CDT's Cyber Road Map Will Integrate and Iterate, Officials Say

In late July, the California Department of Technology released Cal-Secure 2.0, an updated cybersecurity road map for state entities to use as a “north star.” Some months later, state officials are trying to get the word out on the new document and are looking for constructive feedback.

If the changeover from 1.0 to 2.0 wasn’t proof enough, state CISO Mike Marshall and Cyber Risk and Governance Chief Payam Hojjat said during a recent panel discussion at the California Cybersecurity Education Summit* in Sacramento that the document is iterative and will continue to adapt to the changing threat landscape.

“We are moving toward how people are identifying their gaps and how they're maturing in their capabilities, also providing additional toolkits and resources, and trying to ensure that the Cal-Secure road map is a vehicle of communication to help leaders explain the value and impact of cybersecurity to business and legislative stakeholders,” Hojjat explained.

The main difference between the two documents, the pair notes, is the shift in focus to a more risk-based approach that is not meant to be prescriptive, and instead provides a path to cybersecurity practices that can be customized across the state’s diverse collection of agencies.

“We're not trying to rewrite things and not (telling) you to buy certain products. We're not trying to tell you to buy certain technologies, even. We're trying to tell you to shift your focus towards the risk within your department or agency,” Marshall said.

The recently appointed CISO circled back to goals he shared with Industry Insider — California earlier this month, saying that he would be pushing to bring the state, local, tribal and education stakeholders to what he is calling “minimum viable security” during his tenure and is working on building out that strategy.

In addition to heading in the right direction from a cybersecurity perspective, there is a financial incentive for departments to buy into Cal-Secure. Marshall was quick to point out that budget change proposals (BCP) from agencies that are taking the right steps will have his support and will also be able to show the Department of Finance (DOF) they’re moving in the right direction.

“That goes a long way with DOF, and it goes a long way with me in my office because I will be supporting that 100 percent, because it's going to be backed by Cal-Secure 2.0,” he said.

While the road map was created for state agencies to reference, industry also has a role to play, especially in familiarizing itself with the documents and providing services that best align with them.

“I would love for the vendors in the room to make sure you go out and take a look at that and read it fully because I did say in my opening remarks this morning, outcome-based security is what I'm looking for,” the CISO said.

Both Marshall and Hojjat welcomed feedback and inquiries about the document, with Hojjat adding that he would prefer that the private sector reach out for clarifications rather than make assumptions about the state’s goals.

“We have to work together. It's a community, so do not hesitate to reach out to our group to get a better understanding,” he said.

*The California Cybersecurity Education Summit was hosted by Government Technology, Industry Insider — California's sister publication.