing resistant sign in, and review the KEV catalog monthly against their asset list. They keep the control network separate from office systems and keep an offline backup of the permit database.
What makes government different from a company?
Three things stand out. Public bodies often run long lived systems that cannot be replaced quickly, so patching is slow and compensating controls matter. They hold data that citizens are required to give, which raises the stakes of a leak. And they depend on shared services, vendors and managed providers, so one supplier problem can reach many agencies.
CISA's performance goals reflect the last point with a new goal area on managed service provider risk. If your agency outsources hosting or help desk, put that supplier's access in your threat model.
What should leaders ask for each quarter?
Ask for three numbers and one story. The numbers: how many internet facing systems are on the KEV catalog and unpatched, what share of administrators use phishing resistant sign in, and when the last backup restore was tested. The story: the last tabletop exercise and what changed because of it.
These are small enough to review in ten minutes and hard to fake.
How to check or apply this
- Inventory internet facing systems and remote access paths.
- Compare your assets to the KEV catalog and patch those entries first.
- Close or monitor high risk ports such as RDP and SMB, per CISA's advice.
- Move administrators to phishing resistant MFA, then everyone else.
- Keep offline, encrypted backups and test restores.
- Collect logs, especially command line and sign in events, and review them.
- Join the relevant information sharing center, such as MS-ISAC for eligible entities.
- Run a tabletop exercise using CISA's packages and update the plan.
- Report malicious activity to CISA or the FBI quickly.
Quick check
What is the first thing to patch?
Anything on the KEV catalog that exists in your environment, starting with internet facing systems.
Is attributing an attack to a specific nation necessary to respond?
No. CISA notes naming differs across vendors, and defensive steps are the same regardless of who is behind the activity.
Sources
- CISA, Shields Up
- CISA, #StopRansomware Guide
- CISA, Known Exploited Vulnerabilities Catalog
- CISA, Implementing Phishing-Resistant MFA
Last reviewed: 18 October 2026.
