States can help reduce cyber risk across critical infrastructure by strengthening their own systems, coordinating with local governments and asset operators, and helping organizations with limited staff build basic defenses and recovery plans. They do not own or control every critical asset: responsibility is shared among state, local, tribal, territorial and federal governments, as well as private operators.
Why critical infrastructure needs a coordinated defense
Critical infrastructure includes the assets and services whose disruption could affect national security, the economy, public health or safety. The Cybersecurity and Infrastructure Security Agency (CISA) groups it into 16 interconnected sectors. A cyber incident affecting one organization can therefore matter beyond that organization, especially when other services depend on it.
As an Amazon Associate I earn from qualifying purchases.
State and local governments provide essential services, including public utilities, healthcare and public safety. In its April 29, 2025 report, GAO-25-107313, the U.S. Government Accountability Office said attacks on locally owned utilities and school districts had become more frequent and severe. Those risks make local agencies and operators essential partners in a state strategy, even when the state does not own their systems.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe practical state role is to convene, coordinate and build capacity: improve information sharing, support continuity planning, and help organizations with fewer cybersecurity resources reach a defensible baseline. No single state office or program can apply identical controls to every sector or secure every asset.
#1 Best Overall
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
What should states do first?
Raise the baseline across government
CISA’s August 29, 2025 fact sheet, Four Cybersecurity Essentials for SLTTs, identifies four starting practices for state, local, tribal and territorial governments:
- Train employees to recognize phishing. Suspicious messages can expose sensitive information or deliver malware. Training should help staff recognize warning signs and know how to report a message.
- Use strong passwords. Set and support password practices that reduce the risk of account compromise.
- Enable multifactor authentication (MFA). MFA adds a verification step beyond a password. A FIDO2 security key is one possible physical option where the system supports it; compatibility varies, and the recommendation is to implement MFA, not to use one particular device.
- Apply software updates. Keep operating systems and applications updated as part of a routine maintenance process.
CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs) provide a voluntary, prioritized baseline of practices for information technology (IT) and operational technology (OT) owners. States can use them to structure conversations and identify priorities, while treating them as a starting point rather than a replacement for sector-specific risk management.
Turn baseline controls into a support plan
A state can help agencies and operators translate general practices into assigned work: identify the systems and services in scope, establish who is responsible for each, and set a way to track progress. The sequence should reflect the organization’s circumstances rather than assume every entity has the same technology, staffing or authority.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #2
- Hardware-Rooted Security with PUF Technology – PUFido Drive Clife Key uses Physical Unclonable Function technology to generate a unique, hardware-based identity that cannot be duplicated, delivering stronger resistance against tampering and cyber attacks than conventional security keys.
- FIDO2 Certified Phishing-Resistant Protection – Fully compliant with FIDO2/U2F standards, enabling secure passwordless login and two-factor authentication to help protect accounts from phishing and credential theft.
- Security Key + Flash Drive in One Device – Combines a FIDO security key with a built-in USB flash drive, allowing you to carry files and a hardware authentication key together in a single compact device.
- Easy to Use & Portable – Compact USB-C design fits easily on a keychain or in a pocket. Simply plug in the Drive Clife Key to authenticate or access stored files with no extra software required.
- Universal Compatibility – Works with hundreds of FIDO2/U2F compatible services and supports Windows, macOS, Linux, iOS, Android, and other major platforms.
- For state agency IT, assess account security, updates, staff readiness and the ability to respond to an incident.
- For local governments and school districts, identify where limited staffing or expertise makes shared training, technical assistance or exercises useful.
- For a privately operated critical asset, coordinate with the operator and clarify who can make changes, what information can be shared, and how public agencies can support response and continuity.
How should states approach utilities and other OT systems?
Operational technology controls or monitors physical processes. In a utility, a cyber incident may therefore affect operations as well as information or business systems. Security decisions need to account for the consequences of interrupting or manipulating those processes, and for the need to maintain or restore service.
Build visibility and manage access
NIST’s May 2020 SP 1800-23, on asset management for electric utilities and oil and gas, describes accurate OT asset inventory as a critical component of cybersecurity strategy. Knowing which industrial control system (ICS) assets exist and how they are managed supports operational continuity. The guide is useful for this durable inventory principle, not as a current account of threats.
Remote access deserves particular attention because it can connect outside users or systems to operational environments. NIST’s June 24, 2026 announcement of SP 1800-45 describes example secure remote-access architectures for water and wastewater OT. Its sample implementations were demonstrated in a lab environment using commercially available technologies; they are reference designs, not proof that a single configuration fits or has been deployed at every utility.
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Plan for continuity and recovery
NIST’s October 1, 2026 Cybersecurity Insights post says recent attacks on water and wastewater systems have targeted OT devices used to manage physical treatment and storage processes. It emphasizes enterprise-wide risk management across people, processes and technology, and notes that effective protections can help utilities limit impact and restore operations faster.
States can support operators by encouraging them to connect cyber incident response with operational continuity and recovery planning. The plan should make clear who is authorized to act, how the operator will coordinate with public agencies, and how essential services can be maintained or restored. The technical and operational details must be developed with the asset owner or operator, not assumed from a statewide template.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can states help smaller organizations build capacity?
Use grants as one possible resource
GAO-25-107313 describes work supported through the State and Local Cybersecurity Grant Program, including risk assessments, training, tabletop exercises and policy projects. Grants can help build capacity, but funding is not guaranteed or universally available. Eligibility, application timing and allowable work depend on the relevant jurisdiction and fiscal-year requirements; check current program terms before planning around an award.
Rank #4
![Thetis Pro FIDO2 Security Key Passkey with Complex Pin [PinPlex], Hardware Device Supports USB A, Type C &NFC, TOTP/HOTP Authenticator APP, PIV Certificates, FIDO 2.0 Two Factor Authentication 2FA MFA](https://m.media-amazon.com/images/I/31ugrBqG6SL._SL160_.jpg)
- Dual USB-A and USB-C Security Key – Features both USB-A and USB-C connectors for seamless compatibility across desktops, laptops, and tablets. Supports plug-and-stay use or keychain carry.
- NFC-Enabled for Mobile Access – Built-in NFC allows fast, wireless authentication with Android and iPhone devices. Ideal for mobile logins and on-the-go security.
- FIDO Certified for Strong Authentication – [CHECK COMPATIBILITY before purchase] Fully compliant with FIDO2 and FIDO U2F standards. Works with major platforms like Google, Microsoft, GitHub, and Dropbox.
- Passwordless Login with PinPlex – Supports secure passkey login via WebAuthn and CTAP2 with added protection from PinPlex, a complex PIN system that enhances physical security.
- Multi-Layer Authentication Support – Includes PIV certificates and supports both TOTP and HOTP for strong 2FA/MFA coverage across enterprise and consumer apps.
Match assistance to the actual gap
Funding alone does not ensure a project will improve security. Before committing resources, states and participating organizations should check:
- Scope: Is the work for state agency IT, local government systems or a privately operated asset?
- Operational consequence: Is the primary concern data exposure, interruption of a public service, or manipulation of a physical process?
- Readiness: Does the organization have an inventory, staff capacity, incident-response arrangements and recovery capability?
- Coordination: Who owns the system, who can authorize changes, and what information can be shared?
- Cost and fit: Will the proposed work fit existing identity or OT environments, procurement rules and lifecycle needs, and does funding apply?
These questions also help identify where shared services, technical assistance or exercises may be more useful than a standalone purchase. For OT projects in particular, technical fit and safe implementation need to be assessed with the operator.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How should state, local and private partners coordinate?
Coordination works best when roles are explicit before an incident. A state can bring agencies and operators together to align risk reduction and continuity planning, while each organization retains responsibility for systems it owns or operates. Local, tribal, territorial and federal partners may also have roles depending on the service and incident.
- Agree on contact points and how urgent information will be shared.
- Clarify who can make technical and operational decisions for each system.
- Coordinate exercises so participants can practice response, service continuity and recovery across organizational boundaries.
- Respect the limits of each participant’s authority and the sensitivity of information being shared.
CISA’s August 2025 fact sheet puts the public-service stakes plainly: “Cybersecurity isn’t just best practice—it’s civic duty.” For state leaders, that means treating cybersecurity as a shared resilience responsibility while tailoring action to the systems, operators and communities involved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
