State CISO outlines assessments, targets and projects as Oregon moves to stricter cybersecurity standards

The state’s chief information security officer briefed the General Government Subcommittee on May 14 on assessment results, mitigation priorities and several multi‑year projects aimed at raising agency cybersecurity posture.

Ben Gurizgeir, state chief information security officer, said Enterprise Information Services (EIS) uses Center for Internet Security (CIS) controls (version 8) as the baseline and now requires agencies to meet 70% of the first 56 safeguards; the goal is to reach higher maturity and expand adoption of the full control set in the next two to three years.

"We complete assessments of every state agency board and commission in a biennium," Gurizgeir said. He told the committee EIS is scheduling CIS assessments, web application…