City governments face a growing array of threats from cyberattacks targeting city-owned and operated information systems. But even more worrisome, as cities shift to cloud-based IT solutions for everyday tools and integrate “smart” capabilities into IIJA-funded infrastructure systems, software supply chains are becoming increasingly complex. Critical information systems used by cities often depend on integrations with third-party components and services whose risks are poorly understood.