Third Parties Hold Promise To Accelerate Public Sector Digital Modernization, But They Introduce New Cyber-Security Risks

Innovation and emerging digital technologies are continuously reshaping an interconnected world. For the U.S. public sector, the way in which governments and public entities conduct their day-to-day operations has changed significantly, becoming increasingly dependent on technology. The gradual transition to remote services and work began before the COVID-19 pandemic, but prioritization and demand for third-party digital infrastructure accelerated during the pandemic and they will likely remain key business needs. The move to this "no-touch" government service model is prompting a significant build-out of remote access to the public and significantly shifting centralized, physical office settings to a dispersed, remote work environment for many public sector employees. At the same time, keeping up with an expanding digital ecosystem and integrating new digital infrastructure continues to be capital-intensive risk-mitigation undertaking for the more than 15,000 issuers we rate in S&P Global Ratings' U.S. public finance division.

The deployment of third-party technologies and associated spending grew at a frenetic pace over the past five years, and they are likely to be an integral piece in executing core missions of public sector entities going forward. In 2021 alone, total IT spending among states, local governments, and other public entities is estimated to grow to $118.7 billion, an increase of 6.9% compared with 2020 and a 17.2% growth rate since 2017 (source: Government Technology, govtech.com). While S&P Global Ratings believes outsourcing and procurement of third-party managed services will continue and offer substantial benefits, including cost savings and improvements to service delivery, it can also introduce new vulnerabilities to cyber attacks if risks are not properly mitigated.

For many entities within USPF, several factors remain a barrier to widespread in-house management of government technology. First, retirement of cyber security and IT professionals and substantial competition for a finite supply of new or experienced employees has created a supply-demand gap, and the shortage of these professionals varies across all levels of government. In the U.S. alone, the federal government estimates that cyber-security and IT employment across all sectors has an unfulfilled need for nearly 500,000 professionals, finite resources within public sector budgets, and less flexibility to raise wages that remain competitive compared with those of higher-paying private sector positions. In addition, aging infrastructure or potentially complex systems solutions have warranted outsourcing to third parties, which offer benefits of cost-savings, efficiency, expertise, and scalability at a quicker pace than in-house management can provide.

As this reorganization of IT infrastructure and architecture proceeds, increasingly sophisticated and headline-grabbing public sector cyber attacks--particularly the Solar Winds Corp. breach of federal, state, and local agency systems--are a reminder that while government entities are broadening their ability to enhance their own fundamental operations, peripheral threats that target third-party supply chains and bypass government network protections could expose the public sector to more risk. Internet of Things (IoT) devices and a "no-touch" government model--where digital platforms and automation deliver routine and essential services, link to electronic payment systems, and provide on-demand access to documents and records with little to no physical interaction, among other things--each provide a new pathway to sensitive data (e.g., personal identifiable information, credit and bank accounts, employment records, protected health and education information, and law enforcement information) held by governments.

In terms of infrastructure systems such as drinking water and wastewater, public power utilities, and telecommunications the consequences of a third-party cyber attack that impairs critical infrastructure assets can pose potentially significant public health and safety risks. Some recent cyber attacks showed the vulnerability of critical infrastructure when hackers exploited unsupported or outdated operating systems or software to gain access to control system devices, install ransomware, or steal data.

The growing reliance on third parties to develop, deploy, maintain, and protect network applications and devices that rely on sensitive data also requires USPF entities to perform ongoing, active management and communication with third parties to adequately prepare, respond, recover, and minimize the probability of loss arising from a cyber attack. Often, when a third-party cyber-security risk arises, we observe a lack of risk management over who has access to system and data assets, and a lack of formal oversight policies and procedures in place to ensure third-party providers remain connected with and accountable to management teams. For USPF issuers, a lack of risk management around third-party cyber-security risks can prove very costly, both in terms of financial losses and reputational risks that can erode public trust.

Prepare: Issuers Need To Ensure Third-Party Vendors Are Considered Within The Entity's Cyber-Security Policies And Practices

A good cyber-security stance is to maintain a strategy critical to reducing the chances that third parties will inadvertently be the trojan horse for cyber attacks. Public sector issuers must acknowledge where their third-party risk exposure is and identify which third parties are granted access to critical assets or sensitive data. This can be done in different ways, although the capital and resources required to employ a cyber-defense strategy can vary widely. Inclusion of cyber-security requirements (including notification, access controls, monitoring, auditing, and other responsibilities) in third-party vendor contracts needs to clearly address and contractually enforce data risks and security procedures. While the adoption of cyber-insurance policies varies across the sector, public entities might also share risk by imposing additional procurement and contract requirements on third parties to carry cyber insurance for unique risks not covered under its own policy.

Another emerging trend to reduce third-party vendor risk is to adopt a zero-trust risk posture, which views every device or application as a potential threat and requires identity authentication and authorization to access applications and data. This posture provides the opportunity to create more robust and resilient security, simplify security management to segment and restrict users from data that is off limits, improve end-user experience, and enable modern IT practices. However, this shift could require significant effort and be capital intensive for many public sector entities, as it involves addressing foundational cyber-security issues, automating manual processes, and planning for transformational changes, so it is not without financial and logistical challenges.

Regardless of the approach, once third-party contracts are in place, management teams need to be proactive in monitoring that security procedures are followed by vendors. Performing internal or qualified external audits to identify exposure to third-party cyber-security risks and to determine what data the organization has and what levels of security are needed to protect it. Additionally, highly rated management teams should develop and regularly review incident-response plans to address the possibility of unexpected cyber attacks, integrating IT teams in the planning when those services are outsourced. Having good working relationships with third-party vendor security teams could make the difference when these services are most needed following a cyber attack.

The proposed federal Infrastructure Investment and Jobs Act would create a new formula-based grant program through the Department of Homeland Security (DHS) that distributes $1 billion to states between fiscal years 2022-2025 to address cyber-security risks. The grant formula would require states to subgrant 80% of these funds to local governments, and 25% of the local government distribution to rural areas. The bill would also authorize $20 million annually to the DHS to declare a significant cyber-security incident to respond and recover. While this remains a small portion of the overall IT spend across USPF in 2021, S&P Global Ratings believes the federal commitment to make additional cyber-security investments as the first step that could help USPF issuers with limited cyber-security resources to better assess their cyber hygiene and develop plans to address third-party cyber risks.

Respond And Recover: Having The Ability To Quickly Respond To An Attack And Limit The Damage Aids In Recovery

The longer attackers have access to a system the more damage they can bring, making early detection and rapid response critical to limit the financial and reputational damage a cyber attack can present. The greater the damage without an ability to recover system resources, the more likely a cyber attack will cause a deterioration in creditworthiness. When an issuer's IT systems give access to many vendors, enhanced system monitoring could allow for early detection of a cyber attack. Endpoint security management is a key management practice in detecting and blocking attacks in real-time. Being able to disable and quarantine potential access points can limit an attacker's ability to steal important data. In addition, continuing to identify vulnerabilities and reassessing potential points of attack in your network and communications infrastructure and how vendor access factors into these vulnerabilities remain important steps in recovery and future prevention.

Ongoing and open communication with the third-party vendor when an attack occurs to understand what operations might be exposed and what steps will be taken to ensure continuity of services during recovery. This is especially important if much of an entity's IT services are outsourced. Disaster-recovery plans should incorporate cyber risks posed by third-party vendors, establish points of contact, and secure channels of communication with third parties in the event of a cyber attack and ensure that staff is trained and aware of procedures to execute the plan swiftly and effectively. Other best practices include ensuring there are measures in place to minimize losses and stop a potential cyber attack regardless of where the attack originates.

S&P Global Ratings also believes a broader collaborative approach to recovery and promoting better partnerships and sharing of cyber-hygiene practices can enhance the security of citizens' and consumers' data. The federal government recently enacted the False Claims Act, which permits the U.S. Department of Justice to pursue legal action against government contractors that fail to report breaches or misrepresent their cyber-security practices. This could incentivize third-party vendors and private companies to take meaningful action to reduce gaps, both by increasing timely information sharing with the federal government and by hardening cyber defenses of critical infrastructure serving public entities. Indirectly, these measures could provide a framework for states, local governments, and other USPF entities to implement more protective policies and enforce transparency and accountability with third-party vendors.