Cyber insurance for state entities is provided by the Department of Administrative Services (DOAS) Risk Management Services (RMS) Division. This covers your entity for issues such as direct loss, out-of-pocket expenses, and defense and liability expenses. If you suspect that your agency has experienced a cyber attack, it’s important to act quickly.
Be familiar with and recognize a cyber security event.
A cyber security incident is a data breach, and can leave your agency, its data, and your operations vulnerable. Cyber security breaches occur through events like phishing emails, malware-based attacks, intercepted networks, DoS or DDoS attacks to a server, internal threats, and more.
Signs that an attack has occurred can include unusual activity on your network, slow or unresponsive systems, or ransomware messages that might state a payment is required to release your data.
If your agency experiences a cyber attack, you should take several steps to limit the damage and prevent additional attacks.
First, contain the attack. Isolate the device, such as a server, laptop or desktop computer. This may involve disconnecting affected devices from the network or shutting down systems to prevent the spread.
While the attack is being contained, contact the Georgia Technology Authority (GTA) help desk at (877) 482-3233, Option 2, available 24/7. Report the event using the phrase, “Declaring a Cyber-Security Event.” During the call, the help desk staff will request an agency point person.
You will be given guidance regarding any further action needed or additional resources to coordinate. The agency point person will receive communication until the incident is closed.
You must report loss or damage to state-owned property within 48 hours of the discovery by submitting a Notice of Loss (NOL) form. Further supporting documentation must be submitted within 120 days.
Within 48 hours of the loss discovery, complete and submit the NOL by email to RMS at riskmanagement@doas.ga.gov or fax, (404) 657-1188.
