/01How the plan works
The MEL’s Cyber Risk Management Plan grew out of minimum technology standards developed with Rutgers Bloustein Local. It sorts controls into three levels, each building on the one below. The Cyber JIF used to call them tiers, and now calls them Deductible Reduction Groups.
As of January 1, 2026, every member is covered, and the per-claim deductible is $50,000 plus 20% coinsurance of the next $150,000, up to $80,000 out of pocket. Members who comply with the security controls become eligible for a reduction:
| Group | Deductible reduced to | Savings |
|---|
| Basic Security | $35,000 | Up to $45,000 |
| Intermediate Security | $20,000 | Up to $60,000 |
| Advanced Security | $0 | Up to $80,000 |
A municipality adopts the policies each group calls for by resolution of its governing body, puts the controls in place, and keeps the evidence.
/02What the controls cover
The Cyber JIF’s framework asks for controls across these areas, and each level asks for more:
- Asset and data management, including inventories
- Account management and multi-factor authentication
- Vulnerability management and regular patching
- Cyber hygiene, including phishing exercises and security training
- Incident response plans and business continuity policies
- Network penetration testing
/03Basic Security
| Control | What it asks |
|---|
| Backups | Daily incremental backups with at least 14 days of versions on an off-network device, weekly off-network full backups, monthly spot checks, and the same standard for third-party application data. |
| Patching | Operating systems and applications kept current, automatic updates where possible, and security patches installed promptly. |
| Defensive software | Antivirus and firewalls on every desktop and laptop, antispam and antivirus on email, unused firewall ports closed, and firewall rules reviewed twice a year. |
| Training | At least one hour a year for every computer user, covering passwords, spotting incidents, social engineering and business email compromise. |
| Passwords | A password policy that meets the MEL’s Master Technology Policy. |
| Email warnings | An automatic label on every email from outside your organization. |
| Incident response plan | A cybersecurity incident response plan adopted by management or the governing body. |
| Technology policy | A technology practices policy adopted with the Basic Security items from the Master Technology Policy. |
| Memberships | Registration with the NJCCIC and the MS-ISAC. |
/05Advanced Security
| Control | What it asks |
|---|
| Network segmentation | Critical units such as finance, police and utilities separated on the network, to slow an attack’s spread. |
| Multi-factor authentication | MFA for remote access, and for third-party applications that pass or store protected or financial information. |
| Remote access policy | A remote access policy that requires MFA. |
| Password integrity | A way for employees to check their credentials against a breach service such as Have I Been Pwned. |
| Log review | Logs reviewed every three months by an IT professional. |
| Third-party risk | The MEL’s third-party risk assessment tool used when issuing or renewing vendor contracts. |
/06Adopting the Deductible Reduction Groups by resolution
- AssessCheck where you stand against each group, control by control.
- Close the gapsStart with Basic Security, then work up.
- Adopt the policiesYour governing body adopts the required policies by resolution.
- Keep the evidenceBackup logs, training records, access reviews and the plans themselves.
- Tell your JIFLet your risk management consultant know which groups you have met.
- Reassess yearlyAnd again before your policy renews.
/07A note on versions
The group names and deductibles come from the MEL’s 2026 Renewal Overview. The control lists follow the tier standards as presented to League of Municipalities members in June 2022, which reference version 2.2 of the MEL’s Master Technology Policy, with Tier 1, 2 and 3 shown here as Basic, Intermediate and Advanced Security. The Cyber JIF has said it will post an updated framework with the new deductible structure, so confirm the current requirements with your JIF before your governing body adopts them.
/08How we help
We assess your town against each Deductible Reduction Group, close the gaps through MSSP++, run the annual training Basic Security requires, and document the standards so your governing body can adopt them by resolution. For Advanced Security, our SOC reviews your logs continuously rather than every three months. The result is insurance compliance. See what insurers and the law ask for.
