1 Cyber Risks to Next Generation 911 The advent of Next .docx

1
Cyber Risks to Next Generation 911
The advent of Next Generation 911 (NG911) systems, which
operate on an Internet Protocol (IP)
platform, enables interconnection on with a wide range of
public and private networks, such as wireless
networks, the Internet, and regular phone networks. NG911
systems will enhance the current capabilities
of today’s 911 networks, allowing
compatibility with more types of
communication, providing greater situational
awareness to dispatchers and emergency
responders, and establishing a level of
resilience not previously possible. NG911
will allow Public Safety Answering Points
(PSAPs) to accept and process a range of
information from responders and the public
alike, including real-time text, images, video,
and voice calls. In addition, NG911 will
provide PSAPs with supplemental location
data, which may enable more effective
response.
Traditional 911 services typically operate over standard voice-
based telephone networks and use
software, such as computer-aided dispatch systems, that operate
on closed, internal networks with little
to no interconnections with other systems. The limited means
of entry into the traditional 911 network
significantly limited potential attack vectors, and what little
cyber risk existed could be easily managed.

NG911’s interconnections enable new response capabilities, as
shown in Figure 1. However, they also
represent new vectors for attack that can disrupt or disable
PSAP operations, broadening the concerns
of―and complicating the mitigation and management of―cyber
risks across all levels of government.
The potential cyber risks to a NG911 system do not undermine
its tremendous benefits. Nevertheless,
cyber risks do present a new level of exposure that PSAPs must
understand and actively manage as a part
of a comprehensive risk management program. Past events have
proven 911 systems are attractive targets
for cyber-attacks. For example, attackers have disrupted
availability of traditional 911 systems by using
auto-dialers to overwhelm PSAP phone lines and cause
congestion, preventing legitimate 911 calls from
going through [commonly called Telephone Denial of Service
(TDoS) attacks] and location-based
records and databases that support NG911 are of interest to
cyber criminals, data miners, and even nation-
states wanting to access and exploit that information.
As cyber threats grow in complexity and sophistication, attacks
could be more severe against an NG911
system as attackers can launch multiple distributed attacks with
greater automation from a broader
geography against more targets. This issue paper provides an
overview of NG911 cyber infrastructure,
conveys the cyber risk landscape associated with NG911, offers
an approach for assessing and managing
risks, and provides additional NG911 resources.
Figure 1: NG911 Benefits and Risks
Benefits

NG911 will enhance
response capabilities:
(e.g., video, text) from
the public over a variety
of networks
ables data sharing
between PSAPs
PSAPs for survivability
Risks
NG911 is different from
traditional systems:
identity management and
credentialing across
systems
ntial attacks
to quickly escalate or
proliferate across systems
vectors
2

Cyber Infrastructure
The National Emergency Number Association (NENA) describes
NG911 systems as an IP-based system
comprised of hardware, software, data, and operational policies
and procedures that:
• Provides standardized interfaces from emergency call and
message services;
• Processes all types of emergency calls, including voice, data,
and multimedia information;
• Acquires and integrates additional emergency call data useful
to call routing and handling;
• Delivers emergency calls, messages, and data to the
appropriate PSAP and other entities;
• Supports data and communications needs for coordinated
incident response and management; and
• Provides broadband service to PSAPs or other first responder
entities.1
NENA defines several basic building blocks of NG911 systems,
as described below:
• Emergency Services IP Networks
(ESInets). ESInets are at the center
of NG911 systems. These broadband
networks are engineered and managed
to use Internet protocols and standards
to carry voice and data traffic (e.g.,
text, pictures, videos) in support of
local, regional, state, and national
emergency management authorities.
• Applications and Databases. NG911
uses a wide range of internal and
external databases to support its services. Internal databases
validate and route data, record call details,
and enforce policy and business rules. External databases host

many of the datasets that call takers
and dispatchers rely on to provide improved accuracy and
shortened response time, including location
data, government records, law enforcement records, healthcare
information, and infrastructure data.
• Standards and Security. NG911 uses functions and protocols
that are compliant with international
IP standards, as well as standards developed within the
emergency response community. NENA
defines NG911 standards based on Internet Engineering Task
Force (IETF) IP standards.2 In addition
to NENA, there are a number of other entities that establish
standards for NG911 systems, including
the Association of Public-Safety Communications Officials
(APCO), the Alliance for
Telecommunications Industry
Solution
s (ATIS), and the IETF.3
1 “What is NG911?”.NENA.
http://c.ymcdn.com/sites/www.nena.org/resource/resmgr/ng9-1-
1_project/whatisng911.pdf.
2 The full list of NG911 functions, called the “i3” architecture,
are defined in NENA 08-003, “Detailed Functional and
Interface Standards for NG911.” NENA has also defined
security standard 75-001, “NENA Security for Next Generation

9-1-1 Standard (NG-SEC).” The i3 functions and standards,
NG-SEC, and the full suite of other NG911 standards can
be found at https://www.nena.org/?page=Standards.
3 A full review of NG911 standards can be found on the
National 911 Program’s website at
http://www.911.gov/pdf/NG911-Standards-Identification-and-
Analysis-March2015.pdf.
Figure 2: Simplified ESInet Diagram
http://c.ymcdn.com/sites/www.nena.org/resource/resmgr/ng9-1-
1_project/whatisng911.pdf
https://www.nena.org/?page=Standards
http://www.911.gov/pdf/NG911-Standards-Identification-and-
Analysis-March2015.pdf
3
Per the definition above, cyber infrastructure for NG911
systems includes the IP-based networks, assets,
databases, and services, as they are involved in the processing,
storage, and transport of data.
Specifically, an NG911 system’s cyber infrastructure includes:

• Assets that are part of, or interconnect with, ESInets
• Service provider networks and applications that interconnect
with ESInets
• Government applications and services that connect to ESInets
• Dispatch systems and components that connect to ESInets
Traditionally, the term “cyber” has been applied to only
information technology (IT) systems and assets,
while communications infrastructure was considered separate.
However, defining cyber infrastructure as
including both IT and communications systems accounts for the
many ways in which these systems have
converged. NG911 administrators should recognize this
convergence in order to more effectively counter
risks. Risks to any component of these systems could threaten
an entire NG911 system or its data, so it
is important to consider systems holistically.
The NG911 Cybersecurity Risk Landscape
Cybersecurity4 risks occur when a threat exploits a
vulnerability, leading to an undesired event that has
a negative consequence on the desired state of the network. The
three attributes most necessary for a
secure system are often referred to as the C-I-A Triad:
• Confidentiality: Ensures that data is only accessed by those

authorized to see it.
• Integrity: Ensures that data is trustworthy and is not altered
through transmittal, storage, or retrieval.
• Availability: Ensures that the infrastructure—either
components of the network or the network as
a whole—is operational and committable to its intended
purpose.
The CIA Triad is used as a benchmark for evaluating
information system security by the National Institute
of Standards and Technology (NIST), the International
Telecommunications Union (ITU), and others.
Loss of confidentiality, integrity, or availability has especially
severe impacts in the emergency response
domain. For example, loss of confidentiality within NG911
systems could expose information to identity
thefts or disrupt ongoing investigations; loss of integrity could
disrupt response to 911 calls; and loss of
availability could prevent urgent requests from reaching a
PSAP.
4 Cybersecurity is “the prevention of damage to, unauthorized
use of, exploitation of, and, if needed, the restoration of
electronic information and communications systems and

services (and the information contained therein) to ensure
confidentiality, integrity, and availability”, Department of
Homeland Security (DHS) National Infrastructure Protection
Plan,
2009. http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf.
“Cyber infrastructure includes electronic information and
communication systems, and the information contained in these
systems.
…Information and communications systems are composed of
hardware and software that process, store, and communicate
data of all types. Processing includes the creation, access,
modification, and destruction of information. Storage includes
paper,
magnetic, electronic, and all other media types.
Communications include sharing and distribution of
information."
National Infrastructure Protection Plan (2009, Revised and
Updated 2013)
http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf
4

Cybersecurity risks to NG911 systems,
such as those shown in Figure 3, have
severe potential impacts, including loss
of life or property because of hampered
response operations; job disruption for
affected network users; substantial
financial costs from the unauthorized
use of data and subsequent resolution;
and potential lawsuits from those
whose data is breached or whose lives
are adversely affected. To understand
the significance of different risks to the
confidentiality, integrity, or availabity
of a NG911 system, the terms threat,
vulnerability, likelihood, and
consequence must be understood.
Threats. Threats are anything that has
the potential to harm the system and
are produced by “threat actors.” There are a variety of potential
actors, each with different intent and
capabilities to carry out an attack. By understanding the
motivations and capabilities of those responsible
for launching attacks, system administrators can better

anticipate the types of attacks they might face and
better protect data and assets that are likely targets. Threat
actors who have caused real-world damage
include, but are not limited to, those in Figure 4:
In addition to attacks, unintentional threats can disrupt the
confidentiality, integrity, or availability of
NG911 systems. Unintentional threat actors include employees,
vendors, contractors, or subcontractors.
For example, one of these actors could:
• Improperly safeguard data when sending or storing (for
example, not using proper encryption, sending
data to unauthorized individuals, putting weak protection on
databases)
• Enter typing mistakes that result in loss of data integrity
• Accidentally make a data resource unavailable when
performing maintenance or upgrade operations
• Not follow physical or cyber protection procedures
• Improperly test or maintain back-up systems and power
sources
Figure 4:
Threat Actors

structure, private or public, and acts with few constraints
.Manager of
organized crime organization with significant resources
from intrusion or destruction of property, without agenda
gatherer external to the company (includes cyber methods)
-sponsored spy or
agent as a trusted insider, supporting idealistic goals
-sponsored
attacker with significant resources to affect major disruption
-state……………………………………………….A
sovereign territory with significant resources to cause harm
Activist……………………………………………...Highly
motivated, potentially destructive supporter of cause
of violence to support personal socio-political agenda
Figure 3: Potential Risks to NG911 System Components
5

Vulnerabilities. Vulnerabilities are weaknesses
in a system, network, or asset that could enable an
undesired outcome, such as a network outage or
security breach. Vulnerabilities take two forms,
those that are vulnerable to external threats and
those that are vulnerable to internal threats. One
of the key tactics of an attacker is to gain credentials
and access to a network, and then exploit
vulnerabilities within the network as a seemingly
“trusted entity.” Vulnerabilities can also be within
a network and available to malicious threat actors
who gain access to the internal system, either
improperly (through hacking) or by misusing their current
position (insider threats). These actors
typically take advantage of databases or system applications
with bad encryption, poor authorization
and access control measures or policies, and interconnections or
interfaces with an external network or
entity. With vast interconnection possibilities, PSAPs may
suffer from vulnerabilities associated with
systems for which they have not contributed funds, hold no
direct authority, or provide other resources
to support beyond network access and perhaps mutual-aid
agreements—even if they share redundancies,

databases, or other resources. In addition, different vendor
implementations using proprietary
technologies can lead to varying degrees of protection and
interoperability, even when addressing
the same standards and system requirements. NG911
developments have focused primarily on
deployment or modernization projects, but rarely on the
governance and oversight of cyber risk
management that are critical to cybersecurity.
Likelihood. Likelihood refers to the possibility that a risk
scenario could occur. Determining the
likelihood of a risk depends on the level of both the threat and
the vulnerability and is the probability that
a given threat type will exploit a set of vulnerabilities, resulting
in the occurrence of a risk. For example,
if a system has no vulnerabilities, the likelihood of risk is low
even if there is a significant threat because
the threat would have nothing to exploit. On the other hand, if
the system contains a significant
vulnerability but there is no threat to exploit it, the likelihood
of a risk will be equally low. A risk with
both a greater threat and greater vulnerability level is much
more likely to occur than one with a low
threat and low vulnerability level.

Consequences. While the potential consequences of
cybersecurity breaches depend in large part on
the type of breach, the severity of the breach is determined by
its ability to impact and degrade NG911
systems and PSAP operations, or its ability to harm the citizens
they serve and the public’s confidence in
911 systems. Additional consequences include loss of sensitive
records, including personal information
about citizens, law enforcement data, critical infrastructure
information, healthcare data, dispatch
information, and possible legal liability for parties responsible
for protecting the systems. When
evaluating potential consequences, it is important for
administrators to assume the worst possible
outcome. For example, a particular type of data breach could be
small and insignificant, but
Example Vulnerabilities
Old Systems: Systems that are out of date or past their
lifecycle that lack modern security measures
Shared Systems: Shared systems/databases with other
entities that have not employed security measures
Lack of Diversity and Redundancy: Lack of diverse routing
for communications or redundancy for electric power

decreases resilience
Lack of Security Policies: Ad hoc or non-existent security
policies enable insiders to accidently or intentionally disrupt
operations and/or security
6
administrators should account for the greatest reasonable
consequence if that data breach were to occur.
Because it is impossible to address every risk, it is helpful to
look at which risks are more likely to occur
to make more informed decisions about where to best allocate
resources to ensure the most risk reduction.
However, likelihood is only one part of the equation—the
consequences of risks must also be assessed.
Improving NG911 Cybersecurity Posture
Given the dynamic nature of technology and the evolving cyber
risk landscape, organizations should
adopt a cybersecurity framework. An effective framework
enables response organizations to:
• Identify new and evolving risks

• Assess and prioritize risks
• Develop and prioritize mitigation stategies based
on cost-benefit analysis and other factors
• Evaluate the impacts of mitigation
implementation
• Develop an approach to detection and effective
response and recovery procedures
The Department of Homeland Security (DHS)
strongly recommends adopting the NIST
Cybersecurity Framework, which is a flexible, risk-
based approach to improving the security of critical
infrastructure.5 Collaboratively developed between
government and the private sector, the framework is
based on industry standards and best practices and can
be used for NG911 systems. The NIST Cybersecurity
Framework is designed to complement an existing cybersecurity
risk management process or to develop
a credible program if one does not exist. Figure 5 demonstrates
the five core tenets of the NIST
Framework: identify, protect, detect, respond, and recover.
More information, including informative

reference for addressing each tenet can be found in the
Framework.
5 The most recent NIST Cybersecurity Framework and related
newsletters are available at
http://www.nist.gov/cyberframework/.
Risk = the likelihood of a threat exploiting a vulnerability
and the potential consequence or impact of that event
Figure 5: NIST Framework Core Structure
http://www.nist.gov/cyberframework/
7
Identifying and Assessing Risks
Regardless of the cybersecurity framework chosen,
administrators will need to identify, evaluate
and prioritize risks for their organization. Figure 6 provides a
sample risk assessment process.
Figure 6: Sample Risk Assessment Plan (to be followed with

mitigation and response/recovery)
8
Mitigating Risks: Protect and Detect
While no single mitigation strategy can comprehensively
address all the risk scenarios identified, the
individual evaluation of mitigation techniques may identify
complementary mitigation strategies for
creation of a broad-reaching, holistic approach. In general,
mitigation strategies aim to either prevent
and protect against an identified risk being exploited, or seek to
ensure timely awareness of a
cybersecurity breach or occurrence. Mitigation strategies
should employ safeguards that decrease the
impact of a risk, if exploited, on the organization and its ability
to deliver critical services.
Table 1 describes sample mitigation strategies for NG911
cybersecurity. This list is not exhaustive and
should not replace a comprehensive requirements analysis;
however, it is intended to provide a starting
point for requirements, planning, and implementation. Some

elements may be addressed through
nationwide standards, industry best practices, or policy
guidance, while others may be developed and
practiced by PSAP administrators.
SAMPLE Strategy Description
Access Privileges Ensure access privileges are used
appropriately are restricted to appropriate personnel
and that privilege elevations
Application Layer Determine application layer interoperability
requirements and standards and
Protect
Interoperability implement a process for regular review and
update
Authentication And
Identity Management
Develop and implement policies on authentication and identity
management
that are applied uniformly and meet public safety requirements

for
performance, security, and time-sensitive mission demands
Capacity Planning Engage in assessing capacity assets
requirements for PSAP infrastructure and
Data Encryption Develop requirements for data encryption that
apply to both primary back-up data
and
Database Back-Up Develop guidance or policies for performing
and retrieving database backups
Information Security
Policies
Establish and enforce consistent information security policies
and ensure
those policies are continually updated as new threats and
technologies
emerge
Training Develop role-specific training requirements for users
and administrators, include training on security, resiliency, and
operations

to
Continuous Develop continuous diagnostics and mitigation
capabilities or use existing
Detect
Monitoring government capabilities
Log Management
And Audit
Capabilities
Ensure that log management and audit capabilities,
are strong, appropriate, and responsive
policies, and technology
Physical Security Develop and implement physical security and
access control policies for
And Access Control facilities
Table 1: Sample NG911 Security Mitigation Strategies (non-
comprehensive)

9
Exploited Risks: Response and Recovery
Incident Response Teams (IRTs), incident response plans,
recovery or resiliency plans, and continuity
of operations plans are useful in cybersecurity incident
response. PSAP administrators may
consider establishing a Computer Security Incident Response
Team (CSIRT) or reach an agreement
with US-CERT to assist in carrying out cybersecurity planning.
US-CERT is a CSIRT run by the DHS
National Cybersecurity and Communications Integration Center
(NCCIC).6 A CSIRT serves as a
centralized location to report and analyze security issues within
an organization. A CSIRT may also
recommend potential solutions to the threats and publicize
known threats, vulnerabilities, and solutions
generally or to a specific information-sharing community. The
CSIRT could also work with hardware
and software vendors to obtain information about vulnerabilities
and potential solutions.
Leveraging federal resources, such as US-CERT, can aid in the
protection of the NG911 system and its
data. In addition, coordinating response and recovery efforts

with the Statewide Interoperability
Coordinator (SWIC), State Single Points of Contact (SPOC),
and other PSAP administrators can
increase cybersecurity posture. Sample response and recovery
actions are shown in Figure 2.
Table 2: Sample NG911 Response and Recovery Actions (non-
comprehensive)
SAMPLE
Action Description
Response
• Incident Response Plan. Develop incident response plans,
policies, and capabilities for
the networks, personnel and user equipment that prevent
expansion of the event, mitigate
its effects, and eradicate the incident
• Incident Response Team. Establish an incident response team
with or utilize existing
capabilities like US-CERT to ensure response activities are
coordinated with appropriate
stakeholders

• Contain Cybersecurity Event. Execute response processes and
procedures, preventing
expansion of the event, mitigate its effects, and eradicate the
incident
• Deploy IRT. Coordinate with internal and external
stakeholders, as appropriate, including
external support from law enforcement agencies and response
centers, such as US-CERT
Recovery
• Recovery Plan. Develop and implement the appropriate
activities to maintain plans for
resilience and to restore any capabilities or services that were
impaired due to a
cybersecurity event
• Continuity Planning7. Establishing and maintaining
redundancy is a key strategy that
promotes network reliability, resiliency, and continuity of
service
• Coordination. Restoration activities are coordinated with
internal and external parties,

such as coordinating centers, internet service providers, owners
of attacking systems,
victims, response partners, and vendors
• Process Improvements. Recovery planning processes and
strategies are improved by
incorporating lessons learned into future activities. Response
personnel should be trained
on the latest security, resiliency, continuity and operational
practices and maintain in-
service training as new technology and methods are made
available
6 See: https://www.us-cert.gov/ccubedvp.
7 For continuity recommendations, see FEMA’s Continuity
Guidance Circular (CGC) 1 and 2 available at
http://www.fema.gov/media-library/resources-
documents/collections/343
https://www.us-cert.gov/ccubedvp
http://www.fema.gov/media-library/resources-
documents/collections/343
10

Actions for Improving NG911 Cybersecurity
This document provides an overview of the cyber risks that will
be faced by NG911 systems. It is
intended to serve only as an informational tool for system
administrators to better understand the full
scope and range of potential risks, as well as recommend
mitigations to these risks. The following actions
are provided for system administrators intending to improve
their NG911 systems:
• Adopt a “security first” perspective. Cybersecurity has
become an integral part of mission
function and operations for NG911 systems. Working with
others within the NG911 community,
government, industry, and academia to establish consistent
standards, policies, procedures,
interoperability and implementation guidance for NG911
deployments is crucial.
• Leverage historically-successful cybersecurity strategies.
Researching available references and
resources, as well as gathering experiences from other NG911
community members, is important
to constructing the ideal solution set for each NG911 system’s

unique circumstances.
• Establish a CSIRT or reach an agreement with US-CERT to
assist in carrying out
cybersecurity planning. A CSIRT serves as a centralized
location to report, analyze, and respond
to security issues within an organization. Tracking
developments in the cybersecurity field and
providing prioritized implementation of cybersecurity solutions
are also CSIRT activities.
• Establish a cybersecurity risk framework. The NIST
Cybersecurity Framework is highly
recommended as a flexible, risk-based approach to improving
the security of critical infrastructure.
• Identify, evaluate, and prioritize risks using a community-
based risk assessment process.
This process should account for threats, vulnerabilities, and
consequences associated with system
assets. To identify and assess vulnerabilities in their own
systems, PSAP administrators should
work closely with all partners with whom they interconnect,
such as service providers, neighboring
jurisdictions, and other agencies in order to identify the full

architecture of their system and assess
it for physical and network vulnerabilities. This assessment
should also include a review of their
current processes and standard operating procedures against
available government and industry
cybersecurity best practices and standards.
• Develop mitigations. An examination of the likelihood and
consequences of attacks should help
to prioritize and inform mitigation strategies. Using both
prevention and detection techniques,
administrators should strive to negate or decrease the impact of
an attack. Researching available
mitigation techniques and employing them in a prioritized
fashion will produce a comprehensive
cybersecurity solution.
• Solidify Response and Recovery actions. Establishing a
CSIRT and developing incident
response plans, policies, and capabilities for the networks,
personnel, and user equipment can
prevent expansion of the event, mitigate its effects, and
eradicate the incident. These efforts should
be supported by regular training and exercises and coordination
with external parties so that all

participants are aware and capable of their role during and after
an event.
11
Once risks are identified and protection mitigations are in place,
the NG911 community has an
opportunity to focus on detection and advance planning.
Instead of focusing on the individual
cybersecurity events and data recovery, an effective framework
uses data analytics in PSAPs, joint field
offices, and emergency operations centers to accelerate and
automate analysis, and to shift from a posture
of “what just happened, and how do we fix it?” to “what is
going to happen, and how can we prevent
it?” The NG911 community should remain in front of potential
cyber events through its ability to feed
relevant event data to emergency operation centers, fusion
centers, and cyber centers.
Resources
Table 3 provides a list of resources to assist NG911
administrators improving the cybersecurity posture

of their systems.
Organization Resource Name Description and Link
Department of
Homeland Security
(DHS)
Office of Emergency
Communications
DHS offers a collection of programs and initiatives that can be
applied to reduce NG911 cyber risks.
Many of these efforts support approved missions that cover
federal, state, and local users, as well
as public and private critical infrastructure entities.
http://www.dhs.gov/office-emergency-communications
National Cybersecurity and
Communications
Integration Center (NCCIC)
NCCIC is a 24/7 cyber monitoring, incident response, and
management center. Organizations can
leverage NCCIC’s United States Computer Emergency

Readiness Team (US-CERT) for cybersecurity
information and assistance.
http://www.dhs.gov/national-cybersecurity-communications-
integration-center
Federal
Communications
Commissions (FCC)
Legal and Regulatory
Framework for NG911
Services
An overview on the development and creation of a NG911
network that provides specific citations from
the FCC on statutory requirements and funding possibilities.
https://apps.fcc.gov/edocs_public/attachmatch/DOC-
319165A1.pdf
Communications Security,
Reliability and
Interoperability Council
(CSRIC)
CSRIC’s mission is to provide recommendations to the FCC to

ensure, among other things, optimal
security and reliability of communications systems, including
telecommunications, media, and public
safety. Guidance includes:
• Transition to Next Generation 9-1-1.
https://transition.fcc.gov/pshs/docs/csric/CSRIC-WG4B-Final-
Report.pdf
• Cybersecurity Risk Management and Best Practices.
https://transition.fcc.gov/pshs/advisory/csric4/CSRIC_WG4_Re
port_Final_March_18_2015.pdf
Task Force on Optimal
PSAP Architecture
(TFOPA): Optimal
Cybersecurity Approach for
PSAPs
The TFOPA is a federal advisory committee chartered under the
Federal Advisory Committee Act to
provide recommendations to the FCC regarding actions that
PSAPs can take to optimize their
security, operations, and funding as they migrate to NG911.
https://transition.fcc.gov/pshs/911/TFOPA/TFOPA_WG1_FINA
L_Report-121015.pdf

National 911
Program 911.gov
911.gov is a comprehensive resource for all things related to
NG911. The website includes a
resource center with an information clearinghouse, a Technical
Assistance Center, and a 911 profile
database for tracking the progress of 911 authorities around the
Nation in enhancing their systems
and deploying NG911 capabilities. www.911.gov
National
Emergency Number
Assoc. (NENA)
Standards (including i3 and
NG-SEC)
NENA’s website contains a complete archive of all its 911
standards, including those related to
NG911, such as NG-SEC standard (NENA 75-001).
National Institute of

Standards and
Technology (NIST)
Cybersecurity Framework
The NIST Cybersecurity Framework is a prioritized, flexible,
repeatable, and cost-effective approach
that can help NG911 system administrators manage
cybersecurity-related risk.
Recommendations on
Cybersecurity (Special
Publications 800/1800
Series)
NIST’s 800 and 1800 series provides targeted cybersecurity
guidance and are strongly encouraged to
be incorporated into cybersecurity planning.
http://csrc.nist.gov/publications/PubsSPs.html#SP800
Table 3: NG911 Resources
http://www.dhs.gov/national-cybersecurity-communications-

integration-center
https://apps.fcc.gov/edocs_public/attachmatch/DOC-
319165A1.pdf
https://transition.fcc.gov/pshs/docs/csric/CSRIC-WG4B-Final-
Report.pdf
https://transition.fcc.gov/pshs/advisory/csric4/CSRIC_WG4_Re
port_Final_March_18_2015.pdf
https://transition.fcc.gov/pshs/911/TFOPA/TFOPA_WG1_FINA
L_Report-121015.pdf
http://www.911.gov/
http://csrc.nist.gov/publications/PubsSPs.html%23SP800Cyber
Risks to Next Generation 911Cyber InfrastructureThe NG911
Cybersecurity Risk LandscapeImproving NG911 Cybersecurity
PostureIdentifying and Assessing RisksMitigating Risks:
Protect and DetectActions for Improving NG911
CybersecurityResources
MGG 303: The Business Report
Pre-Writing Worksheet
Topic:

What local business did you write about in your report?
What kind of business is it? How long has it been established?
Where is it located/ headquartered?
What goal or problem might you identify in your business report
and why?
Organization:
Does the draft have a title that reflects the focus of the report?
Is there an executive summary in the beginning that summarizes
the content of your report? Do you make clear recommendations
at the end of the report?
Are your sections clearly labeled and do they reflect what is
expected given the genre? Do these match up with those in
Cardon’s Business Communications?
What are the titles of the sections? Are they easy to navigate?
Are the sections organized logically?

Research:
What kind of information will be necessary to include in your
report?
Where do you expect to find sources for this project? What
kinds of sources will you be looking for?
What key words will you use to search for sources for this
project?
Citations and Formatting:
Are all sources included in the works cited page?
Do you have an in-text citation for each source?
Do you include an in-text citation every time you use
information that you gleaned from a source?
Did you use OWL at Purdue or another up-to-date reference
guide for academic citation?

Note the information for your sources:
Source 1
Title:
Author:
Kind of source:
Why you might use it:
Source 2
Title:
Author:
Kind of source:
Source 3
Title:
Author:
Kind of source:

Source 4
Title:
Author:
Kind of source:
Investment in The East Aurora Co-op Turns Healthy Heads
MGG 303: The Business Report
By: Mindy Lahiri
Executive Summary
The East Aurora Cooperative Market (East Aurora Co-op)
started as an idea, then grew to a community of supporters,
which allows civilians the possibility to have a stake within the
company. Establishing personable, and credulous relationships
with producers and consumers potentially may determine the
fate of any cooperative market. This popular modern store has
gained its successful reputation within the community, and is
financially making a statement for towns with an interest in
starting a co-op. The East Aurora Co-op is most appealing to
the local, healthy, and organic food shopper, where they can get

all healthy beverages, snacks, or meals they need, instead of
going to a large grocery store. The East Aurora Co-op has been
very successful due to the distinctive location and upper
middle-class populace. To keep attracting customers,
relationships between consumers and producers must only
increase to progress with rise in revenue. “The findings show
that long-lasting relationships (i.e., recurring transactions with
the same seller) can and do exist in an apparently competitive
market” (Haugland).
Background
Reputation and support determine the destiny of any cooperative
market; the East Aurora Co-op is prevailing with their noble
status, and almost endless support. Substantial financial backing
was received to support the development. There are many
dedicated owners and contributors who made, and will continue
to make the company prosperous. The East Aurora Co-op
needed $2 million to be created, and they were still seeking
about $200,000 to improve the establishment in 2016 (Schanz,
2016). The construction phase costs almost doubled from the
initial estimate. R&P Oakhill was one of the contractors which
stood out from the rest, and was a huge reason the market was
established (Investment, 2018). The East Aurora Co-op also
earned its success by having a large enough store to occupy the

essential consumer foods, so during peak purchasing times,
items do not run out. One of the most powerful quotes gained
from the Ohler article, was from Shelia Conboy, who is the
Business/Project Manager at the East Aurora Co-op, stating,
“We’re coming back around to a time years ago when
consumers understood where their food came from, when they
understood that a dollar spent on local food not only fed their
family well but benefited the local and regional economy”
(Ohler, 2018). This statement is the forefront to the business
plan and idea of why the East Aurora Co-op was initiated. Other
than the knowing of the quality of the produce, and where it
comes from, the investment and member benefits, are also a
strong motivation for citizens to join this company’s
community. The Food Co-op Initiative (FCI) has a website
explaining their organization, which is non-profit, and
recognizes awesome cooperative market success from around
the United States. The seven principals to be acknowledged of
the FCI are; 1) Voluntary and open membership, 2) Democratic
member control, 3) Member economic participation, 4)
Autonomy and independence, 5) Education, training, and
information, 6) Cooperation among cooperatives, and 7)
Concern for community. These seven principals are seen to be
highly respected as it was additionally used in the
Buffalospree.com article. The East Aurora Co-op was granted
the “Startup of the Year’ award for 2017, being one of “new

food co-ops that have done an outstanding job of organizing
their communities, building ownership, and following strong,
viable business plans” (Food, 2017). The leadership that the
East Aurora Co-op has demonstrated gives inspiration to other
co-ops to follow their standards. The FCI started 10 years ago,
and has contributed to 10 co-op’s being started, however they
are planning on contributing to 135 more co-ops in 2018. These
contributing details gives a scale, for which the FCI has
experience with other startup co-op’s (Food, 2017).
Consistency Looks Good for Investment
Keeping proactive to maintain reliable increases in revenue,
requires members who will stay loyal purchasing goods from
the co-op, and a continuous supply of those desired goods
available. Investors have the chance to capitalize with their own
money, and help keep the currency in their own community,
moreover letting the local’s benefit. The sales for the first year
marked $2.34 million, which was way beyond what was
expected (FCI, 2017). This fact is supplemental to the investors’
projections, and is reassuring to any consumer that the
anticipated growth will succeed as long as consistency remains.
Unsuccessful co-ops usually do not have a large enough store,
or enough monetary support to start or operate productively
(Reid, 2016). Having a larger than usual floorplan, ensures the

co-op’s probability of success. Shelia Conboy stated that items
were “flying off the shelves,” and that she wants “to be able to
restock that and just have a really solid beginning so that we
can sustain this great, great store” (Schanz, 2016). Not
continuously restocking items available to customers may
promote loss of trust and revenue, which could be detrimental to
their future. Satisfying adequate management which encourage
building relationships with clients may be essential for co-op
achievement. Without steady forthcoming revenue, stock could
be doomed. Realizing the statistics of a publicly traded entity
makes financial investment results sensible.
Local Consumer Reactions
Consumers seem to be tremendously satisfied with the
result of the East Aurora Co-op, anticipating continuous support
to the newly developed society it has created within the
community. Being able to be a shopper, and investor to the store
in which you eat from, has created the upmost loyalty and
appreciation for the co-op marketplace by the local citizens.
The East Aurora Co-op is making it easier and more reliable for
customers to obtain the healthy and organic foods they want,
rather than going to a large supermarket. Super markets are not
as trustworthy when it comes to healthy foods, because they
offer an array of different types of foods that aren’t as easy to

decipher which ones are healthy, and which are not. A “busy
mom” named Suzanne Lewke told the reporter from News 4,
“We pay attention to all the ingredients that are in our food, so
we like to be able to have a choice, have a say in what’s being
provided for us to eat.” The co-op seems to be much more
satisfied with local producers, rather than profit margins, and
lets the members decide what should be on the shelves. The East
Aurora Co-op has persisted with being an inspiration to their
local community, and have created incentive for other towns
with a similar vison, to gain comparable accomplishment’s. This
impactful, thriving cooperative market, has dominated the
anticipated revenue prediction and should keep the consistent
growth flourishing. Consistently improving trustful connections
with local producers and consumers will forever be crucial for
success.
Works Cited
"East Aurora Co-Op Market Named 2017 Startup Of The Year |
Food Co-Op Initiative." Food
Co-Op Initiative, 2017, https://www.fci.coop/east-aurora-co-op-
market-named-2017-startup-year/. Accessed 22 Feb 2018.
Haugland, Sven A. and Kjell Gronhaug. "Cooperative
Relationships in Competitive Markets."

Journal of Socio-Economics, vol. 25, no. 3, Sept. 1996, p. 359.
EBSCOhost,
search.ebscohost.com/login.aspx?direct=true&db=a9h&AN=961
0242986&site=ehost- live&scope=site. Accessed 22 Feb 2018.
"Investment Details - East Aurora Co•Op Market." East Aurora
Co•Op Market, 2018,
http://eastaurora.coop/capital-campaign/investment-details/.
Accessed 22 Feb 2018.
Ohler, Rick. "East Aurora Cooperative Market."
Buffalospree.com, 2018,
http://www.buffalospree.com/Buffalo-Spree/April-2011/East-
Aurora-Cooperative- Market/. Accessed 22 Feb 2018.
Reid, Stuart. "Why Some Co-Ops Fail | Co-Op Grocer
Network". Grocer.Coop, 2016,
https://www.grocer.coop/articles/why-some-co-ops-fail.
Accessed 22 Feb 2018.
Schanz, Jenn. "East Aurora Welcomes Co-Op Market."
Wivb.Com, 2016,
http://wivb.com/2016/06/11/east-aurora-welcomes-co-op-
market/. Accessed 22 Feb 2018.

Spencer Hastings
Ms. Kellie Sharp
MGG 303: Communication Literacy for Business
05/05/2018
Business Report on The Martin Group
The Martin Group
Report Question:
Should “The Martin Group” expand beyond Western New York
such as southern states of America, in order to explore new
territories and cultures?
Executive Summary
The Martin Group is a private branding and marketing agency
with its headquarters situated in Downtown Buffalo, New York.

The Martin Group was founded by Tod D. Martin in 2001. It is
a well acclaimed agency in Western New York, with two
locations, one in Buffalo and the other in Rochester. The Martin
Group has a wide variety of departments ranging from Research
Strategist to Public Relations, Web Development, Social Media
and Operations. The creative layout of the agency attracts their
client base. It lies in the layout of the company as it offers a
variety of fields to explore in the marketing agency. Upon
taking a look at their website, it becomes clear that they have
been up-to-date with current matters and flexible with creativity
in their content.
They have a wide network of client base such as Insurance
Companies, Medical Groups, Housing, Banks, Eateries, Fashion
and even Athletic clubs. This wide range of variety speaks a lot
about their diversity and ability to juggle different work
cultures and meet the needs of varied disciplines. They toil with
ideas that inspire action, emotion and loyalty; which is a
healthy combination of creative liberty as well as adhering to
workplace and cliental ethics. This is portrayed by the
numerous awards that the group has received on a local as well
as global stage, in respect to their work and client base.
As Martin Group is expanding to the next stage of operations,
this report is suggestive to the same cause and promotes out-
house expansion rather than using resources for in-house

improvement as that has already been well accepted and
awarded by their clients.
Introduction and Accomplishments
In 2013, The Martin Group moved to a newly renovated
building at 620 Main Street in Buffalo. They completed the
project for 2.3 million dollars, which speaks a lot about their
importance to an updated work environment. The vision of The
Martin Group lies in the power of creativity that is well-
executed with strategic communications. In the recent addition
to two locations, The Martin Group has launched their non-
profit vertical. They aim to combine their efforts of
strategically branding and fundraising for regional non-profits.
· The Martin Group has won several awards in the past such as
five golds and twenty silver awards in the local Addy Awards.
Addy Awards are America’s advertising industry’s largest and
most representative competition award for the best marketing
industry locally and globally. (American Advertising Awards)
· Furthermore, the Vice President of the group was presented
with the Buffalo Business First’s 2017 “40 under 40” award,
which is a local Rochester award. (Fink)
· They also received professional and community recognition
from Perry’s Ice Cream, as it selected “The Martin Group to be
there “Agency of Records” for the company’s 100th anniversary

promotional campaign in 2018. (Hunter)
· The Martin Group is widely acclaimed for its non-profit wing
of work and they believe in the motto “community work for
community benefit” (Hanks). For example, they have paired
with Catholic Charities, WNY Women Foundation the YMCA
and many more. Combining strategic fundrasing and branding
has been a rewarding experience for The Martin Group.
· In June 2017, they also won thirty-one PRSA Buffalo
Niagara’s Excalibur Awards for Public Relations. It is rightful
to say that The Martin Group is one of Western New York’s
“Fastest Growing” and “Most Admired” companies, with the
tagline “a different brand of thinking” that accurately
encompasses the work of the agency. (Fink)
What Next for the Martin Group?
The Martin Group has made an active decision in establishing a
new Albany office for the agency. The last words on this are
still in process by the firm as they tackle the red tapes and make
an official announcement. It would be very surprising to learn
the fact as the company recently invested 2.3 million dollars for
their Buffalo office renovation. The next new project that The
Martin Group is an active participant in social moderation,
which means they are flexible in changing their layout in
respect to modern requirements. This culture of the company
has led them to amend their company’s motto from time to time,

to be the most appropriate with the current societal trends of
creativity. They have been working on their growth by
expanding to Rochester, acquiring Travis Collins and merging
with Martin Davison Public Relations. (Fink) With all the new
accomplishments, the group now looks forward to building an
even stronger brand identity as they work to “uncomplicate a
complicated business”. They are working on making their
business flexible for the smaller business downtown to the
larger clients across the country.
Recommendations
According to the past accomplishments and the newer projects
that The Martin Group is looking to invest in, I believe some of
these recommendations would create a stronger brand
positioning and a better brand awareness for the group.
1. Expansion to newer location: If the Martin Group focuses on
expanding to a new territory, apart from Western New York, I
believe that this would foil new experiences for the group as it
has been well accepted in the Western New York Territory and
does have the clientele in vast fields of work. Hence it could be
a profitable investment on their front as most of their client
base is located in southern states of America, and to be closer to
the client would increase their business.
2. Strengthen Brand awareness: With social media advertising
it is needless to say that advertising has a whole new zone of

promotion, and according to my research, most of the agency’s
cliental are brand loyal and have been working with them for 20
plus years. This highlights the fact that to gain the attention of
newer business and reach out to a wider audience, they need
newer strategies to improve their brand awareness upbeat.
3. Benefits of a Public Company: As the Martin Group is a
successful private limited firm, it is missing out on the merits of
having a public recognition on the financial stands. If they were
to convert to a public holding, they could list on the stock
market, which is a better access to capital from internal and
external investors and the shareholders would be able to buy
and sell their shares. Hence assuring a wider presence in the
industry. For example, Omnicom Group Inc. is an American
global marketing and corporate communications holding
company. They went public in 1996, and that was a huge step as
now their revenue is over 15 billion dollars and are at an all
time high of 75 dollars. (The Wall Street Journal) This has
proven to be very important and profitable step for this
advertising group and could also help The Martin Group in
making a global presence.
4. Benefits of shifting focus to Southern Territories: This can
prove to be a very important initiative on behalf of The Martin
Group. It is suggestive to expand into newer locations in
Southern America such as Tennessee, Kentucky, South Carolina
and so on. This would be very cost-effective as well give the

agency a newer platform to spread its roots. One of the reasons
to expand in these states is that they have majority of their
clients from these areas, which would give them an opportunity
to work in close proximity with their clients.
Conclusion
In a nutshell, from all the information provided and inferred to
us that The Martin Group, is in fact a thriving marketing and
advertising agency in Western New York. It is one of the
highest earning, privately owned company. It has built a
reputation, which is very transparent in their relationships with
their clientele. We have seen brand loyal clients such as Perry’s
Ice Cream, Canisius College and several bigger brands around
Buffalo and Rochester. The fairly new Non-profit wing does a
great justice to brand development, as it is one of the very few
marketing firms that invest in a non-profit strategic branding
program. The Martin Group is a very well-established firm, but
it does need to challenge their geographic positioning, and also
indulge in newer ways of advertising, which could deem to be
profitable in the future. Therefore, keeping the recognition and
recommendation in mind, The Martin Group can feasibly reach
newer heights with their vast networking and client base.

Work Cited
American Advertising Awards,
2016,http://www.americanadvertisingawards.com/.
Accessed 12th February, 2018.
Dairy Business News, 8th November 2017,
www.dairybusiness.com/perrys-ice-cream-selects-the-martin-
group-as-strong-strong-agency-of-record-for-companys-100th-
anniversary-communications-campaign/. Accessed 12th
February 2018.
Fink, James. Buffalo Business First, 2016,
www.bizjournals.com/buffalo/news/2016/02/17/the-martin-
group-closes-on-620-main-deal-for-new.html?s=print. Accessed
13th February 2018.
Hanks, Kelsey. Martin, 18th November, 2017,
https://www.martingroup.co/answering-great-need-great-ideas/.
Accessed 12th February, 2018.
Hunter, Meg. Martin,
2001,www.martingroup.co/expertise/.Accessed 12 February
2018. Mcdonnell, Meghan. CannonDesign, 1947,
www.cannondesign.com/our-work/work/the-martin-group/.
Accessed 12 February 2018.
The Wall Street Journal, 2018,https://quotes.wsj.com/OMC.
Accessed 7th May, 2018.
www.bizjournals.com/buffalo/blog/morning_roundup/2014/05/m
artin-group-expands-to-rochester.html. Accessed 12th February

2018.
Sophia’s Restaurant, Buffalo, NY
Dear esteemed customers, at Sophia’s Restaurant we would like
to thank you for your continued support and loyalty throughout
the years. Our goal has and will always be to deliver impeccable
service that satisfies the dining needs for all our customers. In
keeping up with this goal, we have introduced a variety of new
menus and made some innovative changes to our customer care
services. On our new menu include:
Baked bread
Swedish pancakes
Fruit Omelette

Beef Burger with deep fried bacon
Variety of salads
Breaded pork tenderloin
Variety of chicken dishes
Fried Steak
We have a children’s menu and a senior menu to meet the needs
of all of customers. We have also extended our menu to include
specific diet-friendly, gluten free, vegan, and organic meals
(tripadvisor.com, 2018).
Our array of organic meals
We provide our employees with training. This training equips
them with the relevant skills and competencies that they require
to deliver impeccable customer service. The major topics that
we emphasize for training employees include etiquette,
effective communication, appearance, knowledge of menu, and

diversity awareness (Davis, Lockwood, Pantelidis, & Alcott,
2013). Our Staff members are friendly, warm, responsive, and
attentive to the needs of all customers. We also strive to hire
great chefs with vast experience in preparing the best foods for
our customers.
Our esteemed chefs
We additionally provide free internet access via our strong Wi-
Fi network and have ample parking space at the restaurant. In
addition, we have invested in up-to-date technologies including
a state-of-the-art POS system that eases the work for our staff
members and increases convenience to our customers. At
Sophia’s, we aspire to live up to our motto, “Finger Licking,
Delicious Meals for All”.
Our Finger Licking, Delicious meals
We look forward to serving you again. Thank you very much.

1 Cyber Risks to Next Generation 911 The advent of Next .docx

Recommended

Recommended

More Related Content

Similar to 1 Cyber Risks to Next Generation 911 The advent of Next .docx

Similar to 1 Cyber Risks to Next Generation 911 The advent of Next .docx (20)

More from oswald1horne84988

More from oswald1horne84988 (20)

Recently uploaded

Recently uploaded (20)

1 Cyber Risks to Next Generation 911 The advent of Next .docx