Legislative IT outlines cybersecurity posture, pushes MFA enrollment and ongoing training

Legislative IT officials briefed the House Energy and Digital Infrastructure Committee on their cybersecurity posture, metrics and planned actions, and urged legislators to enroll in multifactor authentication to protect access to legislative systems.

The briefing matters because legislative email and internal systems contain official records and constituent contact information; weak access controls or successful phishing could disrupt legislative business or expose sensitive information.

Kevin Moore, director of IT for the General Assembly, said the office focuses on “building resilience, not just the stop threats — to adapt and recover quickly in the event that there is an incident.” Moore described core safeguards in place — encryption of devices and data in transit and at rest, multifactor authentication, next-generation firewalls, network segmentation, extended detection and response (XDR) tools and automated threat-intelligence feeds — and outlined metrics showing active threats to the legislature’s internet-facing footprint.

Moore said the team ingests external feeds such as the Multi-State…