Record-breaking Participation in National Cybersecurity Review Sparks Optimism

Record-breaking Participation in National Cybersecurity Review Sparks Optimism

At a glance

• Record turnout: 4,210 state, local, tribal and territorial (SLTT) organizations completed the 2023 Nationwide Cybersecurity Review (NCSR), up 14% from the year before.
• Small gains: Returning participants improved their cyber maturity scores by about 4% year over year.
• Funding is the top worry: Most respondents said they lack money for security, and many run with fewer than five dedicated security staff.
• Free help exists: CIS points SLTT governments to no-cost services from CISA and the MS-ISAC, including the review itself.

More public bodies took the assessment than ever

The NCSR is a free, voluntary self-assessment for U.S. state, local, tribal and territorial governments, sponsored by the U.S. Department of Homeland Security (DHS) and run by the Multi-State Information Sharing and Analysis Center (MS-ISAC), which is part of the Center for Internet Security (CIS). Results from the 2023 cycle came out in December 2024. Turnout hit a record. K-12 school districts also set a participation high.

“We are encouraged by the record high participation in this year’s NCSR,” said Tyler Scarlotta, member programs manager at CIS. He added that organizations taking part two or more years scored 23% higher than first-timers.

Scores rose for repeat participants

The review measures maturity against the NIST Cybersecurity Framework on a seven-point scale. CIS wants governments to reach a 5. Most state-level organizations scored 4 or higher, while local bodies, which make up the bulk of participants and often have one or two IT people covering everything, trailed well behind them.

The stronger areas were identity management and access control, awareness training, environment monitoring and incident mitigation planning. Weaker spots were risk management, testing of response and recovery plans, and disaster recovery. Those gaps point to work that money and staff time can fix.

Shared services do much of the heavy lifting

Many smaller governments cannot build a security team of their own. CIS recommends federally funded services such as the MS-ISAC’s round-the-clock threat monitoring and Malicious Domain Blocking and Reporting, a protective DNS service.

DHS turns the anonymized NCSR data into a summary report to Congress every two years. Lawmakers see it.

The concerns that respondents listed have not changed for nine straight years: too little funding, more sophisticated threats, emerging technology, missing incident procedures and a shortage of security professionals.

What the numbers mean for next year’s cycle

Funding remains the sticking point. In the 2023 results, lack of money topped the list, and most organizations said they employ fewer than five people dedicated to security.

CIS also advises governments to test their recovery plans, write down incident procedures, and report security metrics to executives to justify budget requests.

The next cycle opens in October. Anyone can register.

A higher turnout with uneven scores

More public bodies are measuring their security, and the ones that keep at it year after year are improving. The data also shows how thin local teams are. Without steady funding and staff, a self-assessment can only do so much.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.