2016 Deloitte-NASCIO Cybersecurity Survey: Cyber Getting Governor Attention; Budget and Talent Challenges Remain
Despite increased executive awareness of cybersecurity, challenges continue
Survey finds a formal strategy, better communications are needed to develop greater command of resources
ORLANDO, Fla., Sept. 20, 2016 — Challenges still exist, but cybersecurity is becoming part of the fabric of government operations, according to the recently-released “2016 Deloitte-National Association of State Chief Information Officers (NASCIO) Cybersecurity Study.” Despite an increase in the governor-level awareness of cybersecurity, the most significant challenge for state chief information security officers (CISOs) in 2016 remains a lack of sufficient funding. Most states’ cybersecurity budgets are hovering between zero and 2 percent of their overall information technology budget.
“There continues to be challenges with proper funding and finding qualified talent, but the good news is that we are seeing positive indications that state CISOs and CIOs are having an impact as communication and collaboration among government is increasing,” said Darryl Ackley, NASCIO president and cabinet secretary and CIO for the New Mexico Department of Information Technology.
“The survey results spell out a clear message for CISOs: State leaders are paying attention. Take advantage of this focus to make substantial progress,” said Srini Subramanian, principal, Deloitte & Touche LLP, and state government cyber risk services leader. “Those CISOs who are able to harness this attention and build stronger relationships with business executives and state legislators have an opportunity to garner more resources and support for their initiatives.”
Subramanian continued, “For the first time, all respondents report having an enterprise-level CISO position. The CISO role itself has become more consistent in terms of functions and responsibilities. CISOs are also focusing their energies more on what they can control.”
Key takeaways from the 2016 survey:
- Governor-level awareness is on the rise. The survey results indicate that governors and other state officials are receiving more frequent updates from CIOs/CISOs. Despite an increase of reporting, a confidence gap still exists between IT and the business, emphasizing the need for better communication of cyber risks.
- Cybersecurity is becoming part of the fabric of government operations. The state government CISO role has become more consistent in terms of functions and responsibilities. Top three cybersecurity initiatives in 2016 include training and awareness, monitoring/security operations centers, and strategy.
- A formal cybersecurity strategy and better communications lead to greater command of resources. States taking a proactive approach to strategy setting and communication are more likely to see improvements in funding and access to talent. Survey shows 16 out of 33 states with an approved strategy reported they had an increase in budget.
- There is a need to rethink talent strategies. The nature of what states have to offer workers has changed. States are pointing to job stability and the opportunity to “give back and make an impact” as compelling reasons to consider state employment. These — along with a rich training and development — are becoming the basis to recruit millennial talent.
To read the survey, visit www.NASCIO.org/stateofcyber.
About Deloitte
Deloitte provides industry-leading audit, consulting, tax and advisory services to many of the world’s most admired brands, including 80 percent of the Fortune 500 companies and 47 US states. Our people work across more than 20 industry sectors to deliver measurable and lasting results that help reinforce public trust in our capital markets and inspire clients to make their most challenging business decisions with confidence. Deloitte’s Center for Government Insights produces groundbreaking research to help government solve its most complex problems. Deloitte’s Secure.Vigilant.Resilient.TM cyber risk programs focus on aligning security investments with risk priorities, establishing improved threat awareness and visibility, and strengthening the ability of organizations to thrive in the face of cyber incidents. http://www.deloitte.com/us/state
About NASCIO
The National Association of State Chief Information Officers is the premier network and resource for state CIOs and a leading advocate for technology policy at all levels of government. NASCIO represents state chief information officers and information technology executives from the states, territories, and the District of Columbia. For more information about NASCIO visit www.nascio.org.
As used in this document, “Deloitte” means Deloitte & Touche LLP. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting.
Contacts
Megan Doern
Public Relations
Deloitte
571.858.1990
[email protected]
Lori Rempe
Membership and Communication Coordinator
NASCIO
859.514.9217
[email protected]
NASCIO Honors Exceptional Contributions in State Government
The National Association of State Chief Information Officers (NASCIO) presented the State Technology Innovator Award to three deserving public servants during the 2016 NASCIO Annual Conference in Orlando.
The NASCIO State Technology Innovator Award honors outstanding individuals who have made contributions to advance state technology policy through the promotion of best practices, adoption of new technologies and advancements in service delivery. Nominees must be an employee, elected official, appointed official or other appointee representing state government. Nominations were gathered from NASCIO members as well as non-members. The following are the recipients of the 2016 NASCIO State Technology Innovator Award:
The Honorable Governor John Hickenlooper, State of Colorado
Governor John Hickenlooper has helped solidify Colorado as an unprecedented leader in technology efforts. Three large initiatives where Governor Hickenlooper has elevated technology for Colorado, and proven that the state is a national leader, are Google Apps for Government, the Colorado Universal Application, and cybersecurity. Just months after his election, Governor Hickenlooper added the title “Secretary of Technology” to the Chief Information Officer (CIO) role to lead the state’s IT economic development efforts.
Dr. William A. Hazel Jr., Secretary, Health and Human Services, Commonwealth of Virginia
Dr. Bill Hazel has a long track record of using technology to improve people’s lives. As an orthopedic surgeon in Northern Virginia, where he was an advocate for using medical technologies to serve his patients, and now as Secretary of Health and Human Resources, where he uses his position to drive positive outcomes for Virginians; from ending Veterans Homelessness, to improving access to mental health services, to integrating individuals with disabilities into the community, to enabling children and families to thrive.
Delano Squires, Director, Connect.DC, District of Columbia
As the leader of Connect.DC — Washington, D.C.’s premier digital inclusion initiative – Delano Squires launched the Mobile Tech Lab (MTL) to leverage the power of technology within the District’s inadequately served communities. The MTL directly advances the District’s digital inclusion technology policy agenda, hosting digital and financial literacy classes, providing access to laptops and Wi-Fi, and ensuring all citizens, regardless of internet access, can utilize the District’s online government services.
# # #
NASCIO Honors Stu Davis of Ohio for his Exceptional Service to the State and NASCIO
The National Association of State Chief Information Officers (NASCIO) recognized Stu Davis, past NASCIO president and chief information officer (CIO) for the state of Ohio, with the association’s Meritorious Service Award. Davis was honored during a special ceremony Monday evening at the NASCIO Annual Conference in Orlando.
To spotlight outstanding service, NASCIO created the Meritorious Service Award, honoring leadership in state government and dedication to the advancement of NASCIO’s mission. NASCIO’s achievements have largely been the product of the enthusiasm, focus and service of its members; this commitment to excellence has served as a catalyst to redefine the role of technology at the federal, state and local levels.
“Stu is the embodiment of true leadership, vision and service and I cannot think of anyone more deserving.” said NASCIO President and cabinet secretary for the New Mexico Department of Information Technology Darryl Ackley. “Having Stu as a friend and resource has been invaluable to me during my tenure as CIO and I know that I am certainly not alone in that sentiment.”
Stu’s career spans over 30 years focusing on state and local government and was appointed as CIO in Ohio in 2011. Under his leadership, Ohio has undertaken an IT Optimization initiative, which has reinvented the way state agencies support the public they serve. Over the last five years the optimization project has redirected agency IT spend from infrastructure and operations to citizen and business-centric application and services. While great strides have been made, Stu is working to ensure continued success for Ohio through partnerships across the state; a focus on creating high-quality citizen and business experiences with state programs; supporting state employees with common and efficient enterprise solutions; and providing secure and reliable information technology solutions.
Ohio Department of Administrative Services Director Robert Blair said, “Stu has provided the leadership, vision and energy necessary to get things done for Ohio! He led the charge to change the way we do IT in Ohio – providing shared solutions for common services so that state agencies can focus on their core missions to create a better Ohio. I am proud to have him on my team and call him my friend. He embodies the DAS spirit of Service, Support and Solutions.”
Davis has been a member of the NASCIO Executive Committee since 2012 when he joined as a director. Since then he has held the offices of secretary-treasurer, vice president and president. Davis has also served on numerous NASCIO committees, currently serving as chair of both the Nominations and Data Management Committees, and has represented NASCIO at regional and national conferences as a speaker and panelist.
# # #
State IT Leaders Adapting to Evolving Tech Environment, 2016 State CIO Survey Reveals
State governments continue to face challenges in recruitment, development and retention of IT professionals as they compete with the private sector for talent.
The 2016 survey finds that state CIOs are innovating and promoting the experiences available only in government that the private sector cannot offer, and it seems to be working. Promoting non-salary benefits and a call to public service are two of the most effective strategies.
Dealing with Data
The overwhelming majority of state CIOs consider data governance and management to be a key element of their strategic agendas and operational plans. There has been significant progress in this area in the last several years. The overwhelming majority of respondents indicate their state is integrating or has an interest in the integration of data analytics to develop insights and inform policy decisions.
NASCIO Announces New Executive Committee Leadership
NASCIO Recognizes Outstanding Achievement in State Government
NASCIO Recognizes State Chief Information Security Officers with Jarrett Scholarship
NASCIO Issues Better Decisions, Better Government Through Effective Data Management
The National Association of State Chief Information Officers (NASCIO) today released the second in its series focused on data management. NASCIO has published briefs in the past on data governance, implications on data management within cloud services, records management, open data and analytics. This is a new series focused on the basics of data management. The first brief dealt with making the case for data management. This second in the series presents how to get started.
Recognizing the importance of data management in state government, NASCIO established its Data Management Working Group under the auspices of the NASCIO Enterprise Architecture and Governance Committee. There is a reason for this positioning. Given NASCIO’s comprehensive definition of enterprise architecture, NASCIO places data management and data architecture in a critical and strategic position within the state government enterprise.
“Data management is the foundational discipline for ongoing operations with state government. Data and information assets are essential to virtually every operation and every decision within state government. From analyzing health data to determine the effectiveness of programs to evaluating road conditions across the state,” said Stu Davis, chief information officer, state of Ohio, and chair of the NASCIO Data Management Working Group. “We have to get better at leveraging our state government data and information assets in decision making at both the strategic and operational levels.”
“The portfolio of data and information assets are growing and will continue to grow at an exponential rate,” said NASCIO Executive Director Doug Robinson. “We have to be able to manage what we have in state government and position ourselves to properly manage the current and anticipated growth in the generation of data from burgeoning technologies such as the Internet of Things.”
Read the brief at NASCIO.org/datamanagement.