State CIOs cite cybersecurity, legacy modernization as top priorities; NASEO outlines funding options

Doug Robinson, executive director of the National Association of State Chief Information Officers, told the House Energy and Digital Infrastructure Committee on Wednesday, April 2, that state chief information officers continue to rank cybersecurity and legacy modernization among their top priorities and that financing models for state IT have shifted toward hybrids that mix agency chargebacks with targeted appropriations.

Robinson, testifying in a virtual session the committee livestreamed on YouTube, said his association’s annual survey of state CIOs showed cybersecurity as the No. 1 priority for the 12th consecutive year and listed legacy modernization and digital services among other top concerns. "If you've seen one state, you've seen one state," Robinson said, arguing that states vary widely in governance and funding but face the same broad pressures.

Robinson described common operating models—decentralized, federated and centralized/unified—and said most states today use a broker or federated model rather than a purely decentralized owner‑operator approach. He told lawmakers that about 90% of state CIO offices still use some form of chargeback (internal billing to agencies) for services, but only eight states are 100% chargeback. He said many states are moving to hybrid approaches that use general‑fund appropriations or dedicated modernization funds for core services such as enterprise cybersecurity.

On funding options, Robinson reviewed a range that legislative staff and committee members often consider: general‑fund appropriations for core services; dedicated technology modernization funds (recurring or one‑time); bonds or certificates of participation for capital projects; cooperative purchasing fees or procurement assessments; revolving loan funds that agencies repay; competitive innovation funds for pilot projects; and, historically, limited data‑sales arrangements where public records are bulk provided under contract. He said dedicated modernization funds in current practice range from about $1 million to $50 million and that some states use a competitive "Shark Tank" approach for innovation awards.

Robinson emphasized persistent barriers to modernization beyond financing: an insufficient or overburdened IT workforce, the need for business‑process redesign so agencies do not simply automate outdated workflows, and project governance and portfolio oversight. "Your IT cost is sunk in diversity and complexity," Robinson said, meaning states pay a premium for many different legacy systems rather than consolidating onto fewer platforms.

He also flagged the continuing role of federal funding for certain business lines, noting that Medicaid Management Information System (MMIS) modernizations are typically supported by the federal enhanced match and that federal funds remain an important source for some large programs. Robinson described successful examples nationwide of investment review boards, enterprise portfolio management and funds structured to require an agency contribution or in‑kind match to secure commitment from program owners.

Robinson took questions from Representative Scott Campbell, Representative Michael Southworth and other committee members about specific mechanisms such as revolving funds, agency matches and the practice of selling public data in bulk. He said data sales have been used in some states—often for driver records or e‑government portal revenues—but are less common than in past decades and can be controversial.

Committee members asked for examples and models to consider; Robinson pointed legislators to Michigan and California as examples of mature modernization funds and competitive innovation funds, respectively. He offered to provide additional materials and to answer follow‑up questions of committee staff.

Less urgent: Robinson noted NASEO represents the state CIOs in all 50 states, territories and the District of Columbia and that its findings are grounded in an annual CIO survey the organization conducts.

Ending: The committee paused for a brief question period after Robinson's presentation and then moved on to other interim business. Robinson said he would be available to provide more detailed documentation on specific funding mechanisms at the committee’s request.