The National Association of State Chief Information Officers (NASCIO) has released its annual list of Federal advocacy priorities.
The priorities are a collection of initiatives, approved by NASCIO’s Executive Committee, that represent significant areas of focus for NASCIO to highlight and collaborate with Federal agencies, Congress, the White House, and other strategic partners.
The 2025 priorities include helping states lead when it comes to artificial intelligence, expanding adoption of the .gov domain, ensuring responsible implementation of the State and Local Cybersecurity Grant Program, expanding and strengthening the state cyber workforce, and harmonizing disparate Federal cybersecurity regulations.
For each advocacy priority, NASCIO provides a handful of recommendations that Federal actors should consider.
Artificial Intelligence: Helping States Lead the Way
- Congress and Federal agencies must work closely with states as they continue to develop AI legislation and regulations. Federal actors must also consider both what states have already done to address AI in their operations, and how any Federal law or regulation will impact state government.
- Provide tools and resources to states to implement AI strategies. The Federal government should take early and robust measures to provide states with the resources needed to ensure services are not interrupted, to train and develop the AI workforce, and to prevent user data from being compromised.
Continued Adoption of DotGov Domain is Essential
- CISA should establish a stakeholder advisory group to work with key stakeholders and educate local governments on the business case and security benefits of migrating to .gov.
- Expand opt-in centralized cybersecurity services for .gov entities. With ownership of the .gov program, they can now make available opt-in cybersecurity shared services on top of the .gov TLD.
- Tie Federal grant funding for local governments to .gov adoption/migration. CISA and FEMA should mandate local governments will only be eligible for grant funding if they agree to migrate to the .gov domain.
- Allow flexible usage of State Homeland Security Grant Program funds to be used for migration to .gov domain to include non-technical transition costs on items including communication outreach to citizens, marketing materials and revisions to stationary, business cards, and other printed collateral.
Ensure Responsible Implementation of the State and Local Cybersecurity Grant Program
- Work with FEMA and CISA to ensure grant guidance includes flexibility for states, promotes whole-of-state cybersecurity, emphasizes cyber hygiene, emphasizes shared services models, and establishes minimum requirements for local government eligibility to receive grant funding.
- Continue to advocate for states to budget for cybersecurity.
- Ensure state CIOs and CISOs set policy for the grant program. While State CIOs and CISOs should not serve as grant administrators, they understand the unique cybersecurity challenges facing their state. In consultation with their planning committees, they should set policy parameters and prioritize funding opportunities for this grant program.
Expand and Strengthen the State Cyber Workforce
- Increase partnerships and collaboration between state and Federal governments. While states and the Federal government compete for the same talented workers, a collaborative approach to solving workplace shortages will maximize and most efficiently leverage the resources needed to train, prepare, and retain these workers.
- Expand existing worker training and education programs.
- Develop comprehensive solutions. NASCIO said there is no “silver bullet” or universal solution to solving cyber worker shortages. Instead, stakeholders should consider a variety of policy proposals and develop them with input from states, Federal agencies, and private industry.
Harmonize Disparate Federal Cybersecurity Regulations
- Congress and the Federal agencies should continue to implement the recommendations of the GAO report and urge the Office of Management and Budget (OMB) to coordinate collaboration among Federal agencies on the development and implementation of cybersecurity regulations.
- Congress should empower OMB with requisite authorities to ensure OMB can mandate consultation by Federal agencies before updating their cybersecurity regulations.
- Federal agencies should work with State CIOs and CISOs to streamline cybersecurity regulations.
