2026 NASCIO-Deloitte Study Finds Falling State CISO Confidence and Tighter Cyber Budgets
Summary
The 2026 NASCIO-Deloitte study finds declining state CISO confidence in protecting public data, tighter cybersecurity budgets and widening skills gaps as AI expands threats and governance responsibilities.
Key points
- The 54-question survey, launched in October 2025, received responses from all 50 states, the District of Columbia and the US Virgin Islands; one response was partial.
- Only 22% of CISOs described themselves as extremely or very confident that state information assets were protected, down from 48% in 2022.
- Budget reductions were reported by 16% of CISOs, compared with none in 2024; only 22% reported increases of at least 6%, down from 40%.
- Third-party breaches were viewed as a coming-year threat by 78% of respondents, up from 44% in 2022.
- Some 94% of CISOs were involved in GenAI security policy development. Respondents warned that automatically enabled AI features could expose sensitive data and outpace governance.
- Roughly one-fifth reported fully or partially advancing whole-of-state cybersecurity support, while funding uncertainty and differing state-local responsibilities constrained expansion.
- Only 22% said their internal cybersecurity professionals had the competencies needed for existing and foreseeable requirements, down from 47% in 2024.
Article Details
- Publisher
- National Association of State Chief Information Officers (NASCIO) and Deloitte & Touche LLP
- Scope
- Biennial survey of state CISO cybersecurity strategy, governance, operations, funding, workforce, AI adoption and whole-of-state support.
- Sample Size
- CISOs from all 50 states, the District of Columbia and the US Virgin Islands answered a 54-question survey. One response was partial, leaving some questions with 51 responses. Survey information was not independently validated by the publishers.
- Key Statistics
- The share of CISOs extremely or very confident that state information assets were protected fell from 48% in 2022 to 22% in 2026.
- The share not very confident or not confident at all in protection of state information assets within local government and public higher education rose from 35% in 2022 to 63% in 2026.
- In the 2026 survey, 22% reported cybersecurity budget increases of at least 6%, compared with 40% in 2024; 16% reported budget reductions, compared with none in 2024.
- Only 22% of CISOs said internal cybersecurity professionals had the required competencies in 2026, down from 47% in 2024; eight of 51 reported significant competency gaps.
- In 2026, 94% of CISOs reported involvement in GenAI security policy development.
- Recommendations
- Track operational, compliance and risk-based cybersecurity effectiveness metrics, including incident response time and phishing click rate, to demonstrate investment benefits.
- Apply strong governance and risk controls to GenAI adoption, including risk assessments and security review during tool evaluation.
- Strengthen data classification, data loss prevention and employee education on data privacy and ethical AI use.
Countries
Industries
K-12educational entities (K-12 as well as public higher • “We currently have adopted a whole-of-stateLocal governmentrole in supporting local government and criticalpublic higher educationand public higher educationstate governmentsupport to entities outside of state government Among those respondents most positive about the