States slowly embrace ‘whole-of-state’ cybersecurity approach

In 2021, Texas began establishing a series of centers throughout the state to provide on-the-ground support to local governments, school districts, hospitals and other critical infrastructure providers through security monitoring, threat sharing and training.

Observers say the novel approach, which has begun in West Texas and is set to expand statewide in the coming years, offers a tantalizing look at how cybersecurity offerings could evolve in the states.

“This is what we need,” Alan Shark, executive director at the Public Technology Institute, which offers IT training to local governments, said in a previous interview. “We need to have better locality and state cooperation; we need to have city-county-state cooperation. And it's not for lack of wanting to do it. The states want to do this.”

These so-called “whole-of-state” cybersecurity strategies embrace greater information sharing and partnerships between the different levels of government, as well as private industry. The strategies, which received a major boost from recent federal cyber grants for state and local governments, acknowledge shared risks and the need to share resources to reduce financial burdens.

The approach is widely seen as a way to deal with multiplying threats, dwindling resources and increasingly vulnerable local governments.

And indeed, more states are embracing whole-of-state cybersecurity strategies to confront these threats. New York’s statewide cybersecurity strategy, which Gov. Kathy Hochul unveiled last year, unifies the state’s cyber services and integrates local governments into its larger plan.

Arizona, Indiana and North Carolina have also prioritized information sharing, collaboration, employee training and threat monitoring with their localities. Other tools they are providing under the model include endpoint protection, firewalls and multifactor authentication.

Earlier this month, a report by Cybersecurity software management company NuHarbor Security found that 57% of leaders in the state and local government and education sectors plan to offer or leverage whole-of-state cybersecurity services.

Similarly, research from the National Association of State Chief Information Officers in 2022 found that technology leaders across the states are looking to share security services in a bid to further whole-of-state goals.

Curt Wood, author of the NuHarbor report and former Massachusetts chief information officer, acknowledged that while whole-of-state has become a “big buzzword,” it “doesn't mean the same thing to everybody” given the differences between how state agencies—and their localities—are structured and led. But such strategies have key underpinnings.

“The point of whole-of-state is to come up with a common framework, a common approach of how we need to improve our cybersecurity, and what does that mean?” Wood said. “It's really about communication. It's about partnerships, it's about education, it's about awareness, it's making sure that you have a commitment.”

Federal funding has played a big role in spurring the adoption of whole-of-state. The federal State and Local Cybersecurity Grant Program under the 2021 infrastructure law helped states be more strategic in how they plan. 

Part of the program’s requirements was that states had to have a formal strategy and a planning committee and had to allocate at least 80% of their funding to local and rural communities. States could provide localities with “items, services, capabilities, or activities on a state-wide basis” instead of cash, with those governments’ permission.

But the program has met some criticism.

In a joint NASCIO and PTI webinar earlier this month, panelists noted that the federal Cybersecurity and Infrastructure Security Agency’s reliance on states to tell them how best to structure the grant program was flawed.

“I think the federal government sometimes thinks that there is this closer partnership between local governments and states, that I don't think is as strong as the federal government may think,” said Greg McCarthy, Boston’s chief information security officer, who also co-founded the Coalition of City Chief Information Security Officers in 2020. “The federal government relies on the states to tell them what should happen, but the states aren't always communicating as effectively with their local government partners.”

Observers all agreed that it is a challenge to get everybody on the same page, especially given the different levels of government they operate at. Wood said it can get “turfy” as different levels seek to protect their authority in certain areas. 

McCarthy, meanwhile, noted that the concept of shared services coming from the state may not be an appealing one for large cities.

“If I'm not losing any capabilities, and someone's going to offset the cost of doing something, I'm OK with that idea,” he said. “But if we're going to lose some capabilities, I think we just need to understand where the benefit of that is. That's where it becomes more complex, especially with the larger municipalities. Smaller municipalities, they don't have anything. But the larger municipalities that have capabilities [already] is where I think it gets a little bit murky.”

One major concern for states is whether they have sufficient cybersecurity staff to deal with local government coordination on top of keeping their own agencies and systems safe. Maryland has people in government specifically responsible for coordinating with localities on cybersecurity, but the sheer amount of governments to manage could overstretch resources.

Shark said during the NASCIO/PTI webinar that something more structured may be necessary to prevent one point person at the state level being overwhelmed.

“You can’t have 500 or 1,000 local governments calling one individual,” he said. “It's got to be a distributed network of people who understand the issues and have some kind of means of flowing up and down through the state.”