Billings Mandates Annual and Monthly Cybersecurity Training for All City Workers

The City of Billings now requires every employee to complete both annual and monthly cybersecurity awareness training through either computer-based modules or instructor-led workshops.

City officials adopted the rule as part of the 2025 IT Cybersecurity Policy Manual posted on the municipal website. The timing follows documented incidents in which email accounts belonging to the police and fire chiefs were breached and used to send phishing messages to staff and residents. Those events prompted a fresh review of internal protections for city networks and public-facing systems.

Billings IT staff have already applied for a $90,000 FEMA grant to support a three-phase project aimed at hardening those networks. Local healthcare providers, including the Advanced Care Hospital of Montana, have also reported significant patient-data incidents in recent years, underscoring the shared risk across public and private organizations in Yellowstone County.

What Employees Must Complete

Under the policy, training occurs on a set cadence: one full annual session plus shorter monthly refreshers. Workers can fulfill the obligation through self-paced online courses or by attending scheduled in-person classes run by the IT department. The manual specifies that completion records will be tracked centrally to ensure compliance across all departments.

Job seekers applying for city positions should expect questions about prior cybersecurity training during the hiring process. Professionals already on staff will see the sessions integrated into regular work calendars, with supervisors responsible for confirming attendance. The approach mirrors similar requirements now common in Montana state agencies and regional hospitals.

Practical Steps for Billings Professionals

Workers and job candidates can prepare by reviewing basic phishing recognition and password-management practices ahead of the scheduled sessions. Montana State University Billings continues to run its annual Cybercat Hacking Academy summer camps, which introduce students and early-career professionals to ethical hacking skills that align with the city’s emphasis on awareness.

City officials have not announced an exact start date for the next training cycle, but the policy manual indicates the program is already in effect. Employees who miss a monthly session must arrange a makeup through their department IT contact. The requirement applies uniformly, from administrative staff to field crews, reflecting the city’s view that every account represents a potential entry point for attackers.