NASCIO: Federal Compliance Exercises Are Hindering State IT

One point that was clear when the National Association of State Chief Information Officers met last week in Austin, Texas for its annual meeting was there is a strong push at the state level toward building an affordable, citizen-centric approach to digital government. An often cited barrier to this approach has been the multitude of regulations from federal agencies on how to store and secure data shared between multiple levels of government.

As most public officials know, the federal government rarely implements programs directly; rather, agencies provide money to states and localities to implement programs on their behalf. Of course, with this money comes a jumbled stew of regulations from an alphabet of agencies on how to implement those programs, what data to collect on those programs, and how to store and secure that data.

The state CIOs and their security teams are typically tasked with figuring out how to disentangle these regulations, performing as few redundant processes as possible while maximizing security.

Enter into the fray Yejin Cooke, who represents the states, territories, and the District of Columbia’s chief information officers to the feds. As director of government affairs at NASCIO, part of her job is to ensure federal officials—be they in an agency, Congress, or the White House—understand how federal rules trickle down to the state and local level.

“State CIOs have a plethora of state regulations—especially those that deal with data security and cybersecurity—that they have to comply with,” Cooke told Route Fifty last week during the conference. She explained that how these regulations impact state operations are “something that maybe our federal partners may not be sufficiently thinking about when they produce these rules, but they do have a real-life impact.”

In full disclosure, I formerly served in Cooke’s role as director of government affairs at NASCIO, and worked as an advocate for the CIOs on this very issue. In that role, I heard firsthand from CIOs regularly on how varying federal security regulations and audits are creating significant pain points for the states. These pain points become amplified as states consolidate data centers, attempt to put complementary of government services on a single portal for citizens to access, and run advanced analytics across multiple data sets to tackle big issues like the opioid epidemic.

“Our CISOs and our CIOs try to do the best they can in compliance and meeting these requirements,” Cook explained. “But, as you know, at the state level we are moving towards a more consolidated IT environment, which means that our CIOs need to deal with … lots and lots of federal regulations [around data] even though they’re only dealing with one data center.”

Back in June, Oklahoma Chief Information Officer James “Bo” Reese, now serving as president of NASCIO, testified before the Senate Homeland Security and Governmental Affairs Committee on behalf of NASCIO. In his testimony, Reese discussed the impact that federal cybersecurity regulations have on state IT and cybersecurity investments, and how “the complex federal regulatory environment is duplicative in nature, contributes to inconsistent federal audits, and drives cybersecurity investments based on compliance and not risk, which is the more secure approach.”

Cooke said that the senators at the hearing were “surprised by … the savings that is possible through IT consolidation and they are shocked to learn that these federal regulations are harming or become a challenge in that process, thus making it harder for state CIOs to save taxpayer dollars.”

Attached to Reese’s written testimony to the committee was a long list of statements from state IT professionals on federal data security regulations, as well as claims of inconsistent audit practices.

Cooke spoke about her members’ concerns about federal audit requirements and how they are implemented in our interview, describing how “in Maine … responding to one IRS audit requires about an investment of about four thousand hours, which calculated out is about one year and 11 months of one person working 8 hours a day every single day,” as well as an investment of 2,500 hours by a state for a Social Security data audit.

“That’s not the best use of our information security personnel,” Cooke stated. “It requires an investment in cybersecurity that’s based on compliance and not risk, and we all know that’s not the best approach to securing citizen data.”

Cooke is optimistic that these conflicting approaches can be fixed. “I think it begins with the recognition that we are partners—state government, local government, federal government,” Cooke said. “We share the same goal, which is to deliver the best and most efficient government services at the least cost to our citizens.”

“If we could work in partnership with our federal partners on ways that we can meet their security requirements and also ensure we are doing our job in securing that info, I think we could end up in a good place.”