Key Takeaways
- Whole‑of‑state cybersecurity is a unified effort to coordinate collaboration and address shared cyber risks across state, local, education, and sometimes industry partners.
- Engaging local governments early, through trusted partners, and respecting their autonomy are foundational to success.
- State programs benefit from advisory councils, associations, and jointly authored guidance that lend credibility and reach.
- Tailoring communication methods to stakeholders’ preferences (email, phone, site visits, in‑person meetings) builds stronger collaboration.
- Mandatory cyber‑incident reporting provides valuable threat‑intelligence data while fostering trust when handled transparently.
- Maturity models—such as the eight‑pillar framework from CIS/MS‑ISAC—help states assess progress, guide investment, and facilitate honest dialogue among leaders.
Defining Whole-of-State Cybersecurity
Whole‑of‑state cybersecurity represents a coordinated effort to align state and local governments, educational institutions, and occasionally private‑sector and nonprofit partners around shared cyber risks. Moderator Karen Sorady of the Multi‑State Information Sharing and Analysis Center (MS‑ISAC) described it as a unified initiative that seeks to bridge gaps between disparate entities while preserving each organization’s mission. The concept has evolved over the past decade, moving from isolated state‑centric plans to a collaborative model that recognizes the interdependence of digital infrastructure across jurisdictions. By framing cybersecurity as a collective responsibility, states can pool resources, intelligence, and best practices to strengthen overall resilience.
The Role of Trusted Networks and Early Engagement
Panelists emphasized that effective statewide cybersecurity hinges on building trusted networks that engage local governments early in the planning process. Rather than issuing top‑down directives, successful programs involve local leaders from the outset, allowing them to shape priorities and evaluation criteria. Trusted partners—such as municipal leagues, county associations, and regional councils—act as messengers who convey state initiatives in familiar language and contexts. This approach respects local autonomy while creating a foundation for cooperation, ensuring that states do not appear to impose solutions but instead facilitate joint problem‑solving.
Tennessee’s Approach: Advisory Council and Associations
Tennessee Deputy CISO Aimé Nsengiyumva illustrated how his state embeds local voices in cybersecurity strategy through a cybersecurity advisory council and related committees. These bodies include county and city officials who help design programs, define metrics, and assess outcomes. Additionally, state leaders regularly present at conferences hosted by the Tennessee Municipal League, leveraging the league’s established relationships to reach a broad audience of local officials. Nsengiyumva noted that these forums serve as trusted conduits for information exchange, enabling the state to align its objectives with the practical realities faced by municipalities.
New York’s Cybersecurity Primer and Trusted Messengers
Meghan Cook, director of the Division of Homeland Security and Emergency Services’ Cyber Incident Response Team in New York, highlighted the impact of a jointly authored Cybersecurity Primer for Local Government Leaders. Produced in 2022 by the University at Albany’s Center for Technology in Government, the primer was developed with the New York State Association of Counties and an advisory team of county technology leaders. Endorsements from the New York State Conference of Mayors and Municipal Officials and other groups amplified its credibility. Cook explained that having “trusted messengers” vouch for the document broadened its reach and ensured that recommendations were perceived as relevant and actionable by local officials.
Communication Preferences Matter
Nsengiyumva stressed that understanding how local governments prefer to receive outreach is critical to effective engagement. Rather than relying on a single channel—such as email—states should ask stakeholders whether they favor phone calls, site visits, or in‑person meetings. By matching communication methods to local preferences, states demonstrate respect for officials’ time and workflows, which in turn increases the likelihood of meaningful dialogue. This tailored approach helps clear barriers to collaboration and fosters a culture where feedback is welcomed and acted upon.
Minnesota’s Incident Reporting Mandate and Threat Intelligence
Minnesota State CISO John Israel described how the state’s mandatory cyber‑incident reporting requirement has sharpened its view of local cybersecurity challenges. The mandate provides a steady stream of threat‑intelligence data that enriches situational awareness and informs statewide defensive measures. Israel advised that building relationships and trust is essential when collecting such data; officials must assure localities that reported information will be used constructively, not punitively. When handled transparently, incident reporting becomes a two‑way street that improves both state‑level intelligence and local resilience.
Maturity Model and Eight Pillars from CIS/MS‑ISAC Report
The panel referenced a Center for Internet Security and MS‑ISAC publication, Advancing Whole-of-State Security, which outlines eight core pillars for effective whole‑of‑state programming. These pillars include purposeful, sustained engagement (building trust through transparency), shared decision‑making, consistent communication, and respect for local autonomy. The report also introduces a capability maturity scale that tracks progression from siloed, ad‑hoc interactions to formal stakeholder planning and established relationships with county and municipal associations. States can use this scale to gauge where they stand and identify concrete steps for advancement.
Applying the Maturity Scale: Not a Checklist but a Diagnostic Tool
Netta Squires of Open District Solutions cautioned against treating the maturity model as a simple checklist or performance score. Instead, she framed it as a diagnostic instrument that helps states visualize their current position and determine where additional investment or process adjustments may yield the greatest benefit. By encouraging conversations among tech leaders, policymakers, and executive officials, the scale promotes reflective practice rather than rote compliance. This perspective aligns with the panel’s broader message that successful cybersecurity hinges on continuous learning and adaptation.
Challenges of Early Phases and Building Trust Through Honest Dialogue
Several panelists acknowledged that many states remain in the early stages of developing whole‑of‑state programs and warned that issuing directives alone will not generate the needed cooperation. Meghan Cook offered a practical test for trust: if a meeting feels merely polite and no candid concerns surface, true trust has not been earned. She urged leaders to seek environments where stakeholders can speak frankly, repeatedly asking whether the information shared is valuable, whether it is working, and whether space exists for honest feedback. Even when immediate solutions are unavailable, listening and acknowledging concerns lay the groundwork for future collaboration.
Conclusion: Path Forward for Whole-of-State Cybersecurity
The insights shared at the ISAC Annual Summit underscore that effective statewide cybersecurity is less about central mandates and more about cultivating trusted, inclusive networks. Early engagement, respect for local autonomy, tailored communication, and credible joint products—such as advisories and primers—form the backbone of successful efforts. Mechanisms like mandatory incident reporting add valuable intelligence when paired with transparent relationship‑building. Finally, maturity models provide a reflective roadmap, helping states assess progress, prioritize investments, and sustain the dialogue necessary for lasting resilience. By embracing these principles, states can create a collaborative cybersecurity ecosystem that leverages the strengths of every jurisdiction while safeguarding the nation’s digital infrastructure.
