Building cyber resilience: A roadmap for state CIOs in 2025

The threat of cyberattacks looms large in 2025. From Rhode Island to Jacksonville Beach, Florida, cybercriminals are targeting local governments to access personal data like Social Security numbers and banking information for ransom.

These attacks, while alarming, are not isolated incidents. Nation-state actors are also targeting critical infrastructure, much of which falls under the responsibility of state and local governments. The House Committee on Homeland Security recently held a hearing to examine global cybersecurity threats by such actors and how they are targeting known vulnerabilities.

The Department of Homeland Security also noted in its 2025 Homeland Threat Assessment that “domestic and foreign adversaries almost certainly will continue to threaten the integrity of U.S. critical infrastructure, in part, because they perceive targeting these sectors would have cascading impacts on U.S. industries and our standard of living.”

These hearings and statements are alarming, as such attacks can have a devastating impact and eventually lead to the dismantling of everyday services that citizens rely on, from 911 operation centers to utility services.

Since state and local governments are often responsible for maintaining and protecting critical infrastructure, it is essential that state chief information officers prioritize effective and robust cyber resilience and risk management strategies that prevent nation states from infiltrating critical infrastructure. 

The National Association of State Chief Information Officers’ 2025 priorities list reflects this urgency, with cybersecurity and risk management ranking as top priorities for CIOs. Given this, how can they put sustainable and effective cyber resilience and risk management strategies in place?

Adapting to Evolving Threats

It’s important to acknowledge that even over the last year, attacks targeting critical infrastructure systems and state and local governments have changed. New threats, such as attacks powered by generative artificial intelligence, are generating scripts to perform tasks like file manipulation and data selection. Nation-state adversaries are also using these attacks and other sophisticated methods for prolonged network and system intrusion.

To address these evolving threats, CIOs need to rethink their strategies on risk mitigation and recognize that prevention tactics alone are no longer sufficient.

Attacks will happen, and they have the potential to cause devastating disruption. According to recent research, ransomware attacks impacted 25% of critical systems, with systems down for an average of 12 hours. And when such attacks occurred, on average, it took 17.5 people, 132 hours each, to contain and remediate their largest ransomware attack.

This level of disruption to systems impacts day to day operations, disrupts essential services and jeopardizes public safety. For state CIOs, it’s no longer about preventing an attack from happening — it's about ensuring critical information remains safeguarded and operations can continue without disruption when an attack does occur.

The Assume Breach Mindset

This approach starts with adopting an “assume breach” mindset. Assume breach accepts that attacks are inevitable, and shifts the focus from preventing all breaches to minimizing the impact of a breach through security measures, protocols and tools that are designed with the assumption that an attacker may have already compromised parts of the network. 

This mindset and set of security measures, protocols and tools enable state and local governments to focus on protecting data, detecting unusual behavior and responding quickly to potential threats.

Just as cars are equipped with seatbelts and airbags to reduce the impact of a crash, an assume breach mindset can reduce the impact — stopping breaches from becoming cyber disasters — when the worst occurs. This mindset helps CIOs emphasize the importance of having a proactive plan and tools in place that protects data, detects threats, and responds quickly.

Key Elements of a Resilient Plan

For plans to be effective, they cannot fall short in one essential area: immediate impact. Cyber resilience means a risk management strategy must address the risks of today and tomorrow — not 10 years down the road. 

Nation-state actors are not waiting for state and local governments to be prepared for an attack — they are attacking and infiltrating our systems now. Should America get into a conflict, adversaries may target vulnerable systems and cause mass disruptions across local cities and states across America.

It’s vital that any risk management strategy has been tested. Controls like data encryption, advanced threat detection, and segmentation stop attackers from reaching critical systems. These measures enhance real-time visibility, identify vulnerabilities, isolate critical assets and block known attack points. By putting these measures in place, critical information remains secure, and the disruption from a successful attack remains minimal.

Additionally, it’s time CIOs move beyond traditional security models that assume everything outside the network is unsafe but everything inside is okay. A perimeter-based security model is no longer sufficient to address evolving threats.

Together with the assume breach mindset, CIOs must operate under the zero trust principle of “never trust, always verify.” By containing attacks at the point of entry, CIOs can protect critical systems, citizen data and reduce downtime.

A Continuous Journey

It's important CIOs recognize that cyber resilience is not a one and done effort — it's a continuous journey. It requires a commitment to evolving alongside new threats, adopting new technologies and strategies, and being agile to adapt to the needs of business operations. 

This approach ensures that essential services and data remain protected in an unpredictable threat landscape. CIOs should foster a culture where cyber resilience is practiced daily throughout the organization. 

This includes basics like ongoing staff training on how to recognize phishing scams and AI attacks. Requiring staff to use multi-factor authentication and ensuring their devices are continuously up to date is key to reinforcing a mindset that cyber resilience is an active and proactive part of day-to-day operations.

Keeping Citizen Data Protected

State and local governments house some of the most sensitive citizen data, and the public trusts their governments to safeguard it. As adversaries persist in targeting these systems, cybersecurity and risk management must remain top priorities for state CIOs.

By adopting an assume breach mindset, implementing a resilient risk strategy plan and putting controls in place, state CIOs will be one step closer to addressing their 2025 priorities and protecting their communities.

Gary Barlet is the public sector chief technology officer at Illumio, where he works with government agencies, contractors and the broader ecosystem to incorporate zero trust segmentation, or microsegmentation, as a strategic enabler of zero trust architecture.