While huge hurdles still exist, cybersecurity is fast becoming part of the fabric of US government operations, according to a recently-released study by Deloitte.
The National Association of State Chief Information Officers Cybersecurity Study suggests that despite an increase in the governor-level awareness of cybersecurity, the most significant challenge for state chief information security officers (CISOs) in 2016 remains a lack of sufficient funding. Most states’ cybersecurity budgets are hovering between zero and 2% of their overall information technology budget.
“There continues to be challenges with proper funding and finding qualified talent” said Darryl Ackley, NASCIO president and cabinet secretary and CIO for the New Mexico Department of Information Technology. “The good news is that we are seeing positive indications that state CISOs and CIOs are having an impact as communication and collaboration among government is increasing.”
Governor-level awareness is on the rise.
The survey results indicate that governors and other state officials are receiving more frequent updates from CIOs/CISOs. Despite an increase of reporting, a confidence gap still exists between IT and the business, emphasizing the need for better communication of cyber risks.
Cybersecurity is becoming part of the fabric of government operations.
The state government CISO role has become more consistent in terms of functions and responsibilities. Top three cybersecurity initiatives in 2016 include training and awareness, monitoring/security operations centers, and strategy.
A formal cybersecurity strategy and better communications lead to greater command of resources.
States taking a proactive approach to strategy setting and communication are more likely to see improvements in funding and access to talent. Survey shows 16 out of 33 states with an approved strategy reported they had an increase in budget.
There is a need to rethink talent strategies.
The nature of what states have to offer workers has changed. States are pointing to job stability and the opportunity to “give back and make an impact” as compelling reasons to gravitate towards state employment. These—along with a rich training and development program—are becoming the basis for a campaign to recruit millennial talent.
“The survey results spell out a clear message for CISOs: State leaders are paying attention.” says Srini Subramanian, principal, Deloitte & Touche LLP, and State Government Cyber Risk Services. “Those CISOs who are able to harness this attention and build stronger relationships with business executives and state legislators have an opportunity to garner more resources and support for their initiatives. For the first time, all respondents report having an enterprise-level CISO position. The CISO role itself has become more consistent in terms of functions and responsibilities. CISOs are also focusing their energies more on what they can control.
View the full study at www.NASCIO.org/stateofcyber
(Infographics: Deloitte)
