The first hour after an incident matters most — for residents, services, and your council's trust.
HackFirstAid walks small and mid-sized municipalities through it in plain language, with no jargon and no procurement headaches. Free triage, 12 playbooks, and a US + Canada regulatory grid.
Built for towns under ~100,000 residents · Atlantic Canadian roots, North-American practice · OT/SCADA out of scope by design
Tell us what just happened. We'll point to the right playbook and the right regulators.
The free triage is always free — no signup, no email gate. Use it during an incident or run it as a tabletop with your team.
Answer 2–5 plain-language questions about what you're seeing.
Matching playbook, first-hour actions, regulator hand-offs for your jurisdiction.
Email to your CAO, print for council, or work straight from the screen.
Scenarios written for the way municipalities actually run.
Tax, permits, billing, council, clerks, treasurer — vocabulary that matches your charter, not a corporate org chart.
Ransomware affecting core services
Tax, permits, utility billing, and court scheduling encrypted on the same morning.
Treasurer / finance department BEC
Fraudulent wire instructions on a vendor payment or payroll change.
Public-records system compromise
Vital records, property assessments, or business licenses exposed or altered.
Vendor / SaaS supply-chain breach
Your platform vendor was breached and your data may be in scope.
Reporting paths for the platforms your town actually runs.
Tyler, OpenGov, Granicus, CivicPlus, Accela, Microsoft 365 Government, Google Workspace — vendor-specific escalation playbooks paired with the matching incident scenarios.
Put the first hour on paper before you need it.
A one-page checklist your CAO, IT lead, and clerk can keep at their desks. Plain language. No vendor pitch. Built specifically for municipalities.
First-Hour Cyber Response Checklist
A printable, plain-language checklist for the first 60 minutes after a suspected incident. Built for small and mid-sized municipalities.
Built by someone who's actually been in your seat.
25+ years of incident response across the public sector. Founder of AtlSecCon. Atlantic-Canada based, working with US and Canadian municipalities. No vendor pitch, no fear marketing — just calm guidance for the worst morning of your year.
About Travis →Annual billing under most municipal single-quote thresholds. W-9 / BN ready. Sole-source justification template. GSA path on request.
Procurement paperwork →Council governance lives at boards.hackfirstaid.com. Personal protection at hackfirstaid.com. One voice across all three.
Try the triage before you need it.
Most municipalities use HackFirstAid first as a tabletop exercise — then again, for real, six months later. Both are free.
One cyber-readiness stack. Four audiences.
Municipalities sit at the operational layer. HackFirstAid also covers the personal lives of your staff and council members, and the governance-layer oversight your council is responsible for.