State Cybersecurity Training for State Employees


Almost every state offers cybersecurity training for executive branch state employees. In most states, this training is voluntary.  The chart below briefly describes the type of training offered in each state and provides links if available to state cyber training resources.  

The box allows you to conduct a full text search or type the state name.

State Cybersecurity Training for State Employees

Alabama offers voluntary training with online training opportunities. Cybersecurity training is indirectly authorized by Alabama Code Title 41, Section 28, Articles 1-8, that gives the executive branch secretary of information technology the authority to develop state employee cybersecurity protocols. Website


Alaska provides a training corner, threat indicator and MS-ISAC’s cyber “tip of the day.” Alaska’s Department of Administration, Enterprise Technology Services division developed the cybersecurity website for the state. Website


In Arizona, cybersecurity training is incorporated into the Arizona IT strategic plan under goal 1.4. The Arizona chief information officer develops the IT strategic plan.


Arkansas provides voluntary cybersecurity training developed by the state of Arkansas Department of Information Systems, Cybersecurity Office. Website


California’s cybersecurity training is voluntary and there are several training opportunities. Individual state agencies like the Department of Motor Vehicles and the Franchise Tax Board may have mandatory cybersecurity trainings. California’s new CIO has been discussing the possibility of mandatory cybersecurity training. Website


Colorado’s cybersecurity training is mandatory for state employees and statutorily required under the Colorado Information Security Act. Website


The Connecticut Department of Administrative Services offers in-service courses in cybersecurity awareness for non-IT personnel in partnership with Connecticut community colleges. Website  

Delaware Delaware offers annual statewide cybersecurity training for state and local government employees. Mandatory cybersecurity training for all executive branch agency employees, which was developed by the Delaware Department of Technology and Information pursuant to authority granted to it by Delaware Code Title 29, Chapter 90C, is part of the state’s strategic plan. Website  

Florida has mandatory cybersecurity training for state employees as required by Florida Statutes Chapter 282. Website  


Georgia’s cybersecurity training is voluntary training and is offered by the Georgia Technology Authority. Website  


Hawaii has no formalized cybersecurity training, but has a state webpage dedicated to cybersecurity with tips and a toolkit. Website


Idaho’s state webpage  contains several training videos and tools for state employees. Website


In Illinois, Cook County provides cybersecurity training.  


Indiana’ state webpage contains cybersecurity information, but no localized training materials for state employees. The state also created an Executive Council on Cybersecurity in 2016 and created a webpage with security awareness training materials to help inform citizens on how to stay safe on the internet. 


Iowa has voluntary cybersecurity awareness training produced by the executive branch. Website


The Kansas Office of Information Technology Services webpage has self-assessment cybersecurity tools. Website


Kentucky hosts annual trainings for state government employees during October, Cybersecurity Awareness Month.


Louisiana has mandatory cybersecurity  training for new employees and annual training for all employees  pursuant to the Louisiana Division of Administration, Office of Technology Services p.52.


Maine offers voluntary cybersecurity training for new employees through the Maine Office of Information Technology. Website


Maryland requires state employee cybersecurity training through the Department of Homeland Security. State agency personnel have to take a cybersecurity class each month to gain access to state networks. Website  


Massachusetts’ cybersecurity training is voluntary. The Massachusetts National Guard cybersecurity battalion provides cybersecurity awareness training and education to state, municipal and private sector entities. 

Michigan Michigan offers online state employee cybersecurity training

Minnesota offers cybersecurity services to employees and residents. Website


Mississippi provides online cybersecurity training for state employees through an outside college. Website


Missouri has an employee tips webpage. Website 


Montana has mandatory executive branch state employee cybersecurity training upon hiring and then annually. Cybersecurity Training and Awareness Program. Legislative branch employees are not required to take cybersecurity training, but are encouraged to do so.


Nebraska has mandatory annual cybersecurity training and a refresher course for all state employees as outlined in department regulation. Website

Nevada has required agency-by-agency state employee cybersecurity training; with passing grade required at new hire then annual thereafter. State Security Standard 123 – IT Security Awareness Training
New Hampshire

New Hampshire requires mandatory cybersecurity training for state employees annually through executive order. 

New Jersey

New Jersey’s cybersecurity training is voluntary. There is an online cyber hygiene video.

New Mexico

Due to budget constraints, New Mexico does not have mandatory cybersecurity training. Previously, the state purchased training through SANS for all agencies to take advantage of using bulk pricing, but this was not renewed as other alternatives were explored. Those purchases are currently on hold.

New York

New York provides SANS training for the general public. Website

North Carolina

North Carolina’s Statewide Information Security Manual  requires each agency to provide training and annual assessments of cybersecurity issues on an agency-by-agency basis.

North Dakota

North Dakota puts out cybersecurity practices and protocols for state government employees. 

Ohio Ohio requires annual cybersecurity awareness training.  

Oklahoma has voluntary cybersecurity training. The Oklahoma Department of Homeland Security has a webpage with cybersecurity tips. Agencies must, however, present security awareness information to all current employees and new hires. 


Oregon requires each state agency to have a cybersecurity plan under which all employees, volunteers and third-party users receive appropriate cybersecurity awareness training and regular updates on policies and procedures 


Pennsylvania has mandatory online cybersecurity awareness training for all state government employees. 

Rhode Island Rhode Island has voluntary cybersecurity training
South Carolina South Carolina’s cyber training is voluntary. The state offers training a program through DHS to state government employees. Website. State training: Cybersecurity Security and Cybersecurity Training Employee Guide.  
South Dakota

South Dakota’s cybersecurity training is voluntary.  


Tennessee cybersecurity protocols say state employees should utilize state-provided cybersecurity and awareness training when first employed and the annually. 


If required, cybersecurity would be done on an agency-by-agency basis. All state agencies are required to submit a state cybersecurity plan to the state and the Texas Department of Information Resources develops strategies to maintain information security. 


Utah has mandatory cybersecurity training.  


Vermont has mandatory cybersecurity awareness training for all new state employees. 


Virginia has required agency-by-agency state employee cybersecurity training. 


Washington does not have public information available on cybersecurity training. Response to cyberattacks is part of Washington's Emergency Management Strategic Plan

West Virginia

West Virginia has mandatory annual training on cybersecurity and privacy


Wisconsin’s cybersecurity training is voluntary for employees and the general public. 


Wyoming has contracted out to the private sector for state employee cybersecurity training. Press Release. There is a cybersecurity awareness web page for the public.