As I think about my recently published muni credit scorecard, one of the key takeaways is that I listed “cyberthreats” as a clear and present risk to most sectors across the public finance ecosystem. Arguably, cyberattacks are not a theoretical concept, but rather a daily threat to municipal bond issuers that has provided instances of successful and impactful execution.
The municipal securities industry has curated extensive guidance on primary and secondary market disclosure best practices. However, a review of the municipal market’s principal trade associations and professional organizations suggests that, while many have issued cybersecurity guidance or educational materials, the market lacks a permanent, cross-disciplinary cybersecurity preparedness task force that combines issuers, legal counsel, municipal advisors, underwriters, investors and cybersecurity professionals.
This piece is designed to equip bond attorneys and municipal advisors with a framework to develop best practices and advise issuers before, during, and after a cyberattack. In my view, it is critical for attorneys and advisors to keep executive-level issuer personnel current on all known schemes and methods employed by cyberattackers to breach issuer operations. Issuers should also understand their disclosure obligations surrounding cybersecurity preparedness and experience.
Jeff Lipton, SourceMedia – 11:14 AM ET 7/15/2026