New Jersey Tech, Business, & Creative Resources
Securing the Next 250: Cybersecurity Basics, CISA Guidance and New Jersey Resources
Every October, the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance run Cybersecurity Awareness Month. 2026 is the 23rd edition. CISA’s theme, Securing the Next 250, marks the nation’s 250th anniversary and puts the spotlight on critical infrastructure and on state, local, tribal and territorial governments, as the NCSL summary explains.
The National Cybersecurity Alliance’s own theme is Don’t Make It Easy for Them. CISA’s campaign graphics reduce its advice to four essentials, three ways to strengthen defenses and two new actions for 2026. This document explains each one, then shows where New Jersey organizations can find help putting them in place.
Four Essentials for Every Organization
CISA aims these steps at businesses and government organizations. At the campaign kickoff, Acting Director Nick Andersen said too many breaches happen because these basics are overlooked, as GovTech reported.
Teach employees to avoid phishing scams
Staff should watch for phishing and other scams in email, texts, direct messages and phone calls, verify the sender before clicking a link or opening an attachment, and report anything suspicious. The reason is practical. Clark Hill notes that CISA previously reported that 90% of successful cyberattacks start with a phishing email, and that Verizon’s breach investigations report finds a human element in about 62% of attacks. Email phishing has been declining as an entry point but remains a major threat, so refreshers repeated through the year work better than a single annual course.
Require strong passwords
The graphic sets three rules. Passwords should be long, at least 16 characters; random, a string of mixed letters, numbers and symbols; and unique, never reused on another account. Few people can memorize that many random passwords, which is why the same graphic tells users to keep them in a password manager.
Require multifactor authentication
Multifactor authentication adds a second layer of protection to an account, so a stolen password alone is not enough. CISA tells organizations to choose the most secure method available and says a physical security key gives the best protection while being easy to use. Email, administrator and remote-access accounts are a sensible place to start, since those are the most damaging to lose.
Update software
Updating software and devices is the easiest way to stay protected from security threats. Install updates as soon as they are available, or turn on automatic updates.
Level Up Your Defenses
CISA’s second graphic adds three practices for organizations ready to go further. Logging means recording system activity so your team can watch for signs that threat actors are trying to get into your systems. Backups matter because incidents happen, and recovery is faster and less stressful when critical information is backed up under a plan. A backup only helps if it restores, so test it. Encryption protects data and devices: even if criminals reach your files, the information stays locked and unreadable.
Two New Actions for 2026
The graphic labels these as CPG 2.0 items 1.C and 6.A. Both focus on what happens after a defense fails.
Have an incident response plan and use it
Organizations should develop, maintain, update and regularly exercise incident response plans for common threats such as ransomware. Drills should be realistic and include every relevant stakeholder, including organizational leadership and legal counsel as well as technical staff. Plans should be reviewed and drilled at least once a year.
Be prepared for system disruptions
Organizations should plan and practice how to recover and restore service to critical assets or systems that a cyber incident could affect. CISA suggests planning to keep essential functions running without access to critical assets or even the internet, for example by shifting to paper-based operations or radio communications.
More Ways to Stay Secure
The graphics close with two further steps. Eligible organizations should get a .gov domain through get.gov, and cyber incidents should be reported to CISA at cisa.gov/report. CISA also frames organizational priorities as the 3Rs: reduce attack surfaces, replace end-of-support devices, and recover quickly to sustain operations, per Clark Hill.
Putting It Into Practice in New Jersey
New Jersey’s cyber hub is the NJCCIC, created by Executive Order 178 in 2015 and described by New America as the first state-level information sharing and analysis organization in the country. Membership at cyber.nj.gov is free and brings alerts, advisories and a weekly bulletin on threats aimed at New Jersey networks. Incidents can be reported at cyber.nj.gov/report, which complements reporting to CISA.
Public schools, state and local government and government contractors must report cyber incidents within 72 hours, according to Government Technology. NJCCIC Director Michael Geraghty has said in StateTech that the aim is information sharing, not punishment. A release from Gov. Mikie Sherrill’s office says enrolled local governments also receive free threat monitoring, risk assessments and incident response support coordinated with the State Police and federal partners.
Businesses that handle residents’ data also face the New Jersey Data Privacy Act, in effect since January 15, 2025, according to Brownstein Hyatt Farber Schreck. The Attorney General enforces it through the Division of Consumer Affairs, with penalties of up to $10,000 for a first violation and $20,000 for each later one. Troutman Pepper Locke obtained 10 cure letters sent in 2025, all resolved without further action, and the cure period was set to end on July 1, 2026. Two pending bills, A4198 and S1225, would have the NJCCIC study threats to public entities and private businesses and then publish cybersecurity guidelines. A legislative tracker lists them as carried over, so check their status before relying on them.
Where to Start
Turn on multifactor authentication for email and administrator accounts, using security keys where possible. Set up a password manager and replace reused passwords. Switch on automatic updates and restore a backup as a test. Then schedule an incident response drill that includes leadership and legal counsel, and write down how essential work would continue on paper or by radio if systems went down.
Guidance, laws and bill status change. Confirm current requirements with CISA, the NJCCIC or an attorney before acting on this summary.
