Top considerations for adopting a whole-of-state cybersecurity strategy

As cyber threats become more sophisticated and pervasive, state and local government agencies, utilities, and educational institutions have become popular targets for nation-state adversaries and e-criminals.

Public sector chief information officers and chief information security officers must balance maintaining a digital-first presence with defending against these threats to safeguard student and citizen data. This is where a whole-of-state, also known as whole-of-enterprise or whole-of-campus, approach to cybersecurity can be invaluable.

A whole-of-state strategy acknowledges cybersecurity is not merely a collection of isolated efforts across agencies or departments. Instead, it emphasizes a cohesive and collaborative framework that spans the entire ecosystem. This focus on partnerships and resource sharing enhances the overall security posture across all levels, including state agencies, municipalities, utilities, and educational institutions.

The whole-of-state model can help agency leaders overcome many of the security challenges they face today, from siloed data and limited funding to cultural resistance and coordination hurdles. Before implementing this security approach, leadership must understand the benefits, challenges, and best practices for accelerating adoption.

Working Better, Together

State and local government agencies have already begun to reap the benefits of the whole-of-state security approach by reducing the risk posture of the whole ecosystem through enhanced efficiency and secure modernization.

Many agencies face limited budgets and resources, making the efficient use of taxpayer funds paramount. By adopting a whole-of-state strategy, agencies can share resources, streamline processes, and enhance overall efficiency, enabling them to do more with less while maintaining robust security postures. This good stewardship also fosters public trust and accountability, allowing citizens to see their government acting responsibly and transparently.

The whole-of-state approach breaks down silos that often hinder effective communication and collaboration across agencies, leading to more robust and comprehensive risk mitigation strategies, as well as improved threat detection and response. Not only does this strategy fortify overall security posture across agencies, but it also reduces the likelihood of breaches and associated potential negative impacts on the lives of affected citizens.

Another advantage to a whole-of-state approach to cybersecurity is the opportunity for tool consolidation across state and local governments. The more licenses agencies purchase, the lower the per-license cost. This drives down expenses across all agencies — an important factor in government due to regularly competing budgets. 

Additionally, common tools are beneficial when an adverse event occurs, requiring these different organizations to work together to triage and remediate the situation. For instance, if a local agency has a breach, they may call the state for help. If the state is already using the same tools as the local agency, they will not have to learn a new tool and will be able to assist much more quickly and effectively.

The benefits of collaboration don’t stop at an intergovernmental level. Schools can benefit from the expertise and advanced tools state agencies provide, enhancing their ability to detect and respond to cyber incidents. Such collaboration also promotes cybersecurity awareness and education among students, which can encourage them to pursue careers in cybersecurity. 

Promoting interoperability and centralized oversight through a whole-of-state strategy can help agency leaders procure the technologies they need to modernize securely, which often involves integrating new systems with legacy ones. This approach makes it easier to implement consistent security policies and procedures, ensuring these integrations are secure by allowing different systems to work together seamlessly and safely. 

Because state and local systems must frequently interoperate, this collective approach can ensure all parts of the process are secure — as the saying goes, a chain is only as strong as its weakest link.

Overcoming Adoption Challenges

The coordination requirements among diverse entities with siloed data, cultural resistance, and frequent turnover can make it difficult for agencies to adopt whole-of-state security strategies. However, there are steps agencies can take to overcome these challenges and accelerate their adoption of this security approach.

Competitive salaries in the private sector, limited budgets, and workload stress have caused staffing challenges across the public sector, impeding agencies’ overall security postures. To successfully implement a whole-of-state strategy, agencies must prioritize growing and reskilling their workforce.

The cutting-edge security tools and technologies needed for this approach can help solve staffing problems by attracting younger, tech-savvy talent looking to work in innovative environments. 

Agency IT leaders should embrace this aspect of the whole-of-state model when recruiting, including training for new and existing employees that complements the standardization of tools and processes. Additionally, the collaborative environment this approach creates enables junior staff to continuously learn from more seasoned members, helping to foster a culture of learning and aiding in retention efforts.  

When it comes time to combine diverse entities with siloed cybersecurity data and systems into a whole-of-state cybersecurity approach, differences in data, policies, and culture can pose a significant hurdle. Coordinating policies and procedures across multiple agencies requires substantial effort to reduce risk while ensuring compliance with state and federal regulations. Cybersecurity culture can also vary among agencies and departments, making it critical for states to introduce training and awareness programs to align all organizations with the collective cybersecurity objectives.

A whole-of-state effort can overcome these challenges by articulating state objectives, establishing aligned cybersecurity policies, optimizing tools and funding across the enterprise, and providing regular cybersecurity training and policy workshops. Adoption of recognized frameworks and well-documented procedures also leads to smoother leadership transitions and sustained progress when those changes inevitably occur, ensuring the continuation of long-term security projects.  

As the public sector cybersecurity landscape evolves with the next era of sophisticated threats, agencies must consider adopting a whole-of-state approach to security. By prioritizing collaboration, modernization, and strategic resource allocation, state and local governments can ensure they’re prepared to address advanced cyber threats and foster trust within their communities, all while safeguarding citizen data.

John Evans is chief technology advisor for World Wide Technology.