Report Legislative Information Technology 2023 Survey

Summary

The needs of state legislatures and legislative IT offices evolve over time. This can be due to changes in technology, labor markets, leading practices or in response to major events like the COVID-19 pandemic.

To explore the impact of changing events and priorities on state legislative IT offices over the past several years, NCSL sent key legislative IT contacts (CIOs, IT directors or managers, referred to here as key contacts) an online survey in August 2023. The survey focused on IT staffing, cybersecurity and trends in legislative technology.

Twenty-six IT staff in 23 states responded, including a range of small, medium and large offices. Thirteen of the key contacts who responded were from states where a single, central IT office supports the entire legislature, six were from IT offices that support the legislative office along with other chambers but not caucus staff, and seven provide IT services to a single chamber.

The survey posed questions largely drawn from three previous surveys, which looked at the impact of the COVID-19 pandemic on IT offices (2021), trends in legislative technology (2020) and cybersecurity in legislatures (2018). In addition, the survey asked respondents about their current and planned use of AI tools and applications.

Compared to previous years, the results from the 2023 survey appear to indicate more uncertainty over the future of remote work for IT staff. In particular, legislative IT offices are experiencing more challenges related to attracting and retaining staff, including the perception by some key contacts that compensation and the ability to remote work are likely to impact their candidate pools. More survey respondents in 2023 also reported: (1) having a CISO and other full time IT security staff positions; (2) providing IT and cybersecurity training to legislators and legislative staff; and (3) that combating security threats and taking increased security measures was “Very Important.” Lastly, five respondents reported that their office was currently using AI tools, while over half of respondents indicated they are considering use of AI tools.

Survey results are broken up into three summary sections below, followed by tables with more detailed survey results, which in some instances include comparisons to the survey results from previous years.

Legislative IT Staffing

Many of the questions about IT staffing were modeled after questions from a 2021 NCSL survey. Results from the two surveys are compared in the following discussion, as well as in the Full Survey Results below.

Legislative IT Staffing

Around two-thirds of key contacts in 2023 reported employing 11 to 50 full-time IT staff, and exactly half reported hiring at least one part-time or session-only employee.

Remote Work

Over a third of key contacts (35%) reported that all IT employees are currently allowed to work remotely at least one day a week at some point during the year. None of the key contacts reported allowing more than two days a week of remote work for all employees during regular or special sessions, though in many IT offices all employees were allowed to work remotely up to three days a week during the interim.

Remote work is not allowed for employees during regular or special sessions in over 55% of key contact offices, though there are some exceptions for special circumstances. Over 80% of key contacts reported that at least some remote work is allowed during the interim. 

When asked about the future of remote work for all IT employees, results from the 2021 and 2023 surveys showed many similarities. However, there appears to be both more and less uncertainty about the future of remote work in 2023, depending on the type of employee and circumstance.

Overall, survey results provided in the table above appear to indicate more uncertainty about remote work in 2023, given that the percentage of respondents choosing “Not sure/don’t know” increased across all three employment types compared to 2021. When answering about remote work for all IT employees in their office, fewer key contacts in 2023 reported that it would “definitely be allowed” or “likely not be allowed” in the future, with a corresponding increase in “Not sure/don’t know.” For certain positions, a higher proportion of key contacts indicated both that remote work would “definitely be allowed” in the future, and that they weren’t sure or did not know. Lastly, a higher degree of certainty was expressed in 2023 that remote work “will definitely be allowed” in the future in limited or special circumstances, which corresponded with a decrease in responses saying it would “likely not be allowed.”

Filling Vacancies

Some key contacts provided additional insights about IT staffing in general, including for staff vacancies and remote work. Many of the comments mentioned challenges with retirements and in providing competitive salaries and career growth opportunities for new employees. Key contacts from two medium sized offices reported:

“We are finding it very difficult to compete with the salary of private sector, due to recent inflation and changes to state retirement benefits for new employees. Also, new generations of workers won't apply unless we offer 100% remote.”

“We recently posted a software engineer position with hybrid, and we received over 100 applications. This is much more than before when we were in the office five days a week.”

Cybersecurity in Legislatures

Legislative IT key contacts also responded to several questions about cybersecurity, which were based on questions asked in a 2018 NCSL survey.

Cybersecurity Staff

In 2023, 58% of respondents reported having a Chief Information Security Officer (CISO) in their office compared to 28% who reported having one in the 2018 survey. Of the offices that have a CISO, more than half reported they had been working in their current position for less than five years in 2023, compared to 22% in 2018. According to key contacts in 2023, this corresponds in part with recently created CISO positions. Some of the respondents that do not employ a CISO reported they either share related duties among multiple legislative IT security staff, or the duties are held by the legislative IT office director.

Well over a third of 2023 respondents (42%) reported employing full time IT security staff or analysts in addition to or other than a CISO, compared to a quarter of respondents (26%) who reported doing so in 2018. For 2023 key contacts, this included smaller IT offices (with a total of 1 to 10 staff total), medium-sized offices, and one of the larger offices (those with more than 50 full-time IT staff). No office reported having more than four staff dedicated to IT security.

Cybersecurity Budget

Roughly two thirds of key contacts reported that their IT budget is not called out as a separate line item. For offices that do call it out separately, three reported that 1% to 3% of their total IT budget is dedicated to cybersecurity and five reported it is more than 3%.

Executive Branch Services

As shown in the charts below, 42% of respondents to the 2023 survey reported that the executive branch provides cybersecurity services to their legislature or chamber, compared to 50% of similar respondents who reported receiving them in a 2018 survey.

In the most recent survey, 11 out of 26 respondents reported receiving some kind of IT service from the executive branch, including:

• ISP and perimeter network security monitoring.
• State firewall, state managed network and use of enterprise subscriptions.
• General responsibility for cyber security with partnership from legislative staff.
• Weekly scans of public-facing systems and additional assistance as requested.

In comparison, 15 out of 30 respondents to the 2018 survey reported using some form of executive branch services, including:

• Information sharing and security training.
• Firewall and Perimeter monitoring.
• Participation in interagency groups.
• Internet service provision.
• Advanced malware detection.
• Filters for email SPAM and phishing attacks.

Cybersecurity Training

Sixty-four percent of 2023 key contacts provide IT/cybersecurity training for legislators, more than double the 31% who reported doing so in 2018. Similarly, 92% of 2023 key contacts reported providing IT/cybersecurity training to legislative staff, compared to 48% in 2018.  

Trends in Legislative Information Technology

The 2023 survey asked two multipart questions related to technology trends that also appeared in a NCSL survey from 2020. In addition, this section of the 2023 survey asked participants about the use of AI tools by their office, as well as by legislators and legislative staff.

Use of AI

Five of the 2023 survey respondents reported their office was currently using AI tools, primarily for cybersecurity and transcription. However, half of respondents indicated they or their staff are currently considering use of AI tools, including for help desk support, proofing or document summarization, and as part of other third-party applications.

Six respondents were aware of legislators or non-IT staff that had or were currently using AI tools for transcription, informational mailers, summaries and for advanced searching. Specific tools included ChatGPT, Bing and Bard.

Legislative IT Management Issues

The survey asked respondents to rank five issues on a scale of not challenging to very challenging. The issues included: (1) limited budgets, (2) finding/retaining skilled IT staff, (3) keeping up with changing priorities or new technologies, (4) keeping up with security threats and (5) getting support from or an equal “seat at the table” with legislative leadership or upper management.

Respondents were asked the same questions in a 2020 survey, and a side-by-side comparison between years can be found in the Full Survey Results section below. Results from 2023 are illustrated in the following chart.

In 2023, over 60% of respondents stated that finding and retaining skilled legislative IT staff was a “Very Challenging” issue, nearly double the percentage of respondents who said so in 2020. Among various impediments to hiring and retention, respondents identified salary and remote work restrictions as major factors.

The next two most challenging issues in 2023, keeping up with security threats and keeping up with changing priorities or new technologies, were reported as being “challenging” or “very challenging” by 96% and 92% of respondents respectively. A similar number of respondents, 96%, reported the same for both issues in 2020. However, in 2020 more respondents found both issues “very challenging” compared to those who said so in 2023.

Future IT Project Priorities

The survey also asked respondents to rank 14 different projects in terms of priority for their office in the next one to three years. The top three responses from this survey and those from the 2020 survey are listed below.

Though combating security threats and taking increased security measures was in the top three for both survey years, it was ranked very important by nearly 25% more respondents in 2023 compared to 2020. The other top two priorities, as identified by key contacts, changed between the two survey years, which may reflect shifting needs from during and after the COVID-19 pandemic, when many legislative IT offices sought new options to enable and enhance remote participation in legislative proceedings.

Full Survey Results

Legislative IT Staffing and Remote Work

1. What is the total number of full-time IT staff employed in your agency/office/chamber?

2. What is the total number of part-time or session-only IT staff employed in your agency/office/chamber?

3. Does your office allow remote work for IT employees? (Check as many as apply)

NOTE: Because respondents were allowed to choose multiple responses, percentages do not add to 100%. See Table 10 of the 2021 survey to compare results between 2021 and 2023.

4. How many days a week are IT employees generally able to work from home or a remote location? (Please check as many as apply)

5. Will your office allow remote work for IT employees in the future? (Check as many as apply)

6. If your office will or is likely to allow remote work for IT employees in the future, how many days a week do you anticipate that they will be able to work from home or a remote location? (Please check as many as apply)

NOTE: See Table 12 of the 2021 survey to further compare results between years.

Cybersecurity in Legislatures

7. Does your legislature/chamber have a Chief Information Security Officer (CISO) or equivalent? (This would be a full-time staff person dedicated to, and authorized to oversee, IT security for the legislature.)

8. How long has your CISO or equivalent been employed by the legislature?

9. Does the legislature have full-time IT security analysts/IT security staff (in addition to or other than a CISO)?

10. How many full-time IT security analysts/IT security staff does the legislature have (in addition to or other than a CISO)?

11. Does the executive branch provide cybersecurity services for the legislature/your chamber?

12. Approximately how much of your total IT budget is dedicated to cybersecurity?

NOTE: In addition to "Don't know," the 2018 survey provided respondents with the option "Preferred not to answer," which was not an option in the 2023 survey.

13. Does your office provide IT/cybersecurity training for legislators?

14. Does your office provide IT/cybersecurity training for legislative staff?

Trends in Legislative Information Technology

15. Please identify how challenging the following issues are for you as a technology manager.

16. Are you or your IT staff currently using any AI tools or applications?

17. Are you or your IT staff considering using any AI tools or applications?

18. Are you aware of any legislators or non-IT legislative staff who are using AI tools?

19. Which of the following projects do you expect to be a priority for your office in the next one to three years?

NOTE: "Implementing technology changes to comply with ADA and accessibility requirements" was a new addition in the 2023 survey, therefore results are not available from 2020.