1. Enterprise Cybersecurity Initiative Department of Information Technology Vince Martinez, State CIO, Executive Sponsor Lorenzo Ornelas, Managing Director Enterprise Services/Communications (Acting), Business Owner
April 23, 2019

2. Project Overview Agency Mission Business Need Project Purpose
DoIT provides IT leadership for the State, performs oversight for IT projects and procurements, and delivers enterprise IT services to the State’s executive agencies
Business Need
While cybersecurity must underlie everything that IT does in the state, dedicated resources, time and money are hard to come by.
Cybersecurity threats are more costly, more frequent, more complex, and have greater potential to deliver damage than ever before.
Cybersecurity incidents currently are identified and remediated on a case-by- case basis, but need to be addressed on a statewide basis
Project Purpose
Strengthen the state’s cybersecurity posture and support the effort to operationalize security policies, procedures, and activities across the State’s enterprise.

3. Project Objectives Objectives
Complete a statewide vulnerability assessment as a baseline upon which to define near term security mitigation strategies
Create a robust CISO office by leveraging multiple vendor contracts;
Create an enterprise library of security policies;
Mature the state’s incident response abilities in partnership with vendors and state agencies; and,
Utilize enterprise solutions across the state, with strong executive support for all-agency participation.

4. PRODUCTS and DELIVERABLES
Approach
PHASE
WORK TO BE PERFORMED
PRODUCTS and DELIVERABLES
PHASE I
Initiation and planning
Charter
Project Management Plan
Vulnerability Assessment
Contract Requirements
CISO Plan
PHASE II
Planning for foundational cybersecurity framework for the enterprise
Current State Assessment
Stakeholder/Partner Approach
Define Governance Structure
Outline Policy Library
PHASE III
Implementation for initial enterprise concept of operations; policy library; operationalize governance structure and partnership plan
Enterprise Cybersecurity Governance
Policies and Procedures Library
Security Operations Center
Threat/Monitoring Tools
PHASE IV
Standardization and stabilization
Fully operationalized cybersecurity enterprise framework

5. Approach (cont’d)
Initial focus on current statewide vulnerability assessment and planning to build robust enterprise framework, including external communities (Higher Education, other partners)
Contractor support coupled with in-house involvement
Project management
State CISO search, supported by multi-vendor Virtual CISO (VCISO) while CISO is recruited
Incident Response team
Schedule to be developed during Initiation phase

6. Funding and Certification
Requested $3 million for project; $1 million appropriated
Requesting Certification Change to release $619,228.93
In support of immediate statewide vulnerability assessment
Project management support (initiation phase)
Develop schedule and initiation documents
FUNDING
FISCAL YEAR
FUNDING SOURCE
AMOUNT
2018
Laws of 2018, Chapter 73, Section 7 (11)
$1,000,000
TOTAL

7. Enterprise Cybersecurity Initiative
DoIT requests initiation certification
for the
Enterprise Cybersecurity Initiative