Emergency Services and NG911 Security Guide: Protecting PSAPs, CAD and ESInets

When a 911 centre loses its computer-aided dispatch system or its phone lines are flooded, the cost is measured in delayed ambulances and police responses, not lost revenue. Public safety answering points (PSAPs), also called emergency communications centres (ECCs), are moving from analogue trunks to Next Generation 911 (NG911): IP networks called ESInets, SIP call delivery, and shared core services run by states, regions and vendors. That move widens the attack surface just as ransomware and telephony denial of service (TDoS) have become routine. This guide covers the US regulatory and standards picture (FCC NG911 rules, NENA i3 and NG-SEC), the threats specific to 911, how to protect CAD and ESInet connections, and how to keep answering calls when systems fail. It is for PSAP directors, 911 authority IT and security staff, and vendors supporting them. It assumes the criminal justice data rules covered in the CJIS Security Policy Guide and does not repeat them.

Key takeaways

• NG911 is a security change, not just a telephony upgrade. IP delivery, shared ESInets and cloud-hosted call handling replace isolated trunks with networks that must be authenticated, monitored and segmented.
• The FCC now drives IP delivery to 911 authorities. FCC 24-78 requires originating service providers to deliver 911 traffic in SIP format, then in NG911-standard format with embedded location, within set periods after a valid request.
• NENA NG-SEC is the security baseline. NENA-STA-040.2-2024 sets minimum security requirements for NG911 entities, with a 2025 audit checklist and a NIST CSF 2.0 crosswalk to measure against.
• Ransomware usually arrives through the municipal network. Dallas in 2023 showed CAD going down and dispatchers writing reports by hand after attackers used stolen credentials on a city server.
• Plan to operate without computers. CISA's 911 guidance stresses manual operating procedures, hard-copy plans, overflow agreements with neighbouring PSAPs and tested offline backups.

Why emergency communications are different

Emergency communications combine availability requirements stricter than almost any other sector with small, often municipal IT teams. Several features change how security work is done:

• Availability first: a PSAP cannot take systems offline for patching during a busy shift, and an incident response step that cuts the network also cuts call handling. Every control must have a fallback that keeps calls flowing.
• Shared infrastructure: ESInets are often run by a state or regional 911 authority, with call handling, CAD, mapping and logging supplied by vendors and hosted in data centres or cloud. Responsibility is split across many contracts.
• Connections to policing data: CAD and records management systems (RMS) connect to state criminal justice networks, so CJIS requirements apply to parts of the environment.
• Public inputs: anyone can call or text 911, and NG911 adds multimedia and data from devices, sensors and crash notification systems. The input channel cannot simply be closed.
• Municipal dependencies: many PSAPs sit on city or county networks and share directory services, email and remote access with other departments. CISA's guidance warns that compromised city networks can affect connected emergency services systems.

The regulatory and standards landscape

This section summarises US federal rules and national standards as at 27 October 2026. State 911 laws, funding conditions and procurement rules add further requirements and are not covered.

The FCC order defines NG911 as a system that must be secure and interoperable, but the order itself is about delivery, routing, location and cost, not a detailed security regime. Security requirements come from NG-SEC, state programmes, CJIS for criminal justice data, and contracts. Cost demarcation also matters: under the order, originating providers bear the cost of delivering to the NG911 Delivery Points unless a state or local authority sets another arrangement, which makes those points a natural place to define security responsibilities in agreements.

Threats to PSAPs and NG911

CISA's TDoS case study describes one PSAP that faced up to 12 TDoS attacks per day in 2020 and 2021. See the VoIP and SIP Security Guide and the STIR/SHAKEN Caller ID Authentication Guide.

Lessons from incidents

The 2023 ransomware attack on the City of Dallas shows how a municipal compromise reaches emergency services. BleepingComputer reported Royal ransomware notes printed on city printers in May 2023, and that 911 dispatchers had to handwrite reports for officers instead of using CAD. The city's after-action report, as reported in September 2023, said attackers used stolen credentials to reach a city server from 7 April and launched ransomware on 3 May, encrypting 230 servers and 1,168 workstations, with at least 30,253 people's data exposed. Its recommendations included better backup and restoration and replacing unsupported software. Two lessons stand out for PSAPs: credentials on the shared municipal network were the path, and CAD continuity depended on manual procedures. See the Royal and BlackSuit Ransomware Profile Guide.

Securing CAD, call handling and the ESInet

Network design

• Separate 911 from municipal IT: CISA's guidance is to keep emergency communications separate from the municipal administrative network. In practice that means separate network segments, separate admin accounts and no shared domain trust for call handling and CAD where possible.
• Control the ESInet edge: NG911 designs place border control at the ESInet edge to filter SIP and data traffic from originating providers and other networks. Treat it as you would an internet perimeter, with logging and rate limits.
• Use the PKI: i3 version 3 uses a PSAP Credentialing Agency as a root of trust for certificates between functional elements and agencies. Plan certificate issuance, renewal and revocation for every element and agency that connects.
• Diverse paths: provide diverse, redundant connections to the ESInet and hosted services, because a single circuit loss is an outage.

Identity and access

• MFA everywhere it can work: CISA recommends MFA for privileged actions and sensitive data and checking configurations so MFA does not "fail open". For call-taker positions, use methods that work at shift speed, such as smart cards or FIDO2 keys, rather than phone prompts.
• Dedicated admin workstations: administer CAD, call handling and ESInet elements from hardened admin workstations, not from desktops used for email and browsing. CISA identifies browsing, personal email and USB use on CAD or RMS workstations as infection paths.
• Service accounts and interfaces: CAD integrates with RMS, mobile data terminals, automatic vehicle location, state criminal justice systems and alerting. Inventory these interface accounts and API credentials, give each its own identity and rotate them on staff and vendor changes.
• Vendor access: include vendor responsibilities and data handling in contracts, as CISA recommends, and route all vendor support through a recorded, approved channel.

For identity programmes across local government, see the Local Government Identity Security Guide.

Implementation roadmap

1. Assess: inventory hardware, software and network connections, then assess against NG-SEC using the NENA Security Audit Checklist. Record which controls belong to the PSAP, the 911 authority, the municipality and each vendor.
2. Quick wins: MFA on remote and admin access, removal of internet-exposed management interfaces (CISA's no-cost Cyber Hygiene scanning helps find them), separation from municipal email and browsing on CAD positions, and offline backups.
3. Continuity: write and exercise manual operating procedures, keep hard-copy plans and contact lists, and sign continuity agreements with neighbouring PSAPs for overflow call handling. Test failover to backup PSAPs and alternate routing at least annually.
4. NG911 transition: as Phase 1 and Phase 2 requests go to providers, define security requirements at NG911 Delivery Points and in ESInet contracts: logging, border control, certificate use and incident notification.
5. Monitoring: bring ESInet edge, call handling, CAD and identity logs into a monitored SIEM, through the 911 authority, a state SOC or MS-ISAC services if the PSAP cannot staff one.
6. Exercise and improve: run tabletop exercises covering ransomware during a major incident and a TDoS attack, then a hotwash and plan update. See the Tabletop Exercise Guide.

Decision guidance

• Small PSAPs on a county network: push for a separate segment and accounts, rely on the state 911 authority's ESInet services and monitoring, and focus local effort on backups, MFA and manual procedures.
• Regional or state 911 authorities: own the NG-SEC baseline, the PKI and edge controls for every connected PSAP, and set contract security terms for core service vendors.
• Hosted or cloud call handling: reduces local server exposure but moves risk to identity, connectivity and the provider. Require evidence of the provider's controls and a tested plan for loss of the cloud path.

Detection, response and measurement

• Call pattern monitoring: track call volumes per trunk and per originating network, abandoned calls and repeated callers, so TDoS is spotted early. Keep detailed records of attacks with dates, times and frequency, as CISA advises.
• Identity signals: failed and unusual logins to CAD and admin systems, new remote access sessions and changes to privileged groups.
• Edge and core: SIP rejects and floods at the border, certificate failures between elements, and configuration changes to routing.
• First response: CISA's guidance is to disconnect affected devices from the network rather than power them off, preserve logs and volatile evidence, change admin credentials, and report to CISA, the FBI or IC3, and MS-ISAC. See the Ransomware Response and Recovery Guide.

Metrics:

1. Percentage of NG-SEC audit checklist items met, tracked quarterly.
2. Percentage of remote and privileged access to 911 systems protected by MFA.
3. Time to switch call handling to a backup PSAP or alternate routing, measured in exercises.
4. Age of the most recent tested offline restore of CAD and call handling.
5. Number of internet-exposed services found by external scanning, trending to zero.

Framework mapping

Common failure patterns

• CAD on the city domain: CAD servers and call-taker positions share a domain and admin accounts with the wider municipality, so one stolen credential reaches dispatch.
• Backups online and untested: backups sit on the same network and are encrypted with production, or restores have never been timed.
• No manual mode practice: procedures exist on paper but staff have not practised running dispatch on cards and radio, so an outage becomes a crisis.
• Overflow not contracted: neighbouring PSAPs are expected to help, but no agreement, routing or test exists.
• Persistent vendor tunnels: always-on vendor remote access into CAD and call handling with shared credentials.
• Ten-digit lines forgotten: NG911 protections cover 911 trunks, but administrative and non-emergency lines, which CISA says should be included, remain exposed to TDoS.

Practitioner checklist

• Assess the PSAP against NENA-STA-040.2-2024 using the NENA Security Audit Checklist and assign each gap an owner.
• Separate 911 networks and admin accounts from the municipal network and email.
• Enforce MFA on remote, vendor and privileged access, and check it cannot fail open.
• Keep offline, tested backups of CAD, call handling and mapping data, and time restores.
• Sign and test overflow and continuity agreements with neighbouring PSAPs.
• Agree TDoS detection, alternate routing and escalation with carriers and the 911 authority.
• Define security, logging and incident notification terms at NG911 Delivery Points and in ESInet contracts.
• Inventory CAD interface accounts and API credentials and rotate them on staff and vendor changes.
• Exercise ransomware and TDoS scenarios, including manual dispatch, at least annually.

Standards and references

• Federal Register: Facilitating Implementation of Next Generation 911 Services (FCC 24-78)
• eCFR: 47 CFR Part 9 Subpart J, Next Generation 911
• NENA: Standards and Documents (i3, NG-SEC, TDoS, spoofing mitigation)
• NENA: New version of the i3 NG9-1-1 standard
• CISA: 911 Cybersecurity Best Practices Package
• SecurityInfoWatch: Dallas ransomware, hackers used stolen credentials
• BleepingComputer: City of Dallas hit by ransomware attack

Related NHI Mgmt Group resources: CJIS Security Policy Guide · Cybersecurity for Local Government Guide · DDoS Protection Guide · Backup Security and Immutable Backup Guide. This guide summarises US NG911 rules and standards and is not legal advice.