Why Wipfli?
From strengthening infrastructure to creating new economic opportunities, government leaders must make decisions that support both immediate needs and long-term goals.
Wipfli’s tribal government advisory services help you navigate a more sustainable foundation for your tribe, with a team that serves over 300 tribes across more than 25 states.
Our professionals recognize that every tribe is a sovereign nation with its own priorities and values. We listen first, building a deeper understanding of your tribe’s journey so that we can help you apply tailored solutions that strengthen your community today while honoring your unique future vision.
Support transparency and accountability across your organization. Wipfli helps tribal governments meet audit requirements, strengthen financial reporting and provide leaders with insights to support informed decision-making.
Address staffing challenges with flexible access to experienced professionals. Our outsourcing for tribes offers scalable support for accounting, HR, payroll and technology so that internal teams can stay focused on serving members.
Navigate the complexities of energy incentives with confidence. Wipfli helps tribal governments evaluate energy projects, identify qualifying costs and maximize available funding opportunities to support community investment.
Wipfli provides comprehensive transaction support, including due diligence, valuation and buy-side and sell-side advisory to help you evaluate new opportunities with greater clarity.
Modernize the systems that support your community with Wipfli. We provide the solutions and strategy services tribes need to improve service delivery, strengthen data governance and increase operational efficiency.
Wipfli helps tribal governments strengthen strategic planning, improve organizational effectiveness and develop leaders who can carry their vision forward with our support for strategy, people and operations.
Wipfli’s risk advisory services focus on proactive, relationship-led support that helps you improve oversight and manage compliance obligations so that you can better safeguard community resources.
Align investment decisions with your tribe’s long-term priorities. We offer guidance to tribal governments on managing trusts and preserving financial resources for future generations.
Insights and resources
ARTICLE
AI governance for tribes: A guide for tribal leaders
Tribal leaders are increasingly integrating AI more deeply into their organizational operations. But leaders who don’t first establish AI governance expose their tribes to risks like data security issues, poor operational outcomes and financial losses. Keep reading to learn how AI governance helps tribes mitigate those risks, plus how to create an effective governance structure and AI policy to protect your tribe. Why do tribes need stronger AI governance? Without governance, tribes face the same risks as their non-tribal peers , like shadow AI, data privacy, bias or inaccurate outputs. But tribal leaders also carry the additional responsibility of navigating sovereignty issues and protecting tribal culture, as well as compliance challenges that are only likely to grow over time. Key AI risk management areas for tribes include: Sovereignty and culture: AI use could expose your tribe’s data, including member, cultural and historical data, to AI models without tribal consent, which risks not only member privacy but culturally disrespectful AI-produced content. Shadow AI: Unsanctioned AI use within tribal organizations can create issues with data privacy, costs and inaccurate information flowing up to leaders or your tribal council. Bias and poor output quality: AI trained on limited or inaccurate data may exhibit biases or output wrong answers, and even well-trained models still hallucinate. Cost overruns: As AI models increasingly move to usage-based pricing, it’s become possible to run up a large monthly AI bill without realizing it until it’s too late. Limited regulations: There is still no comprehensive federal AI law in the U.S., but states are enacting their own rules, and the EU AI Act is already in force, with obligations phasing in through 2027. Lack of ROI: AI initiatives that are poorly designed or implemented will cost money but lack impact (for example, a Gartner survey found 84% of finance organizations have implemented or plan to implement AI, but only 7% report high impact ). Many tribal organizations are also currently lagging behind the private sector in AI adoption, which, if not corrected, will make it harder to catch up. How does effective governance help tribes mitigate AI risks and improve outcomes? AI governance helps manage AI risks and improve outcomes by setting ground rules for how your tribal organizations use AI. Effective governance chooses AI tools, defines use cases and builds guardrails to protect your data and mitigate the risk of bad outcomes. Establishing governance typically starts with creating a governance team. Once formed, your governance team will choose AI governance pillars and create a formal AI policy that will help limit risky AI use and deliver better organizational results from your AI investments . AI governance should be an ongoing effort, with your governance team continuing to evaluate AI-related risks and opportunities. Guide your AI governance using policy pillars like these Before you can write your formal AI policy, you need to define key policy pillars. Each pillar covers a critical aspect of AI governance, including areas like fairness, reliability, privacy and vendor risk. Once you have a list of pillars, you can use it to help write your AI policy. Here are common policy pillars that may make sense for your tribe to build into your own AI policy: Fairness and bias management AI models can show bias towards individuals or groups based on certain characteristics like culture, ethnicity or gender. Assess how your AI tools are trained, as bias is especially likely for models that rely on smaller datasets. Reliability and validity With AI, input quality plays a major role in output quality. Evaluate whether you are giving your AI tools the clean, organized data they need, and regularly check AI outputs for errors. Sovereignty, privacy and security Sharing private tribal data with public AI models risks exposing that data to users outside your tribe. Set up controls to help ensure that tribal data is only shared with enterprise AI tools that are contractually bound to protect it. In vendor contracts, ask for explicit terms: No training on tribal data, no benchmarking and a full data export if you leave. Transparency and explainability Leaders should understand how AI models are being used within tribal entities. Conduct regular AI transparency and explainability reviews to make sure that’s the case. Accountability and oversight AI needs human oversight to manage risks, protect against bias and avoid damaging mistakes. Make sure your tribe has clear guardrails and defined oversight structures in place. As vendors embed AI agents directly into finance and ERP systems, govern each agent like an employee: Define what it can reach, who approved it and how to shut it off. Inclusiveness AI tools built on broad, diverse datasets are more likely to deliver outputs that reflect the broad range of human experience. This can help you not just avoid bias but actively promote inclusiveness. Legal and regulatory compliance Legal and regulatory compliance rules for AI are still in their infancy. However, tribes, specifically, should evaluate how AI could affect their existing compliance obligations and watch for future developments in this space. Vendor and third-party risk Your vendors are likely using AI too, which means that any tribal data you share with them could be at risk of being fed to public AI models . Regularly discuss this risk with your vendors and make sure they have their own responsible AI governance policies in place. Acceptable IP use AI outputs that draw on trademarked or copyrighted IP could create liability for your tribe. Be aware of this risk and train your employees to flag potential problem areas. Sustainability AI relies on resource-intensive, energy-hungry data centers to function. If your tribe has sustainability goals, you may want to restrict unnecessary AI use or buy carbon offsets. Again, this list is just a starting point. You may wish to include some or all of these pillars when writing your own AI policy, but you may also determine you need others not mentioned here. AI governance checklist: Follow these action steps to establish your tribe’s own AI governance process To establish an AI governance process for your tribe, you should create a governance team or working group. This group should define AI dos and don’ts, choose governance pillars and consider how AI will affect your tribe, its data and its operations. At that point, you can write your tribe’s formal AI policy. Here are key steps to follow when establishing AI governance: 1. Choose your AI governance team Establish a diverse group of tribal leaders, organizational managers and other stakeholders. This group should include a range of perspectives to help the group consider how AI affects your tribe, its businesses and its people. 2. Level set for AI knowledge Your whole governance team needs to have an active working knowledge of AI. Make sure everyone on the team understands the different types of AI, like agents or generative AI, key risks and how technology is evolving today. 3. Decide on AI dos and don’ts Define your AI dos and don’ts. This is essentially deciding how you want your tribal organizations to use AI, and what sort of usage is off-limits. For example, using an AI tool to help with grant writing or assist in conducting fraud checks may be a do, but delegating those tasks entirely to AI would be a don’t. 4. Select AI governance pillars that fit your needs Based on your do’s and don’ts, along with other considerations like compliance requirements or tribal culture, choose your AI governance policy pillars. Use the policy pillars list in the previous section as a starting point here and then adapt it to meet your tribe’s specific needs. 5. Collaborate with other stakeholders Your AI governance team needs to be able to make crucial governance decisions without getting bogged down, but it should also consult a wide range of stakeholders when possible. Open communication between your governance team, tribal leaders and employees within tribal entities will help ensure both more effective policies and stronger policy adoption. 6. Talk about any new oversight processes you may need Your governance team should create specific oversight processes for areas like AI monitoring or approving a new AI tool. These can then be included in your formal AI policy. 7. Clarify which AI tools are acceptable to use Clearly define which AI tools your tribal organizations are allowed to use. For example, you may want to state that tribal employees can only use enterprise AI tools your tribe has specifically contracted with, as those will protect your data. 8. Write your formal AI policy Turn your dos and don’ts, policy pillars, oversight ideas and acceptable tools list into a formal written AI policy. You can write your own policy from scratch, but you may also find it simpler to download a sample AI policy and adapt it to fit your needs. Read more AI for Tribes: Managing risk and maximizing impact AI ROI: How to get more business value from your AI spending AI risk management: Business strategy, governance and more
ARTICLE
Tribal Home Energy Rebate Program: A Guide for Tribes
The Tribal High-Efficiency Electric Home Rebate (HEEHR) Program gives federally recognized tribes and Alaska Native Corporations grants to help their communities reduce energy costs and modernize their homes. The application deadline is December 11, 2026. DOE reopened the program and extended the deadline in 2026 under Program Notice 26-3, which included updated rules, so a plan drafted under the earlier guidance needs a fresh look. If your tribe hasn’t yet acted, there is still time to claim its share. Keep reading to learn more about the grants and strategies your tribe can use to help ensure your community gets the most benefit out of the money. What is the Tribal HEEHR Program? The U.S. Department of Energy’s Tribal High-Efficiency Electric Home Rebate Program provides up to $ 218.5 million to Indian Tribes and Alaska Native Corporations to develop, implement and subsidize residential energy-efficiency, electrification and appliance-upgrade projects. The grant uses a formula-based allocation. Each tribe has a specific amount set aside for them. You’re not competing against other tribes for a shared pool. You simply need to apply and demonstrate that you have a plan to use the money effectively. Tribes can form a tribal consortium, which allows them to pool administrative funding and administer programs more efficiently. Tribes can join a consortium at any point prior to application submission, with approval from a Tribal Council Resolution or a Head of Government letter. What Tribal HEEHR money can be used for Tribal HEEHR funds are allocated to help low- and moderate-income households make energy upgrades to their homes. Rebates can cover up to full project costs for low-income households (less than 80% of the area median income) and up to half of project costs for moderate-income households (80–150% of the area median income). Individual homes are eligible for up to $14,000 in rebates. Here is a breakdown of the approved upgrades and of how much money is available for each: Improvement Maximum rebate Electric heat pump HVAC system $8,000 Electric circuit panel upgrade $4,000 Electric wiring upgrades $2,500 Electric heat pump water heater $1,750 Insulation, air sealing and ventilation $1,600 Electric stove, cooktop or oven, heat pump, clothes dryer $840 Restrictions of note include: Homes must use rebates for insulation and air sealing prior to installing heating and cooling upgrades, unless their insulation and sealing meet DOE and tribal standards. Rebates cannot be used to switch from a gas, oil or other fossil-fuel appliance to an electric appliance. They can be used to replace existing electric equipment with more efficient electric equipment. In practice, that means the $8,000 heat pump rebate applies mainly to homes that already heat and cool with electricity. Why tribes should pursue this funding now This is money that can help tribal members and the overall economy in your community. There is no reason to let the opportunity go to waste. When you put this money to work, the benefits could include: Lower energy bills: Utility rates have been going up. The spikes are significant in many regions. More efficient appliances equal smaller utility bills. For low-income households, those monthly savings can go a long way. Modernize your housing stock: If your tribe owns homes that members live in, this is an opportunity to upgrade those houses at reduced or no cost. Economic stimulus: If the work installing insulation, heat pumps and other appliances goes to local businesses, that’s money and jobs that stay in your economy. Workforce training: Organizations such as Green Summit can pair the installations with training and mentorship for tribal members, including HERS Rater and Rating Field Inspector pathways, so the knowledge stays in the community. Layer grants to maximize your return HEEHR funding doesn’t have to work in isolation. The rebates can be combined with other federal and state programs, such as the Weatherization Assistance Program (WAP) . The key is to be strategic in how you allocate grant money. Avoid spending general funds to pay for projects or appliances that grant money could cover. Prioritize the use of general funds for items and services that are out of scope for federal and state awards. How tribes can get started Think of this program like a construction project. You wouldn’t break ground without a blueprint. The same applies here. Before you put the money into action, you need to: Know your community and make a plan Be sure you have the relevant data for your community. How many homes are owned by the tribe? How many citizens are homeowners in the area? Have you gathered the income data for each household? Then decide what upgrades your tribe wants to prioritize. Whether it’s more heat pumps and appliance changeouts for energy efficiency or panel upgrades to support electrification, it’s ultimately up to the tribe to decide which upgrades to implement. Climate and geography should drive the tribe’s strategy. In northern regions, insulation, air sealing and cold-climate heat pumps may offer significant value. In warmer regions, conventional heat-pump systems or other eligible electric upgrades may be a better fit. Build a fraud, waste and abuse mitigation plan The DOE is focused on preventing waste, fraud and abuse within the program. You’ll need to demonstrate that your grant funds were spent on the projects they were intended for. Documentation isn’t just good practice; it’s a compliance requirement. Whether it’s tribal staff or a third party conducting inspections, everything should be documented. GPS-verified and time-stamped photos should be taken before and after each project. DOE mandates include address verification to ensure that a single address doesn’t receive rebates for the same component through a similar program. For example, if a household claims an HVAC heat pump under the Tribal HEEHR program, it can’t also claim an HVAC heat pump under a state program. However, it could potentially take an HVAC heat pump under one program and appliances, stoves or electrical panels under the other. Find the right partner It’s strongly recommended that tribes bring in outside help. With income verification, compliance requirements and data reporting, the program is complex. Navigating it solo adds unnecessary risk. Get a partner familiar with the program, document everything and have a very good plan in place. If those three things are taken care of, distributing funds, certifying funds and supporting any DOE audits becomes a much smoother process Read more AI for tribes: Managing risk and maximizing impact How GASB 103 and GASB 104 will impact tribal governments Don’t let tribal energy grants jeopardize your energy tax credits
ARTICLE
7 cybersecurity tips for tribes and tribal organizations
Cybercrime continues to plague the U.S., and the problem is only accelerating. According to the 2025 FBI Internet Crime Report , there were 1,008,597 cybercrime complaints filed in the year. That is the biggest number on record. No industry or government body is safe from a cyberattack. This includes tribal governments and the businesses they operate, particularly casinos. In this environment, investing in cybersecurity isn’t an option. You shouldn’t be asking if you’ll be attacked, but rather when and if you’ll be ready. Keep reading to learn steps your tribe can take to bolster its cybersecurity posture. Why tribes must take cybersecurity seriously Nearly 90 tribes nationwide own and operate broadband networks . It’s common for critical infrastructure managed by tribes, such as water treatment facilities and healthcare centers, to be connected. Tribal businesses, such as casinos and resorts, also rely on the internet to deliver services and manage day-to-day operations. Add it all together and tribes have a large attack surface that bad actors can target. Tribes hold sensitive data of their members and customers that need to be protected. There’s also invaluable cultural heritage data that could be compromised in an attack. From critical services to members being disrupted to financial information being stolen, the consequences of a cyberattack could be disastrous for a tribe. A cybersecurity program that is regularly tested is a must for tribes to protect their communities. Why do cybercriminals target tribes? The reason tribes are targeted is simple: they run high-dollar businesses, manage critical infrastructure and possess sensitive data. The information or infrastructure that attackers could attempt to compromise includes: Financial data Tribal casinos, resorts and other businesses generate significant revenue. As a result, they hold large amounts of credit card numbers, bank routing information, gaming loyalty program data and more. Examples of attacks on tribal casinos include: Several Kewadin Casinos locations were forced to temporarily close following an attack. A ransomware attack impacted gaming operations and other tribal services for the Lower Sioux Indian Community . Tribal enrollment and membership records Tribes hold a significant amount of their members’ personally identifiable information (PII), including names, Social Security numbers, dates of birth, physical addresses and potentially even biometric data. Financial records linked to distributions, tribal housing assistance funds and more could also be compromised if your tribe is the victim of an attack. Healthcare records Many tribes manage independent medical centers via the Indian Health Service (IHS) or localized tribal health networks. As a result, they possess protected health information (PHI). In addition to the ethical need to protect their members’ health records, holding PHI means tribes must comply with HIPAA. Disruption of critical services Some cyberattacks are carried out simply to create chaos. Tribes provide a variety of essential services to their communities, and their disruption could upend day-to-day life. Services that are vulnerable to an attack include: Health centers Police, fire and emergency dispatch centers Emergency alerting systems Utilities, including water and power Social services such as housing and welfare programs Cultural heritage and language assets Hackers can also target a tribe’s digital archives. If successful, they can hold your cultural and historical files ransom. It took the Eastern Band of Cherokee Indians eight months to recover audio and video recordings of tribal members speaking their native language after they were stolen in a ransomware attack . Other valuable assets could include digital copies of sacred artifacts, geographic land boundaries, water rights documents and historical government treaties. What cybersecurity actions should tribes take? Here are seven ways tribes can mitigate cyber risks across their government and business operations: 1. Multi-factor authentication (MFA) MFA remains one of the most effective controls a tribe can deploy, but not all MFA is equal. SMS-based codes, in which an access code is texted to a cell phone, are now considered a weaker form of MFA due to SIM-swapping attacks, in which criminals convince a carrier to transfer your phone number to a device they control. Tribes should prioritize a phishing-resistant MFA, such as FIDO2 hardware security keys or authenticator apps that generate time-based codes. These methods help prevent the most common cyberattacks, including phishing, credential stuffing and adversary-in-the-middle (AiTM) attacks, a newer technique that attackers use to bypass traditional MFA by intercepting authentication sessions in real time. 2. Penetration testing Penetration testing simulates real-world attacks against your systems, applications and people. A pen test will expose vulnerabilities in your security that hackers may exploit. For example, the third-party firm you hire to perform penetration testing might create simulated phishing emails to look for insufficient updates and improper protection processes. 3. Real-time detection If you’re only relying on traditional endpoint protection tools (e.g., firewalls and antivirus software), security attacks and data breaches may go undetected for weeks or months. These are reactive security measures developed to counter known security threats. Two technologies now define the current standard for proactive threat detection: Security information and event management (SIEM) collects and aggregates log data from across your environment, networks, endpoints, applications, identity systems and cloud platforms and correlates that data in real time to surface suspicious patterns. Unlike a firewall that only sees what crosses its perimeter, a SIEM sees across your entire operation simultaneously. For a tribal organization running a casino, a health center, a broadband network and a government services portal, that breadth of visibility is critical. A SIEM might flag that the same user account logged in from two geographic locations within minutes, that a privileged account accessed an unusual volume of enrollment records overnight or that outbound traffic is communicating with a known malicious IP address. Managed detection and response (MDR) pairs that technology with human security analysts operating around the clock. MDR platforms use extended detection and response (XDR) capabilities to correlate signals across endpoints, networks, cloud environments and identity systems. Trained analysts investigate alerts, separate genuine threats from false positives and take containment action when needed. AI-driven behavioral analysis has become central to this discipline, enabling faster detection of multi-stage attacks that automated rules alone would miss. Used together, SIEM and MDR close the visibility and response gaps left by legacy tools. For tribes that cannot hire a full security staff, outsourcing MDR to a specialized provider delivers 24/7 coverage without the operational overhead. While the SIEM ensures analysts have the full environment data they need to act quickly and decisively. 4. Patches and updates Hackers know how to exploit vulnerabilities in systems, applications and processes. Patches and updates fix code defects and close these vulnerabilities. Make sure a member of your IT team is monitoring software and frequently pushing updates and patches. 5. Cybersecurity insurance When assessing your insurance needs, make sure to consider obtaining cybersecurity insurance. Appropriate coverage helps prevent your tribe from being left in a vulnerable security posture with much to lose. 6. Backup and recovery Ransomware attacks are increasingly looking for backup files to encrypt so they can prevent access to any data until the ransom is paid. Your tribes should have a data backup recovery process in place that includes air-gapped, immutable data protection. These are offline copies of data, which makes them secure, recoverable and unable to be altered or changed. By keeping an archive of immutable backups, you can recover from a ransomware attack much easier and faster — without having to pay the ransom. 7. Cybersecurity training Employees remain a primary target in cyberattacks, and the attacks they face are becoming more sophisticated. AI-generated phishing emails are now grammatically flawless, personalized and increasingly indistinguishable from legitimate communications. Deepfake audio and video are being used in vishing (voice phishing) attacks, in which criminals impersonate executives or vendors to obtain authorization for fraudulent wire transfers or credential resets. A modern security awareness program needs to include: Simulated phishing campaigns: Regularly send realistic test phishing emails to employees and use failures as teaching moments rather than punitive ones. Role-based training: Tailor training to specific departments. Finance staff need training on wire fraud and business email compromise. HR staff need training on W-2 and direct deposit scams. IT staff need training specific to their elevated access privileges. Insider threat awareness: Not all threats are external; employees need to understand access control principles and report unusual activity. Frequent updates: Training content must evolve as threats evolve. New employees must be trained before they have access to tribal systems, not weeks after onboarding. Cybersecurity for tribes FAQs Here are answers to some frequent asked questions about cybersecurity for tribes: Why are tribal governments targeted by cyberattacks? Tribal governments are high-value targets because they combine the financial assets of a business with the sensitive data holdings of a government entity. Tribal casinos and resorts generate significant revenue and process large volumes of credit card transactions, gaming loyalty data and financial records that are attractive to financially motivated attackers. At the same time, tribes hold personally identifiable information (PII) on their members and protected health information (PHI) through tribal health centers. Tribes also operate critical infrastructure, including broadband networks, water utilities and emergency services that hackers may target to cause disruption. The scale of that attack surface, often managed with lean IT and security resources, makes tribal governments a frequent and deliberate target. How often should tribes conduct cybersecurity assessments? At a minimum, tribes should conduct a comprehensive cybersecurity risk assessment annually, but the threat environment has evolved to the point where annual reviews alone are not sufficient. Penetration tests should be performed at least once a year, with targeted retesting any time a significant system change, new technology deployment or major business expansion occurs. Ongoing attack surface management and continuous vulnerability scanning should run between formal assessments to catch newly discovered exposures before attackers do. Tribes that operate casinos, health centers or broadband networks, each of which carries its own regulatory and compliance obligations, may need assessments on a more frequent cycle to remain in good standing with applicable requirements. Think of cybersecurity assessment not as a calendar event but as a continuous process with periodic formal checkpoints. What is the biggest cybersecurity risk for tribal organizations today? The single greatest cybersecurity risk facing tribal organizations today is human error. Specifically, the success rate of phishing and social engineering attacks as an initial entry point into tribal systems. Attackers no longer need to find a technical vulnerability when a convincing email, text message or AI-generated voice call can trick an employee into handing over credentials or directly authorizing a fraudulent transaction. Once inside, attackers move laterally across connected systems, often going undetected for weeks. The growing use of generative AI by threat actors has made phishing messages harder to identify, removing the spelling errors and awkward phrasing that employees were historically trained to spot. Addressing this risk requires a combination of phishing-resistant MFA, continuous security awareness training and robust detection capabilities that can identify suspicious behavior even after credentials have been compromised. How can tribes prepare for ransomware attacks? Preparing for ransomware requires a layered strategy that addresses prevention, detection and recovery. On the prevention side, tribes should enforce phishing-resistant MFA on all accounts, maintain a disciplined patch management program and limit user access privileges so that a compromised account cannot move freely across systems. For detection, managed detection and response (MDR) combined with a SIEM gives security teams the visibility to identify ransomware staging activity, such as large-scale file enumeration or backup deletion, before encryption begins. Recovery preparedness centers on maintaining tested, air-gapped and immutable backups, so that data can be restored without paying a ransom. Equally important is a documented incident response plan that has been rehearsed through tabletop exercises, ensuring tribal leadership, IT staff, legal counsel and communications teams each know their role the moment an attack is confirmed. Read more AI for tribes: Managing risk and maximizing impact How GASB 103 and GASB 104 will impact tribal governments Your tribal organization just implemented a new ERP. How do you maximize the success of your investment?
Reach out to our team
Let our tribal government consulting help you develop future leaders, strengthen operations and advance your vision for the next generation.
LET'S CONNECT
Wipfli is ready to help you balance today’s challenges with the priorities that will shape your tribe’s future.
