Controls Written for a Department You Do Not Have
A borough with a part-time IT contractor gets the same list as a county. The controls are reasonable; the assumption that someone is there to run them is not.
An Attestation With a Date on It
It comes around every year whether the work is done or not, and it is usually the clerk or the administrator who has to sign it.
Coverage That Depends on the Answers
Where you stand against the controls is part of how the fund sets what it carries for you. Guessing is expensive in both directions.
Vendors Selling Tools, Not Controls
A firewall invoice is not a control. The fund wants the control operating and documented, and a box on a shelf does neither.
The ten controls
The Cyber JIF publishes ten controls and describes each one in a sentence. Those sentences are quoted below exactly as the fund states them, followed by what Cloud Guardian puts in place and what the evidence for each one will be. Every one of them is something we already run for managed clients.
Asset Management
Cyber JIF: Inventory of your physical technology system, such as desktops and servers.
A live inventory of every desktop, laptop, server, switch and firewall the entity owns, pulled from the management agent rather than typed into a spreadsheet, so the list is right on the day of the attestation and not just the day it was made.
Data Management
Cyber JIF: Inventory of your digital assets, such as software, sensitive data and employee data.
What software is installed and where, and where the sensitive records sit: payroll, personnel files, resident data, court and police records. Each store gets an owner, a location and a retention rule.
Account Management
Cyber JIF: Inventory of your users' accounts and managing their access security, including Multi-Factor Authentication (MFA).
Every account listed against a person who still works there, with the rest disabled. MFA enforced on email, remote access and every administrative account, and the enforcement report kept as the evidence.
Vulnerability Management
Cyber JIF: Vulnerability scans of your system to detect vulnerable software, as well as your patch management practices.
Scheduled internal and external scans, a patch cadence that is written down and met, and the machine that cannot be patched replaced or fenced off. The scan history is the proof.
Logging
Cyber JIF: Tracking activity throughout your network for security research.
Endpoint, identity, firewall and email logs collected centrally and retained long enough to answer what happened, so an incident is investigated from records instead of memory.
Defense
Cyber JIF: Antivirus, antispam, firewalls, Endpoint Detection & Response (EDR) to protect your network.
Managed EDR on every workstation and server that can see a threat, isolate the machine and tell someone. Filtering in front of the mailbox, SPF, DKIM and DMARC enforced on the entity's domain, and a firewall that is maintained rather than installed once.
Hygiene
Cyber JIF: Employee training, with periodic testing.
Security awareness training on a schedule, phishing simulation between sessions, and completion records by person that the fund can be shown on request.
3rd Party Risk Management
Cyber JIF: Assessing organizations you do business with for security risk, and managing the contractual relationships accordingly.
Who can reach your systems from outside, what they can reach, and whether the vendor holding your records meets the same bar you do. A register of those vendors with the contract language and the review date.
Policies
Cyber JIF: Documenting all security practices, and implementing and testing an Incident Response Plan.
Written policy for each practice above, a named person responsible, and an incident response plan that has been walked through in a tabletop at least once before anyone needs it.
Penetration Testing
Cyber JIF: With all security in place, annual penetration testing can show you how current security can be adjusted or what steps to take next.
An annual test by someone who is not the person who built the defenses, with the findings ranked, fixed and re-tested, and the report filed with the rest of the evidence.
The ten controls above are taken from the Cyber JIF's published 2023 controls document. The fund's own material is the authority, and it changes. We check the published version at the start of every engagement rather than working from a copy, and we map each control on it to what is in place, what is missing and what the evidence will be. See the program's governance and controls material at cyberjif.org.
More than a form to sign
The controls exist because municipalities are the softest large targets in the state: public records, payroll, tax collection and utility billing, run by small staffs on aging equipment. Meeting the list is how you stop being that.
-
Renewal Without a ScrambleThe attestation is answered from a folder of evidence that already exists, not from a week of phone calls to find out what is actually installed.
-
Ransomware Is the Municipal ThreatTowns, school boards and authorities are hit because they pay and because they cannot afford to be down. Every control on the list is aimed at that.
-
Your Standing Shapes Your CoverageWhere you sit against the controls is part of how the fund sets what it carries for you. Being able to prove it matters as much as doing it.
-
Records You Are Obliged to KeepOPRA requests, retention schedules and audit trails all assume the records survive an incident. Backups and logging are the controls that make that true.
-
An Answer for the CouncilWhen the governing body asks whether the town is protected, the administrator can point at a document instead of a feeling.
-
Audit and Grant ReadinessFederal and state grant conditions, insurers and auditors increasingly ask the same questions the Cyber JIF does. One body of evidence answers all of them.
From gap to attestation
Cloud Guardian takes an entity from wherever it stands to an attestation it can sign with confidence, and keeps it there year to year.
Readiness Gap Assessment
Every control on the current list checked against what is actually in place, with the gaps ranked by risk.
Remediation
The gaps closed in priority order: MFA rolled out, backups fixed, endpoints protected, systems patched or retired.
Evidence Pack
A document behind every line of the attestation: screenshots, reports, policies and records, organized the way the fund asks.
Staff Training & Phishing Simulation
Awareness training delivered on a schedule, tested with simulated phishing, with completion records kept.
Incident Response Plan & Tabletop
A written plan with names and phone numbers in it, walked through with your people before it is ever needed.
Annual Re-Check
Before each attestation, the list is checked again against the current published version and the evidence refreshed.
Choose your starting point
Every engagement is quoted to the entity: its size, its systems and how many controls need work. Onsite across New Jersey. Need something else? Tell us.
Readiness Review
For an entity that needs to know exactly where it stands before the attestation comes around.
- ✓ Control-by-Control Gap Assessment
- ✓ Asset, Account and Vendor Inventory
- ✓ Risk-Ranked Remediation Plan
- ✓ Findings Presented to the Administrator or Council
- - Remediation Work
- - Evidence Pack
Remediation & Attestation
The gaps closed and the evidence assembled, so the next attestation is signed from a folder rather than a guess.
- ✓ Everything in the Readiness Review
- ✓ Remediation of Every Open Control
- ✓ Policy and Incident Response Plan Written
- ✓ Staff Training and Phishing Simulation
- ✓ Evidence Pack for the Attestation
- ✓ Support Through the Attestation Itself
Kept Ready
The controls run day to day by us, so the entity stays where the attestation says it is all year.
- ✓ Everything in Remediation & Attestation
- ✓ Controls Operated and Monitored Year-Round
- ✓ Quarterly Control Review
- ✓ Re-Check Against Each New Published List
- ✓ Evidence Refreshed Before Every Attestation
- ✓ A Named Engineer Who Knows the Entity
Six steps to an attestation you can sign
A staged path from where the entity stands today to evidence in hand, with the order of work agreed before anything starts.
Call
Which JIF you belong to, when the attestation is due, what you know is missing and what you are not sure about.
Pull the Current List
We work from the controls document as published at that moment, never from a copy.
Gap Assessment
Every control checked against what is actually running, and the gaps ranked by what would hurt most.
Close the Gaps
Highest risk first. Each fix gets an owner, a date and a piece of evidence when it is done.
Assemble the Evidence
One folder, one document per control, organized the way the fund asks for it.
Attest and Keep It
The attestation is signed from the folder. Next year starts with a re-check, not from zero.
The affiliated JIFs
The Cyber JIF's own member form lists these joint insurance funds. If your municipality, authority, housing authority, utility or first-responder organization belongs to one of them, the Cyber JIF program is the one your cyber coverage runs through.
- Atlantic County JIFACM / ATL
- Bergen County JIFBER
- Burlington County JIFBURLCO
- Camden County JIFCAM
- Central Jersey JIFCNTRL
- First Responder JIFFRESP
- Gloucester, Salem, Cumberland JIFTRICO
- Mid Jersey JIFMID
- Monmouth County JIFMON
- Morris County JIFMOR
- NJ Public Housing Authority JIFNJPHA
- NJ Self Insurers JIFNJSI
- NJ Utility Authorities JIFNJUA
- Ocean County JIFOCE
- Professional Municipal Management JIFPMM
- Public Alliance Insurance Coverage FundPAIC
- South Bergen JIFSBER
- Suburban Metro JIFSBEX
- Suburban Municipal JIFSBMU
Not on the list, or not sure which fund you belong to? Ask your risk manager or fund administrator, or ask us and we will find out with you.
Is your attestation due?
Cloud Guardian is based in North Brunswick and works onsite across Middlesex, Somerset, Mercer, Monmouth, Union and the surrounding counties. We know the framework, we know what a three-person borough office actually runs, and we know the distance between the two.
Tell us which JIF you belong to and when the attestation is due. We come back with where you stand and what it takes to be ready, in writing.
Request a Readiness ReviewCommon questions
What is the NJ Cyber JIF?
A joint insurance fund that provides cyber coverage to New Jersey local public entities through the affiliated municipal, county and specialty JIFs. It publishes the cyber controls that member entities are expected to meet and attest to, and it keeps that list current. The official list and program details are at cyberjif.org.
Does Cloud Guardian issue the coverage or approve the attestation?
No. The fund does both. What we do is prepare you: map every control to what you actually run, close the gaps, and produce the evidence that sits behind each line of the attestation. You sign it knowing it is true and provable.
Do we have to be a managed IT client?
No. Readiness work is scoped on its own. Many entities have an existing IT contractor, and we work alongside them. If you would rather one provider run the controls day to day, that is available too, and it is priced for public budgets.
We already have a deficiency, or a control we cannot honestly attest to. Can you help?
Yes, and it is the most common starting point. We treat a deficiency as a scoped project with a date on it: what the control requires, what is in place, what is missing, who owns the fix and what the evidence will be. Then we close it and document it.
How long does it take to get ready?
It depends on how many controls are already operating and how large the environment is. A small borough or authority with a modern email platform and decent backups is usually weeks. An entity with legacy servers, no endpoint protection and no training program is a longer project, and we tell you the order of work up front so the highest-risk gaps close first.
What does it cost?
Every engagement is quoted to the entity: its size, its systems and how many controls need work. Tell us what you have and we come back with a number in writing. Nothing is billed that you have not already seen.
cGuard Security SuiteTM
Ready before the attestation. Evidence in hand.
Tell us which JIF you belong to and what you have. We reply in writing with where you stand against the current controls and what it takes to close the gaps.