Compliance Coffee Talk · June 2026
Managing cyber risk in smaller counties
Laramie County risk manager Gavin Lobmeyer came to public sector risk from cybersecurity. Here is his practical advice for cities, counties, and special districts that feel behind on cyber.
Guest expert
Gavin Lobmeyer
Risk Manager, Laramie County, Wyoming
John Rote
Host
The session
A risk manager who used to work in cyber
Gavin runs the risk program for Laramie County, the largest county in Wyoming, the least populated state. The county also hosts seven data centers and an NCAR supercomputer, so cyber risk is part of his daily work.
Before risk management, he audited the digital infrastructure of companies his employer acquired, and before that he spent eight years as a paralegal. In June he joined John Rote to answer questions sent in by public sector risk managers.
Watch the full conversation, or read the takeaways below.
Key takeaways
15 takeaways from the session
Grouped by the questions attendees asked, from why small agencies get targeted to how to recruit cyber talent into risk.
01–02
Why smaller agencies get targeted
Size doesn't keep you off an attacker's list. It can put you near the top.
- 01
Small agencies are the test run
Attackers practice on small and mid-sized agencies because those agencies have less money and fewer people for security, yet run the same software as big cities. A water district in Wyoming may use the same system as Denver or Los Angeles, so an exploit that works on the small system can be scaled up.
The takeaway: Treat shared software and utility systems as part of your own risk profile, whatever your size.
- 02
New data centers raise the stakes
Laramie County has seven data centers inside its borders. Data centers depend on local water for cooling, and so do residents. An attack on a small water authority could cut service to businesses, data centers, and households at once.
The takeaway: If a data center is coming to your area, ask the operator and your state to bring the city or county into their security planning.
03–05
Where to start when you feel behind
At one PRIMA session, everyone in the room said they felt behind on cyber. Gavin's advice is to start with the people you already work with.
- 03
Treat security as a process
Gavin's first rule from the cyber world is that security is a process, not a product. You won't ever feel 100% ready. You take small steps until you feel good, then you take more.
The takeaway: Set the next step for your program instead of waiting for a finished plan.
- 04
Sit down with IT, then help build their case
Most county IT staff know what's going on but don't have the resources to act on all of it. Gavin learned where IT thought the county stood, then helped them make the case to elected officials. His cyber broker will soon require a full-time cybersecurity person on staff, and pointing that out helped the county add a dedicated cybersecurity role.
The takeaway: Ask your broker which cyber requirements are coming in the next renewal or two, and use them to support IT's requests.
- 05
Take inventory of what partners already offer
Gavin's broker runs a free penetration test and a cybersecurity audit at each renewal. Because the county's program was strong, the broker created a new tier that raised coverage at the same premium. In Wyoming, a 2023 executive order created the CARE team (Cyber Assistance Response Effort) to help local governments respond to incidents.
The takeaway: Ask your broker, your state, and your grants manager what cyber help you can already use.
06–08
Get ready for an incident with the staff you have
Two cleanup steps that don't require new positions, and a more honest way to think about incidents.
- 06
Plan as if someone may already be in
In cyber, Gavin said, “it is not if or when. It's you either know or you don't know.” Some attackers get in just to see whether they can. Luck holds things together only so long, and good cybersecurity practices are what replace it. Your broker should be able to provide guidance if you don't have it.
The takeaway: Start with basic cyber hygiene now rather than waiting for a first major incident.
- 07
Remove access when people leave
An account for a former employee keeps every permission it had. An attacker who gets into it doesn't need to create a new identity. They can sit in your systems and wait, which Gavin called “living off the land.” Risk and HR staff often have broad access, so their accounts matter most.
The takeaway: Clean up your user rosters, then ask yourself what someone could reach if they got into your account.
- 08
Know which tools people are using
Departments are adopting AI tools for different jobs, and many agencies are still working out their policies. When one person wears ten hats, these tools help, but you need to know what's in use. “The most dangerous risk is something you don't know about.”
The takeaway: Review and update your policies for digital tools, including AI, so every department follows the same practices.
“When you're too small to do it yourself, you rely on your partners.”
Gavin LobmeyerRisk Manager, Laramie County, Wyoming09–10
How risk and IT share the work
You don't need a cyber background to be useful. You need a clear lane.
- 09
Let IT drive, and connect them to help
IT knows your network, your infrastructure, and the industry standards. Risk's job is to understand their concerns and projects, then connect them to outside resources when they reach their limits: the broker, the state risk manager, or a contractor for a penetration test.
The takeaway: Ask IT three questions. What are you concerned about? What should I be aware of? How can I help?
- 10
Share ownership and keep checking in
No one fully owns cyber risk at a municipality, so ownership ends up shared. Once you know about a risk, you're on notice. Gavin checks in with IT on shared goals to make sure the work keeps moving toward a fix.
The takeaway: Put a recurring check-in on the calendar for each open cyber goal.
11–13
Contracts and coverage
Cyber policies are still being figured out, and so is vendor liability.
- 11
Expect cyber coverage to keep changing
A damaged vehicle is easy to price. A system outage that stops every department, or a water authority, is not. An insurer told Gavin that cyber insurance and reinsurance are set to outpace the liability market in the next couple of years. On ransomware, his advice was simple: don't pay it.
The takeaway: Plan for cyber coverage costs and terms to move at each renewal.
- 12
Piggyback where you can't negotiate
Large municipalities and state contracts often get better terms from software vendors. If you piggyback on one of those contracts, you can't change it, but you inherit its protections. The biggest vendors rarely change their terms for anyone, though you do benefit from their large security teams.
The takeaway: Before signing a software contract, check for a state or large-agency contract you can join.
- 13
Ask where liability sits for vendor-hosted data
Public data often lives on servers your agency doesn't own, and you have little insight into the vendor's risk appetite or security practices. Gavin expects this to be the next big contract question for public entities.
The takeaway: Review how your software contracts assign cyber liability for the data you hand over.
14–15
Building skills on your team
Training helps when someone can put it to use.
- 14
Certify someone to bridge risk and IT
Gavin holds the ISO/IEC 27001:2022 ISMS internal auditor certification. He put the cost at roughly $200 to $300, plus an exam. It covers best practices, industry standards, and cyber hygiene, and it gives you a shared language with IT. It won't make anyone a cybersecurity expert.
The takeaway: Work with IT to certify one person who can work between both teams, or name a point person in IT for cyber questions.
- 15
Show IT people what risk work protects
Gavin didn't know his role existed in local government. In cyber work you rarely see the result. In public risk you do: the water stays on, county operations keep running, and people get their paychecks.
The takeaway: When you recruit from IT, show how the work protects residents and services.
Join the next session
Bring your questions to the next Coffee Talk
Each month, experienced risk leaders answer questions from public sector and enterprise risk teams in a 30-minute conversation.