As state and local governments operate under increasing threats of ransomware attacks, geopolitical threats, and breach attempts of citizens' personally identifiable information, cybersecurity awareness is on the rise in the non-federal public sector.

According to the 2022 Deloitte-NASCIO Cybersecurity Study, state-level cybersecurity is growing more mature as lawmakers and bureaucrats have started seriously responding to the risks at hand. Today, no state lacks a CISO, state-level budgets are on the rise, and many foundational cybersecurity controls are in place.

However, states still struggle with the cybersecurity talent gap, and they're dogged by legacy infrastructure that's not keeping pace with new technology and threats. What's more, municipalities are still very spotty in their cybersecurity strategy and execution, as there's very little cohesive guidance at the state level about municipal efforts to shore up protection and response.

The following are some key statistics and trends from this report, which is based on a survey of CISOs from 53 US states and territories.