Cybersecurity Forum

Date: Wednesday, July 9, 2025
Time: 11:00 AM – 12:00 PM
Duration: ~62 minutes
Participants: 174 total attendees, including 61 state employees

Presenters:

• Vitaliy Panych, Chief Information Security Officer, California Department of Technology
• Chris Cruz, Moderator; Former Deputy State CIO
• Bill Maile, Host, TechCA

The forum was not recorded.

Summary:

The forum featured a discussion with State CISO Vitaliy Panych, moderated by Chris Cruz, focused on California’s cybersecurity posture and strategic initiatives. Panych detailed the responsibilities and operations of the Office of Information Security (OIS), the collaborative structure of the California Cybersecurity Integration Center (Cal-CSIC), audit and maturity metrics, and forward-looking priorities outlined in Cal-Secure, the state’s overall roadmap and framework to enhance the cyber resilience across departments and agencies, a preview of Cal-Secure 2.0, AI governance, and post-quantum security preparedness. The hour-long discussion also focused on cost-effective risk reduction, expanded support for local governments, and ongoing workforce development and cybersecurity training.

Key Points Made During the Meeting:

Organizational and Operational Overview

• OIS operates within the California Department of Technology (CDT), overseeing risk governance, policy development, and statewide security audits.
• Collaboration with Cal-CSIC – CDT, CalOES, CHP, and the Military Department, among others, ensures unified incident response and threat intelligence operations.
• Cal-CSIC has expanded from 6 to nearly 60 personnel and now functions as a centralized incident response and threat intelligence body.

Cal-Secure

• Launched in 2021 by the CDT in partnership with the CalOES. It was designed as a five-year cybersecurity roadmap to enhance the state’s cyber resilience across departments and agencies, with an expected end to its initial phase in October 2026.
• California’s statewide cybersecurity roadmap outlines strategic initiatives, technical capabilities, and governance frameworks to improve the security maturity of state agencies.
• Serves as a taxonomy for aligning risk reduction, funding priorities, and operational goals across departments.
• CDT’s Security Operations Center (SOC) supports ~115 departments and has enabled $54M in statewide cost avoidance.

OIS Audit Program and Maturity Metrics

• OIS expects to complete approximately 80 audits in 2025 within the high-risk multiyear cycle.
• Maturity scores follow a NIST CSF-aligned 0–4 scale, with departments seeing an incremental annual improvement.
• Audits support strategic risk reduction and inform funding priorities.

OIS Advisory and Remediation Services

• Services include strategic consulting, training, and assistance in audit response planning.

Statewide Workforce Development

• The Information Security Leadership Academy has graduated over 200 participants across nine cohorts.
• Additional programs: ISO 101/102, Cyber Scholars, training for security onboarding, and professional growth.

Statewide Budget Trends and Cost Efficiency

• Security investments increased over four years.
• Current maturity uplift trending is increased levels of maturity by measures of audits/assessments for less dollars spent for remediation efforts.
• Focus on tool consolidation, replatforming, and measurable outcomes in security spend.
• With more than 12,000 security tools in the industry, it’s a significant effort to stay updated.

Local Government Engagement

• CDT extending inherited security services (e.g., DMARC, DNS protection, vulnerability disclosures) to counties, cities, and school districts.
• 588 school districts, 280+ cities, and 57 counties now engaged with MS-ISAC and Cal-CSIC initiatives.

Cal-Secure 2.0 Preview

• Proposed potential topics for the future Cal-Secure’s beyond Year 5 in 2026.

• • Zero trust maturity and operationalization
  • AI risk governance
  • OT/ICS security and critical infrastructure
  • Third-party/supply chain risk
  • Post-Quantum Cryptography (PQC) readiness
  • Workforce succession, diversity, and inclusion

Emerging Threats and Technology

• AI is increasingly used in phishing and business email compromise attacks.
• “Harvest now, decrypt later” tactics reinforce the need for PQC readiness.
• Emphasis on standardization and future-proofing through automation and scalable controls.

Training and Career Development

• Encouragement for aspiring cybersecurity professionals to join associations (e.g., ISSA, ISACs) and local community groups (e.g., DEFCON groups).
• CDT to plan to broaden access to training for early-career practitioners.