State Cybersecurity Training for State Employees

10/11/2017

Almost every state offers cybersecurity training for executive branch state employees. In most states, this training is voluntary.  The chart below briefly describes the type of training offered in each state and provides links if available to state cyber training resources.  

The box allows you to conduct a full text search or type the state name.

State Cybersecurity Training for State Employees
STATE SUMMARY
Alabama

Alabama offers voluntary training with online training opportunities. Cybersecurity training is indirectly authorized by Alabama Code Title 41, Section 28, Articles 1-8, that gives the executive branch secretary of information technology the authority to develop state employee cybersecurity protocols. Website

Alaska

Alaska provides a training corner, threat indicator and MS-ISAC’s cyber “tip of the day.” Alaska’s Department of Administration, Enterprise Technology Services division developed the cybersecurity website for the state. Website

Arizona

In Arizona, cybersecurity training is incorporated into the Arizona IT strategic plan under goal 1.4. The Arizona chief information officer develops the IT strategic plan.

Arkansas

Arkansas provides voluntary cybersecurity training developed by the state of Arkansas Department of Information Systems, Cybersecurity Office. Website

California

California’s cybersecurity training is voluntary and there are several training opportunities. Individual state agencies like the Department of Motor Vehicles and the Franchise Tax Board may have mandatory cybersecurity trainings. California’s new CIO has been discussing the possibility of mandatory cybersecurity training. Website

Colorado

Colorado’s cybersecurity training is mandatory for state employees and statutorily required under the Colorado Information Security Act. Website

Connecticut

The Connecticut Department of Administrative Services offers in-service courses in cybersecurity awareness for non-IT personnel in partnership with Connecticut community colleges. Website  

Delaware Delaware offers annual statewide cybersecurity training for state and local government employees. Mandatory cybersecurity training for all executive branch agency employees, which was developed by the Delaware Department of Technology and Information pursuant to authority granted to it by Delaware Code Title 29, Chapter 90C, is part of the state’s strategic plan. Website  
Florida

Florida has mandatory cybersecurity training for state employees as required by Florida Statutes Chapter 282. Website  

Georgia

Georgia’s cybersecurity training is voluntary training and is offered by the Georgia Technology Authority. Website  

Hawaii

Hawaii has no formalized cybersecurity training, but has a state webpage dedicated to cybersecurity with tips and a toolkit. Website

Idaho

Idaho’s state webpage  contains several training videos and tools for state employees. Website

Illinois

In Illinois, Cook County provides cybersecurity training.  

Indiana

Indiana’ state webpage contains cybersecurity information, but no localized training materials for state employees. The state also created an Executive Council on Cybersecurity in 2016 and created a webpage with security awareness training materials to help inform citizens on how to stay safe on the internet. 

Iowa

Iowa has voluntary cybersecurity awareness training produced by the executive branch. Website

Kansas

The Kansas Office of Information Technology Services webpage has self-assessment cybersecurity tools. Website

Kentucky

Kentucky hosts annual trainings for state government employees during October, Cybersecurity Awareness Month.

Louisiana

Louisiana has mandatory cybersecurity  training for new employees and annual training for all employees  pursuant to the Louisiana Division of Administration, Office of Technology Services p.52.

Maine

Maine offers voluntary cybersecurity training for new employees through the Maine Office of Information Technology. Website

Maryland

Maryland requires state employee cybersecurity training through the Department of Homeland Security. State agency personnel have to take a cybersecurity class each month to gain access to state networks. Website  

Massachusetts

Massachusetts’ cybersecurity training is voluntary. The Massachusetts National Guard cybersecurity battalion provides cybersecurity awareness training and education to state, municipal and private sector entities. 

Michigan Michigan offers online state employee cybersecurity training
Minnesota

Minnesota offers cybersecurity services to employees and residents. Website

Mississippi

Mississippi provides online cybersecurity training for state employees through an outside college. Website

Missouri

Missouri has an employee tips webpage. Website 

Montana

Montana has mandatory executive branch state employee cybersecurity training upon hiring and then annually. Cybersecurity Training and Awareness Program. Legislative branch employees are not required to take cybersecurity training, but are encouraged to do so.

Nebraska

Nebraska has mandatory annual cybersecurity training and a refresher course for all state employees as outlined in department regulation. Website

Nevada
Nevada has required agency-by-agency state employee cybersecurity training; with passing grade required at new hire then annual thereafter. State Security Standard 123 – IT Security Awareness Training
New Hampshire

New Hampshire requires mandatory cybersecurity training for state employees annually through executive order. 

New Jersey

New Jersey’s cybersecurity training is voluntary. There is an online cyber hygiene video.

New Mexico

Due to budget constraints, New Mexico does not have mandatory cybersecurity training. Previously, the state purchased training through SANS for all agencies to take advantage of using bulk pricing, but this was not renewed as other alternatives were explored. Those purchases are currently on hold.

New York

New York provides SANS training for the general public. Website

North Carolina

North Carolina’s Statewide Information Security Manual  requires each agency to provide training and annual assessments of cybersecurity issues on an agency-by-agency basis.

North Dakota

North Dakota puts out cybersecurity practices and protocols for state government employees. 

Ohio Ohio requires annual cybersecurity awareness training.  
Oklahoma

Oklahoma has voluntary cybersecurity training. The Oklahoma Department of Homeland Security has a webpage with cybersecurity tips. Agencies must, however, present security awareness information to all current employees and new hires. 

Oregon

Oregon requires each state agency to have a cybersecurity plan under which all employees, volunteers and third-party users receive appropriate cybersecurity awareness training and regular updates on policies and procedures 

Pennsylvania

Pennsylvania has mandatory online cybersecurity awareness training for all state government employees. 

Rhode Island Rhode Island has voluntary cybersecurity training
South Carolina South Carolina’s cyber training is voluntary. The state offers training a program through DHS to state government employees. Website. State training: Cybersecurity Security and Cybersecurity Training Employee Guide.  
South Dakota

South Dakota’s cybersecurity training is voluntary.  

Tenessee

Tennessee cybersecurity protocols say state employees should utilize state-provided cybersecurity and awareness training when first employed and the annually. 

Texas

If required, cybersecurity would be done on an agency-by-agency basis. All state agencies are required to submit a state cybersecurity plan to the state and the Texas Department of Information Resources develops strategies to maintain information security. 

Utah

Utah has mandatory cybersecurity training.  

Vermont

Vermont has mandatory cybersecurity awareness training for all new state employees. 

Virginia

Virginia has required agency-by-agency state employee cybersecurity training. 

Washington

Washington does not have public information available on cybersecurity training. Response to cyberattacks is part of Washington's Emergency Management Strategic Plan

West Virginia

West Virginia has mandatory annual training on cybersecurity and privacy

Wisconsin

Wisconsin’s cybersecurity training is voluntary for employees and the general public. 

Wyoming

Wyoming has contracted out to the private sector for state employee cybersecurity training. Press Release. There is a cybersecurity awareness web page for the public.